1.简介

iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question "why is our ADSL link so slow?".

iftop监听网络（和top监听cpu使用状态类似），通过监听指定的网口，来展示当前的带宽使用率，用于解答"您的adsl网络链接为何如此之慢”的问题

项目地址：http://www.ex-parrot.com/pdw/iftop/

用途

对定位机器上的流量异常问题，和服务间调用问题比较有用。

2.安装

有两种安装方式

yum/apt安装
源码编译安装

2.1 yum/apt

#Ubuntu
sudo apt install -y iftop/xenial
#Centos
sudo yum install -y  iftop.x86_64

2.2 源码编译安装

2.2.1 预装系统包

#Ubuntu
sudo apt-get install flex byacc  libpcap0.8 libncurses5
#Centos
sudo yum install -y flex byacc libpcap ncurses-devel libpcap-devel

2.2.2 编译安装iftop

#下载iftop的安装包
wget http://www.ex-parrot.com/pdw/iftop/download/iftop-0.17.tar.gz
#解压缩iftop的安装包
tar xzvf iftop-0.17.tar.gz
#进入对应目录
cd iftop-0.17/
#配置
sudo ./configure
#编译
sudo make
#安装
sudo make install

3. 运行iftop

3.1 帮助

执行iftop -h

iftop: display bandwidth usage on an interface by host

Synopsis: iftop -h | [-npblNBP] [-i interface] [-f filter code]

[-F net/mask] [-G net6/mask6]

-h display this message

-n don't do hostname lookups

-N don't convert port numbers to services

-p run in promiscuous mode (show traffic between other

hosts on the same network segment)

-b don't display a bar graph of traffic

-B display bandwidth in bytes

-a display bandwidth in packets

-i interface listen on named interface

-f filter code use filter code to select packets to count

(default: none, but only IP packets are counted)

-F net/mask show traffic flows in/out of IPv4 network

-G net6/mask6 show traffic flows in/out of IPv6 network

-l display and count link-local IPv6 traffic (default: off)

-P show ports as well as hosts

-m limit sets the upper limit for the bandwidth scale

-c config file specifies an alternative configuration file

-t use text interface without ncurses

Sorting orders:

-o 2s Sort by first column (2s traffic average)

-o 10s Sort by second column (10s traffic average) [default]

-o 40s Sort by third column (40s traffic average)

-o source Sort by source address

-o destination Sort by destination address

The following options are only available in combination with -t

-s num print one single text output afer num seconds, then quit

-L num number of lines to print

可以看到有很多选项，这里我分享一些常见用法示例