1 .\" netsniff-ng - the packet sniffing beast
2 .\" Copyright 2013 Daniel Borkmann.
3 .\" Subject to the GPL, version 2.
4 .TH FLOWTOP 8 "03 March 2013" "Linux" "netsniff-ng toolkit"
6 flowtop \- top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow tracking
10 \fBflowtop\fR { [\fIoptions\fR] }
14 flowtop is a top-like connection tracking tool that can run on an end host or
15 small home router. It is able to present TCP, UDP/UDP-lite, SCTP, DCCP, and
16 ICMP(v6) flows that have been collected by the kernel's netfilter connection
17 tracking framework, thus no packet capturing in user space needs to be done.
19 flowtop is able to give you a quick overview of current connections on your
20 local system, e.g. for debugging purposes or to answer questions like:
22 * If you access website X, what other connections are being opened in
23 the background that I'm not aware of?
24 * What connections are active that pass one's router?
25 * I have this proprietary binary Y, to where does it connect?
26 * To which countries am I sending data?
27 * Are there any suspicious background connections on my machine?
28 * How many active connections does binary Y have?
30 The following information will be presented in flowtop's output:
32 * Application name and PID when run on local machine
33 * Reverse DNS for source and destination
34 * Geo-location information (country, city)
35 * Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...)
36 * Flow port's service name heuristic
37 * Transport protocol state machine information
39 In order for flowtop to work, netfilter must be active and running
40 on your machine, thus kernel-side connection tracking is active.
42 flowtop's intention is just to get a quick look over your active connections.
43 If you want logging support, have a look at netfilter's conntrack(8) tools
49 Display IPv4 flows. That is the default when flowtop is started without
53 Display IPv6 flows. That is the default when flowtop is started without
57 Display TCP flows. That is the default when flowtop is started without
61 Display UDP and UDP-lite flows.
67 Display ICMP version 4 and version 6 flows.
73 Also show source information of the flow, not only destination information.
76 The built-in database update mechanism will be invoked to get Maxmind's
77 latest database. To configure search locations for databases, the file
78 /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save
79 bandwidth or for mirroring Maxmind's databases (to bypass their traffic
80 limit policy), different hosts or IP addresses can be placed into geoip.conf,
81 separated by a newline.
84 Show version information and exit.
87 Show user help and exit.
92 Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP.
95 This example enables the maximum display options for flowtop.
99 Files under /etc/netsniff-ng/ can be modified to extend flowtop's
100 service resolution and lookup information.
102 * tcp.conf - TCP port/services map
103 * udp.conf - UDP port/services map
104 * geoip.conf - GeoIP database mirrors
107 With a fairly high rate of connection tracking updates, flowtop can become
108 unresponsive for short periods of time while scrolling. The right fix would
109 be to replace flowtop's connection management backend with a better design
110 with respect to the locking approach. This is still on the "todo" list.
113 flowtop is licensed under the GNU GPL version 2.0.
117 was originally written for the netsniff-ng toolkit by Daniel Borkmann. It
118 is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel
119 Borkmann <dborkma@tik.ee.ethz.ch>.
127 .BR astraceroute (8),
131 Manpage was written by Daniel Borkmann.
134 This page is part of the Linux netsniff-ng toolkit project. A description of the project,
135 and information about reporting bugs, can be found at http://netsniff-ng.org/.