1.簡介

iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?".

iftop監聽網絡（和top監聽cpu使用狀态類似），通過監聽指定的網口，來展示目前的帶寬使用率，用于解答"您的adsl網絡連結為何如此之慢”的問題

項目位址：http://www.ex-parrot.com/pdw/iftop/

用途

對定位機器上的流量異常問題，和服務間調用問題比較有用。

2.安裝

有兩種安裝方式

yum/apt安裝
源碼編譯安裝

2.1 yum/apt

#Ubuntu
sudo apt install -y iftop/xenial
#Centos
sudo yum install -y  iftop.x86_64

2.2 源碼編譯安裝

2.2.1 預裝系統包

#Ubuntu
sudo apt-get install flex byacc  libpcap0.8 libncurses5
#Centos
sudo yum install -y flex byacc libpcap ncurses-devel libpcap-devel

2.2.2 編譯安裝iftop

#下載下傳iftop的安裝包
wget http://www.ex-parrot.com/pdw/iftop/download/iftop-0.17.tar.gz
#解壓縮iftop的安裝包
tar xzvf iftop-0.17.tar.gz
#進入對應目錄
cd iftop-0.17/
#配置
sudo ./configure
#編譯
sudo make
#安裝
sudo make install

3. 運作iftop

3.1 幫助

執行iftop -h

iftop: display bandwidth usage on an interface by host

Synopsis: iftop -h | [-npblNBP] [-i interface] [-f filter code]

[-F net/mask] [-G net6/mask6]

-h display this message

-n don't do hostname lookups

-N don't convert port numbers to services

-p run in promiscuous mode (show traffic between other

hosts on the same network segment)

-b don't display a bar graph of traffic

-B display bandwidth in bytes

-a display bandwidth in packets

-i interface listen on named interface

-f filter code use filter code to select packets to count

(default: none, but only IP packets are counted)

-F net/mask show traffic flows in/out of IPv4 network

-G net6/mask6 show traffic flows in/out of IPv6 network

-l display and count link-local IPv6 traffic (default: off)

-P show ports as well as hosts

-m limit sets the upper limit for the bandwidth scale

-c config file specifies an alternative configuration file

-t use text interface without ncurses

Sorting orders:

-o 2s Sort by first column (2s traffic average)

-o 10s Sort by second column (10s traffic average) [default]

-o 40s Sort by third column (40s traffic average)

-o source Sort by source address

-o destination Sort by destination address

The following options are only available in combination with -t

-s num print one single text output afer num seconds, then quit

-L num number of lines to print

可以看到有很多選項，這裡我分享一些常見用法示例