.\" netsniff-ng - the packet sniffing beast .\" Copyright 2013 Daniel Borkmann. .\" Subject to the GPL, version 2. .PP .TH FLOWTOP 8 "03 March 2013" "Linux" "netsniff-ng toolkit" .SH NAME flowtop \- top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow tracking .PP .SH SYNOPSIS .PP \fBflowtop\fR { [\fIoptions\fR] } .PP .SH DESCRIPTION .PP flowtop is a top-like connection tracking tool that can run on an end host or small home router. It is able to present TCP, UDP/UDP-lite, SCTP, DCCP, and ICMP(v6) flows that have been collected by the kernel's netfilter connection tracking framework, thus no packet capturing in user space needs to be done. .PP flowtop is able to give you a quick overview of current connections on your local system, e.g. for debugging purposes or to answer questions like: .PP * If you access website X, what other connections are being opened in the background that I'm not aware of? * What connections are active that pass one's router? * I have this proprietary binary Y, to where does it connect? * To which countries am I sending data? * Are there any suspicious background connections on my machine? * How many active connections does binary Y have? .PP The following information will be presented in flowtop's output: .PP * Application name and PID when run on local machine * Reverse DNS for source and destination * Geo-location information (country, city) * Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...) * Flow port's service name heuristic * Transport protocol state machine information .PP In order for flowtop to work, netfilter must be active and running on your machine, thus kernel-side connection tracking is active. .PP flowtop's intention is just to get a quick look over your active connections. If you want logging support, have a look at netfilter's conntrack(8) tools instead. .PP .SH OPTIONS .PP .SS -4, --ipv4 Display IPv4 flows. That is the default when flowtop is started without any arguments. .PP .SS -6, --ipv6 Display IPv6 flows. That is the default when flowtop is started without any arguments. .PP .SS -T, --tcp Display TCP flows. That is the default when flowtop is started without any arguments. .PP .SS -U, --udp Display UDP and UDP-lite flows. .PP .SS -D, --dccp Display DCCP flows. .PP .SS -I, --icmp Display ICMP version 4 and version 6 flows. .PP .SS -S, --sctp Display SCTP flows. .PP .SS -s, --show-src Also show source information of the flow, not only destination information. .PP .SS -u, --update The built-in database update mechanism will be invoked to get Maxmind's latest database. To configure search locations for databases, the file /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save bandwidth or for mirroring Maxmind's databases (to bypass their traffic limit policy), different hosts or IP addresses can be placed into geoip.conf, separated by a newline. .PP .SS -v, --version Show version information and exit. .PP .SS -h, --help Show user help and exit. .PP .SH USAGE EXAMPLE .PP .SS flowtop Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP. .PP .SS flowtop -46UTDISs This example enables the maximum display options for flowtop. .PP .SH CONFIG FILES .PP Files under /etc/netsniff-ng/ can be modified to extend flowtop's service resolution and lookup information. .PP * tcp.conf - TCP port/services map * udp.conf - UDP port/services map * geoip.conf - GeoIP database mirrors .PP .SH BUGS With a fairly high rate of connection tracking updates, flowtop can become unresponsive for short periods of time while scrolling. The right fix would be to replace flowtop's connection management backend with a better design with respect to the locking approach. This is still on the "todo" list. .PP .SH LEGAL flowtop is licensed under the GNU GPL version 2.0. .PP .SH HISTORY .B flowtop was originally written for the netsniff-ng toolkit by Daniel Borkmann. It is currently maintained by Tobias Klauser and Daniel Borkmann . .PP .SH SEE ALSO .BR netsniff-ng (8), .BR trafgen (8), .BR mausezahn (8), .BR ifpps (8), .BR bpfc (8), .BR astraceroute (8), .BR curvetun (8) .PP .SH AUTHOR Manpage was written by Daniel Borkmann. .PP .SH COLOPHON This page is part of the Linux netsniff-ng toolkit project. A description of the project, and information about reporting bugs, can be found at http://netsniff-ng.org/. inux/net-next.git/patch/?id=a771151a8323a5ca81f443a9a439851b8a872c85'>patch) treee1cd1a77beae03bb03ec238c227ae26199998dc7 parent997b611baf7591ea5119539ee821a3e2f4fcf24e (diff)parente13688fe618881dd407a68dfbd2295d70b21a445 (diff)
Merge tag 'armsoc-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc
Pull ARM SoC cleanups from Arnd Bergmann: "The cleanups for v4.9 are a little larger that usual, but thankfully that is almost exclusively due to removing a significant number of files that have become obsolete after the still ongoing conversion of old board files to devicetree. - for mach-omap2, which is still the largest platform in arch/arm/, the conversion to DT is finally complete after the Nokia N900 is now fully supported there, along with the omap3 LDP, and we can remove those two board files. If no regressions are found, another large cleanup for the platform will happen as a follow-up, removing dead code and restructuring the platform based on being DT-only. - In mach-imx, similar work is ongoing, but has not come that far. This time, we remove the obsolete board file for the i.MX1 generation, which like i.MX25, i.MX5, i.MX6, and i.MX7 is now DT-only. The remaining board files are for i.MX2 and i.MX3 machines based on old ARM926 or ARM1136 cores that should work with DT in principle. - realview has just been converted from board files to DT, and a lot of code gets removed in the process. This is the last ARM/Keil/Versatile derived platform that was still using board files, the other ones being integrator, versatile and vexpress. We can probably merge the remaining code into a single directory in the near future. - clps711x had completed the conversion in v4.8, but we accidentally left the files in place that should have been deleted then" * tag 'armsoc-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (21 commits) ARM: select PCI_DOMAINS config from ARCH_MULTIPLATFORM ARM: stop *MIGHT_HAVE_PCI* config from being selected redundantly ARM: imx: (trivial) fix typo and grammar ARM: clps711x: remove extraneous files ARM: imx: use IS_ENABLED() instead of checking for built-in or module ARM: OMAP2+: use IS_ENABLED() instead of checking for built-in or module ARM: OMAP1: use IS_ENABLED() instead of checking for built-in or module ARM: imx: remove platform-mxc_rnga ARM: realview: imply device tree boot ARM: realview: no need to select SMP_ON_UP explicitly ARM: realview: delete the RealView board files ARM: imx: no need to select SMP_ON_UP explicitly ARM: i.MX: Move SOC_IMX1 into 'Device tree only' ARM: i.MX: Remove i.MX1 non-DT support ARM: i.MX: Remove i.MX1 Synertronixx SCB9328 board support ARM: i.MX: Remove i.MX1 Armadeus APF9328 board support ARM: mxs: remove obsolete startup code for TX28 ARM: i.MX31 iomux: remove duplicates with alternate name ARM: i.MX31 iomux: remove plain duplicates ARM: OMAP2+: Drop legacy board file for LDP ...
Diffstat