iftop show LAN traffic

How to Enable Promiscuous Mode:
You can enable promiscuous mode with the following command:

bash
Αντιγραφή κώδικα
sudo ip link set dev eth0 promisc on

To Show IP Addresses, Not MAC Addresses:
iftop by default shows IP addresses. However, if you want to see hostnames associated with those IP addresses, you can use the -n flag to disable DNS resolution, or let iftop resolve the names automatically.

bash
Αντιγραφή κώδικα
sudo iftop -n -i eth0
This will prevent iftop from performing reverse DNS lookups for IP addresses. If DNS is enabled, it will attempt to resolve the hostnames of the IPs.

To See Traffic for Specific Hosts:
If you want to monitor the traffic from a particular host or see which IP addresses are generating the most traffic, you can filter by IP with the -F option. For example, to only show traffic to/from a specific IP:

bash
Αντιγραφή κώδικα
sudo iftop -i eth0 -F 192.168.1.100
This will only show traffic related to the IP 192.168.1.100.

Limitations of iftop:
MAC addresses: iftop doesn't directly display MAC addresses, as it works at the IP layer and not the Ethernet layer. To see MAC addresses, you would typically use arp or ip neighbour.
Hostnames: iftop may not always resolve hostnames (it depends on the network setup and DNS configuration). If it doesn't resolve, you can look up the IPs manually via nslookup or use arp to associate IPs with MAC addresses.


Yes, in iftop, you can sort the connections by traffic in descending order using a simple key press.

To Sort by Traffic in Descending Order:
Press t to toggle the sorting order.
By default, iftop sorts by the total traffic (i.e., combined incoming and outgoing traffic) for each connection.
Pressing t will toggle the sorting between descending and ascending order.
Explanation of iftop Sorting:
t: Sort by traffic in descending/ascending order (default is descending).
p: Sort by the number of packets.
s: Sort by source IP/port.
d: Sort by destination IP/port.
If you press t multiple times, it will toggle through the different sorting methods, and it will automatically sort by the largest traffic first when sorted by traffic.

Example Usage:
When you're in iftop, press t to ensure it's sorted by traffic, and the connections with the highest amount of traffic will be listed at the top.



Είπες:
can I sort in iftop the source IPS that start with 192.168.1.XXX?
Το ChatGPT είπε:
ChatGPT
iftop does not provide a built-in option to filter or sort traffic specifically by IP address patterns, such as "source IPs starting with 192.168.1". However, you can filter the traffic to only show connections that match a certain IP range by using iftop's filter option.

Filtering Traffic by Source IP Range:
iftop allows you to set a filter to show only specific traffic. To filter the traffic to show only IPs in the 192.168.1.0/24 range (which covers IPs 192.168.1.0 to 192.168.1.255), follow these steps:

Start iftop on your interface (e.g., eth0):

bash
Αντιγραφή κώδικα
sudo iftop -i eth0
Set the filter to only show traffic from the 192.168.1.0/24 subnet:

Press the f key to enter the filter mode in iftop.
Enter the following filter expression to only show traffic from source IPs in the 192.168.1.x range:
css
Αντιγραφή κώδικα
src net 192.168.1.0/24
This filter will display only the traffic where the source IP is in the 192.168.1.0/24 range.
Sorting by Traffic: Once the filter is applied, you can press t to sort the filtered results by the amount of traffic in descending order (as explained earlier).

To Clear the Filter:
To remove the filter and see all traffic again, press f and then Enter with an empty filter expression.
Example:
Start iftop:

bash
Αντιγραφή κώδικα
sudo iftop -i eth0
Press f, then type src net 192.168.1.0/24, and press Enter.

Press t to sort by traffic.

Alternative Method: Use tcpdump to Filter Traffic First
If you need more advanced filtering capabilities (like specific source IPs or ranges), you can use tcpdump to capture the traffic and then pipe it to a tool like iftop or analyze it in other ways.

Example using tcpdump to capture traffic from 192.168.1.0/24:

bash
Αντιγραφή κώδικα
sudo tcpdump -i eth0 src net 192.168.1.0/24
This would capture all traffic from the 192.168.1.x subnet. You can pipe this output to another tool like iftop if needed.

Conclusion:
Direct Filtering in iftop: You can filter the traffic to show only IPs from 192.168.1.0/24 using the filter option (f key) with the expression src net 192.168.1.0/24.
Sorting: After applying the filter, you can press t to sort the results by traffic in descending order.
This will give you a view of only the traffic from source IPs in the 192.168.1.x range, sorted by traffic amount.