.\" netsniff-ng - the packet sniffing beast .\" Copyright 2013 Daniel Borkmann. .\" Subject to the GPL, version 2. .TH FLOWTOP 8 "03 March 2013" "Linux" "netsniff-ng toolkit" .SH NAME flowtop \- top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow tracking .SH SYNOPSIS \fB flowtop\fR { [\fIoptions\fR] } .SH DESCRIPTION flowtop is a top-like connection tracking tool that can run on an end host or small home router. It is able to present TCP, UDP/UDP-lite, SCTP, DCCP, and ICMP(v6) flows that have been collected by the kernel's netfilter connection tracking framework, thus no packet capturing in user space needs to be done. flowtop is able to give you a quick overview of current connections on your local system, e.g. for debugging purposes or to answer questions like: * If you access website X, what other connections are being opened in the background that I'm not aware of? * What connections are active that pass one's router? * I have this proprietary binary Y, to where does it connect? * To which countries am I sending data? * Are there any suspicious background connections on my machine? * How many active connections does binary Y have? The following information will be presented in flowtop's output: * Application name and PID when run on local machine * Reverse DNS for source and destination * Geo-location information (country, city) * Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...) * Flow port's service name heuristic * Transport protocol state machine information In order for flowtop to work, netfilter/iptables must be active resp. running on your machine, thus kernel-side connection tracking is active. flowtop's intention is just to get a quick look over your active connections. If you want logging support, have a look at netfilter's conntrack(8) tools instead. .SH OPTIONS .SS -4, --ipv4 Display IPv4 flows. That's default when flowtop is started without any arguments. .SS -6, --ipv6 Display IPv6 flows. That's default when flowtop is started without any arguments. .SS -T, --tcp Display TCP flows. That's default when flowtop is started without any arguments. .SS -U, --udp Display UDP and UDP-lite flows. .SS -D, --dccp Display DCCP flows. .SS -I, --icmp Display ICMP version 4 and version 6 flows. .SS -S, --sctp Display SCTP flows. .SS -s, --show-src Also show source information of the flow, not only destination information. .SS -u, --update The built-in database update mechanism will be invoked to get Maxmind's latest database. To configure search locations for databases, the file /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save bandwidth or for mirroring Maxmind's databases (to bypass their traffic limit policy), different hosts or IP addresses can be placed into geoip.conf, separated by a newline. .SS -v, --version Show version information and exit. .SS -h, --help Show user help and exit. .SH USAGE EXAMPLE .SS flowtop Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP. .SS flowtop -46UTDISs This example enables the maximum display options for flowtop. .SH CONFIG FILES Files under /etc/netsniff-ng/ can be modified to extend flowtop's service resolution and lookup information. * tcp.conf - TCP port/services map * udp.conf - UDP port/services map * geoip.conf - GeoIP database mirrors .SH BUGS With a fairly high rate of connection tracking updates, flowtop can become unresponsive for short periods of time while scrolling. The right fix would be to replace flowtop's connection management backend with a better design resp. locking approach. Still on todo. .SH LEGAL flowtop is licensed under the GNU GPL version 2.0. .SH HISTORY .B flowtop was originally written for the netsniff-ng toolkit by Daniel Borkmann. It is currently maintained by Tobias Klauser and Daniel Borkmann . .SH SEE ALSO .BR netsniff-ng (8), .BR trafgen (8), .BR mausezahn (8), .BR ifpps (8), .BR bpfc (8), .BR astraceroute (8), .BR curvetun (8) .SH AUTHOR Manpage was written by Daniel Borkmann. option>space:mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2017-01-01 12:27:05 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2017-01-01 12:27:05 -0800
commit4759d386d55fef452d692bf101167914437e848e (patch)
treee7109c192ec589fcea2a98f9702aa3c0e4009581 /include/kvm/arm_pmu.h
parent238d1d0f79f619d75c2cc741d6770fb0986aef24 (diff)
parent1db175428ee374489448361213e9c3b749d14900 (diff)
Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Pull DAX updates from Dan Williams: "The completion of Jan's DAX work for 4.10. As I mentioned in the libnvdimm-for-4.10 pull request, these are some final fixes for the DAX dirty-cacheline-tracking invalidation work that was merged through the -mm, ext4, and xfs trees in -rc1. These patches were prepared prior to the merge window, but we waited for 4.10-rc1 to have a stable merge base after all the prerequisites were merged. Quoting Jan on the overall changes in these patches: "So I'd like all these 6 patches to go for rc2. The first three patches fix invalidation of exceptional DAX entries (a bug which is there for a long time) - without these patches data loss can occur on power failure even though user called fsync(2). The other three patches change locking of DAX faults so that ->iomap_begin() is called in a more relaxed locking context and we are safe to start a transaction there for ext4" These have received a build success notification from the kbuild robot, and pass the latest libnvdimm unit tests. There have not been any -next releases since -rc1, so they have not appeared there" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: ext4: Simplify DAX fault path dax: Call ->iomap_begin without entry lock during dax fault dax: Finish fault completely when loading holes dax: Avoid page invalidation races and unnecessary radix tree traversals mm: Invalidate DAX radix tree entries only if appropriate ext2: Return BH_New buffers for zeroed blocks
Diffstat (limited to 'include/kvm/arm_pmu.h')