1 .\" netsniff-ng - the packet sniffing beast
2 .\" Copyright 2013 Daniel Borkmann.
3 .\" Subject to the GPL, version 2.
4 .TH FLOWTOP 8 "03 March 2013" "Linux" "netsniff-ng toolkit"
6 flowtop \- top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow tracking
10 \fBflowtop\fP { [\fIoptions\fP] }
14 flowtop is a top-like connection tracking tool that can run on an end host or
15 small home router. It is able to present TCP, UDP/UDP-lite, SCTP, DCCP, and
16 ICMP(v6) flows that have been collected by the kernel's netfilter connection
17 tracking framework, thus no packet capturing in user space needs to be done.
19 flowtop is able to give you a quick overview of current connections on your
20 local system, e.g. for debugging purposes or to answer questions like:
22 * If you access website X, what other connections are being opened in
23 the background that I'm not aware of?
24 * What connections are active that pass one's router?
25 * I have this proprietary binary Y, to where does it connect?
26 * To which countries am I sending data?
27 * Are there any suspicious background connections on my machine?
28 * How many active connections does binary Y have?
29 * How long are connections active already?
30 * At which rate am I sending/receiving data?
32 The following information will be presented in flowtop's output:
34 * Application name and PID when run on local machine
35 * Reverse DNS for source and destination
36 * Geo-location information (country, city)
37 * Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...)
38 * Flow port's service name heuristic
39 * Transport protocol state machine information
40 * Byte/packet counters (if they are enabled)
41 * Connection duration (if timestamping is enabled)
42 * Flow send/receive rate (if byte/packet counters are enabled)
44 In order for flowtop to work, netfilter must be active and running
45 on your machine, thus kernel-side connection tracking is active. If netfilter
46 is not running, you can activate it with
50 iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
52 iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
55 or by loading the following kernel modules:
58 modprobe nf_conntrack_ipv4
60 modprobe nf_conntrack_ipv6
63 To dump byte/packet counters flowtop enables the
65 parameter \fBnet.netfilter.nf_conntrack_acct\fP via:
68 echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct
71 and resets it to the previously set value on exit. These counters will only be
72 active on connections which were created after accounting was enabled. Thus, to
73 have these counters be active all the time the parameter should be enabled after
74 the system is up. To automatically enable it,
80 To calculate the connection duration flowtop enables the
82 parameter \fBnet.netfilter.nf_conntrack_timestamp\fP via:
85 echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp
88 and resets it to the previously set value on exit.
90 flowtop's intention is just to get a quick look over your active connections.
91 If you want logging support, have a look at netfilter's
98 Display IPv4 flows. That is the default when flowtop is started without
102 Display IPv6 flows. That is the default when flowtop is started without
106 Display TCP flows. That is the default when flowtop is started without
110 Display UDP and UDP-lite flows.
116 Display ICMP version 4 and version 6 flows.
122 Don't perform hostname lookup. Only numeric addresses will be shown for flow
126 Don't perform GeoIP lookup. No geographical information will be shown for flow
130 Also show source information of the flow, not only destination information.
133 Show flow rates in bits per second instead of bytes per second.
136 The built-in database update mechanism will be invoked to get Maxmind's
137 latest database. To configure search locations for databases, the file
138 /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save
139 bandwidth or for mirroring Maxmind's databases (to bypass their traffic
140 limit policy), different hosts or IP addresses can be placed into geoip.conf,
141 separated by a newline.
143 .B -t <time>, --interval <time>
144 Flow info refresh interval in seconds, default is 1s.
147 Show version information and exit.
150 Show user help and exit.
155 Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP.
158 This example enables the maximum display options for flowtop.
162 Files under /etc/netsniff-ng/ can be modified to extend flowtop's
163 service resolution and lookup information.
165 * tcp.conf - TCP port/services map
166 * udp.conf - UDP port/services map
167 * geoip.conf - GeoIP database mirrors
170 With a fairly high rate of connection tracking updates, flowtop can become
171 unresponsive for short periods of time while scrolling. The right fix would
172 be to replace flowtop's connection management backend with a better design
173 with respect to the locking approach. This is still on the "todo" list.
176 flowtop is licensed under the GNU GPL version 2.0.
180 was originally written for the netsniff-ng toolkit by Daniel Borkmann. It
181 is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel
182 Borkmann <dborkma@tik.ee.ethz.ch>.
190 .BR astraceroute (8),
198 Manpage was written by Daniel Borkmann.
201 This page is part of the Linux netsniff-ng toolkit project. A description of the project,
202 and information about reporting bugs, can be found at http://netsniff-ng.org/.