Police your network traffic with IPTraf

With Logging activated, press the x key or scroll down to Exit and press [Enter], press the m key or scroll up to IP Traffic Monitor, and press [Enter] to open that menu. Next, select the eth0 interface, define the log file or accept the default of /var/log/iptraf/ip_traffic-1.log, and press [Enter] again. You'll see network traffic information scrolling by far too fast to make heads or tails of it. Fortunately, you turned on Logging. Now if you open your favorite text editor (mine is Pico) to the log file, you'll see entries like the one shown in this listing. If you dissect each entry, you'll see that they each contain the following:

Time stamp: month, day, time, year
Protocol: ARP, OSPF, TCP, UDP, etc.
Interface: eth0, eth1, localhost, etc.
Packet size in bytes
Addresses: Addresses following the for keyword are destination addresses, and those following the from keyword are source addresses. They can be either IP or MAC addresses.

Creating filters One of the best features of IPTraf is the ability to define your own display filter to monitor specific network traffic. For example, you can create a TCP filter that will monitor SMTP traffic on the network. To do this, first open iptraf and select TCP Display Filters. In this new menu, select Define New Filter and enter the name SMTP Traffic. After you've named the filter, you'll see a window like the one shown in Figure B.

Figure B

The [Tab] key lets you navigate around the edit screen.

As you can see in Figure B, you must enter two sets of data. The first set, on the left side, is for the destination address; the second set is for the source address. If you leave either with 0s (as shown in the second set), IPTraf will assume that you're monitoring all addresses. The SMTP traffic filter I've created from this example will look like the one in Figure C. As you can see, I've defined a range of addresses by entering 10.16.58.190 for the host name and a wildcard of 255.255.248.0, which is the equivalent of the subnet mask on my network. The final bit of information I entered is 25 for the port number. The preceding information is my destination address. For the source address (the second set of data), I entered 10.16.56.13 for the host address, 255.255.248.0 for the wildcard mask, and 25 for the port.

Figure C

You can include or exclude matching packets from the display by tabbing to Include/Exclude and entering either the letter I or the letter E, respectively.

Once you enter all your information, all you have to do is press [Enter] and then [Ctrl]X to get out of the Define New Filter screen. Then, you need to apply the filter by scrolling to Apply Filter, pressing [Enter], selecting the SMTP Traffic filter I just created, pressing [Enter] again, and then going back to IP Traffic Monitor. Once you start the monitor, you'll see all the traffic zipping by on the bottom part of the screen, and any traffic matching your filter will show up in the upper portion of the screen. Summary This quick walk-through of IPTraf should give you an idea of how useful and flexible this open source utility can be. Whether you're the network administrator of a large corporation or solely responsible for a small operation, you can benefit from IPTraf's ability to monitor and log any amount of network traffic.

Have your say instantly in the Tech Update forum. Let the editors know what you think in the Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

All of the feedback regarding using a touch monitor for a desktop PC is right on. Several months ago, we installed a "demo" multitouch all-in-one...

2 hours ago by apexwm on Windows 8 could speed multi-monitor uptake

anyone wanting to triple boot *their* own Mac

3 hours ago by 191706 on xTreme Triple Booting: Linux, Mac & Windows

Cont.. Biggest Bugbear: Win7's stop-animate-go approach to work, you develop a staggered (not in the above alchohol sense of the word) approach to...

3 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Ah the joys of Windows 8 Consumer Preview... If Windows 7 was 'Vista with Lipstick', whats Windows 8? Vista with Lipstick, the morning after?...

3 hours ago by SoapyTablet on Windows 8 could speed multi-monitor uptake

Though the metro look is quite cool on the windows mobile platform I think that think that microsoft ARE MESSING THINGS UP because what has they...

4 hours ago by daveveej on Windows 8 could speed multi-monitor uptake

I agree, we have a few touch screen monitors in work but as Windows7 and the applications we use are not touch screen friendly (the size of the...

4 hours ago by Custonian on Windows 8 could speed multi-monitor uptake

I find it amusing that Microsoft added the mouse, which was deemed awkward, but people were forced to use it so it stuck, and now they're saying,...

6 hours ago by archerthom on Windows 8 could speed multi-monitor uptake

Agree with other comments. Nobody's going to start reaching out to start tapping their desktop monitors with their fingers. Their arms would tire...

15 hours ago by BrownieBoy on Windows 8 could speed multi-monitor uptake

The only way a touch monitor would be any good is if it were horizontal on the desk, with a virtual keyboard so you could do away with that as well...

20 hours ago by Random_Error on Windows 8 could speed multi-monitor uptake

This is just dumb! Forget that I think Windows 8 will bomb, but really, people are going to go out and buy touch Monitors now??? Just pretend...

22 hours ago by JBDragon on Windows 8 could speed multi-monitor uptake