Network traffic utilities bandwhich and iftop

Traffic Cops

Keep It for Later

As mentioned, once you've chosen your preferences and created a config file, you can start up iftop just as intended without necessarily having to tweak a running display. A sprinkling of some of the many choices you might use in an iftop config file include:

dns-resolution: no
port-resolution: yes
show-bars: yes
port-display: on
sort: 2s

If you call your tweaked options file simply config, you can execute it with the -c switch:

$  iftop -i wlp1s0 -c config

Note that normally the config file would be called something like .iftop in your home directory.

You can find heaps of options for your config file that I haven't discussed. An online manual [5] offers a relatively astounding number of changes you can make to the excellent iftop.

The End Is Nigh

If you haven't seen these network traffic tools before, I hope you'll be going to their respective websites right away to try them. Both bandwhich and iftop offer excellent terminal-based solutions to monitoring what your network stack is doing. In addition to having an extra terminal open on a server while you're working to spot spikes in traffic, they're ideal for troubleshooting. The iftop utility in particular filters out the noise to make sure you're seeing exactly what you want to analyze.

Once you've spotted what you're looking for, just reach for ngrep or the stalwart tcpdump to get down to the packet level. You'll then be all set to troubleshoot any issues that might arise.

Infos

bandwhich: https://github.com/imsnif/bandwhich
Rust: https://www.rust-lang.org
Prebuilt releases: https://github.com/imsnif/bandwhich/releases
iftop: http://www.ex-parrot.com/pdw/iftop
iftop manual: https://www.systutorials.com/docs/linux/man/8-iftop

The Author

Chris Binnie's latest book, Linux Server Security: Hack and Defend, shows how hackers launch sophisticated attacks to compromise servers, steal data, and crack complex passwords, so you can learn how to defend against such attacks. In the book, he also shows you how to make your servers invisible, perform penetration testing, and mitigate unwelcome attacks. You can find out more about DevOps, DevSecOps, Containers, and Linux security on his website: https://www.devsecops.cc.

« Previous 1 2