Police your network traffic with IPTraf

With Logging activated, press the x key or scroll down to Exit and press [Enter], press the m key or scroll up to IP Traffic Monitor, and press [Enter] to open that menu. Next, select the eth0 interface, define the log file or accept the default of /var/log/iptraf/ip_traffic-1.log, and press [Enter] again. You'll see network traffic information scrolling by far too fast to make heads or tails of it. Fortunately, you turned on Logging. Now if you open your favorite text editor (mine is Pico) to the log file, you'll see entries like the one shown in this listing. If you dissect each entry, you'll see that they each contain the following:

Time stamp: month, day, time, year
Protocol: ARP, OSPF, TCP, UDP, etc.
Interface: eth0, eth1, localhost, etc.
Packet size in bytes
Addresses: Addresses following the for keyword are destination addresses, and those following the from keyword are source addresses. They can be either IP or MAC addresses.

Creating filters One of the best features of IPTraf is the ability to define your own display filter to monitor specific network traffic. For example, you can create a TCP filter that will monitor SMTP traffic on the network. To do this, first open iptraf and select TCP Display Filters. In this new menu, select Define New Filter and enter the name SMTP Traffic. After you've named the filter, you'll see a window like the one shown in Figure B.

Figure B

The [Tab] key lets you navigate around the edit screen.

As you can see in Figure B, you must enter two sets of data. The first set, on the left side, is for the destination address; the second set is for the source address. If you leave either with 0s (as shown in the second set), IPTraf will assume that you're monitoring all addresses. The SMTP traffic filter I've created from this example will look like the one in Figure C. As you can see, I've defined a range of addresses by entering 10.16.58.190 for the host name and a wildcard of 255.255.248.0, which is the equivalent of the subnet mask on my network. The final bit of information I entered is 25 for the port number. The preceding information is my destination address. For the source address (the second set of data), I entered 10.16.56.13 for the host address, 255.255.248.0 for the wildcard mask, and 25 for the port.

Figure C

You can include or exclude matching packets from the display by tabbing to Include/Exclude and entering either the letter I or the letter E, respectively.

Once you enter all your information, all you have to do is press [Enter] and then [Ctrl]X to get out of the Define New Filter screen. Then, you need to apply the filter by scrolling to Apply Filter, pressing [Enter], selecting the SMTP Traffic filter I just created, pressing [Enter] again, and then going back to IP Traffic Monitor. Once you start the monitor, you'll see all the traffic zipping by on the bottom part of the screen, and any traffic matching your filter will show up in the upper portion of the screen. Summary This quick walk-through of IPTraf should give you an idea of how useful and flexible this open source utility can be. Whether you're the network administrator of a large corporation or solely responsible for a small operation, you can benefit from IPTraf's ability to monitor and log any amount of network traffic.

Have your say instantly in the Tech Update forum. Let the editors know what you think in the Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

14 minutes ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

5 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

6 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

7 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

9 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

23 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint