tracetop

tracetop shows a live update of the busiest flows over time, performing a similar function to the 'top' tool in Unix.

Usage

    tracetop
         [ -f exp, --filter=exp ]
         [ -s len, --snaplen=len ]
         [ -p mode, --promisc=mode ]
         [ --bits-per-sec ]
         [ --percent ]
         [ -i secs, --interval=secs ]
         inputURI [inputURI ...]

Options

-f, --filter Apply a BPF filter to the input trace(s).

-s, --snaplen Snap captured packets to the given length.

-p, --promisc If 1, enable promiscuous mode on the input (if supported). If 0, disable promiscuous mode.

--bits-per-sec Display flow bandwidth as bits per second.

--percent Display flow bytes and packets as a percentage of total traffic.

-i, --interval Wait this many seconds between updates. Defaults to 2 seconds.

Applications

Monitoring a live network to pick out large flows:

    tracetop -p 1 --percent --bits-per-sec int:eth0

Notes

• If tracetop is run against a trace file, it will operate in trace time (i.e. preserving all timing gaps that were between the packets when they were originally captured).
• tracetop is a nice way to get a quick look at how your network is performing and what might be using up all your bandwidth.