NAME

       tcptrack - Monitor TCP connections on the network

SYNOPSIS

       tcptrack [ -dfhvp ] [ -r seconds ] -i interface
        [ filter expression ]

DESCRIPTION

       tcptrack displays the status of TCP connections that it sees on a given network interface.
       tcptrack monitors their state and displays information such as  state,  source/destination
       addresses and bandwidth usage in a sorted, updated list very much like the top(1) command.

       The  filter  expression is a standard pcap filter expression (identical to the expressions
       used by tcpdump(8))  which  can  be  used  to  filter  down  the  characteristics  of  TCP
       connections  that  tcptrack will see. See tcpdump(8) for more information about the syntax
       of this expression.

OPTIONS

       -d     Only track connections that were started after tcptrack was started. Do not try  to
              detect existing connections.

       -f     Enable  fast  average  recalculation. TCPTrack will calculate the average speeds of
              connections by using a running average. TCPTrack will use more memory and CPU time,
              but  averages  will seem closer to real time and will be updated more than once per
              second and may be more accurate under heavy load.  The number of times  per  second
              that  averages  will  be  recalculated  in fast mode is a compile-time setting that
              defaults to 10 times per second.

       -h     Display command line help

       -i [interface]
              Sniff packets from the specified network interface.

       -T [pcap file]
              Read packets from the specified file instead of sniffing from the network.   Useful
              for testing.

       -p     Do not put the interface being sniffed into promiscuous mode.

       -r [seconds]
              Wait  this  many  seconds  before  removing  a  closed connection from the display.
              Defaults to 2 seconds. See also the pause interactive command (below).

       -v     Display tcptrack version

INTERACTIVE COMMANDS

       The following keys may be pressed while tcptrack is running to change runtime options:

       p - Pause/unpause display. No new connections will  be  added  to  the  display,  and  all
       currently displayed connections will remain in the display.

       q - Quit tcptrack.

       s - Cycle through the sorting options: unsorted, sorted by rate, sorted by total bytes.

       The  options  for  pausing  and toggling sorting are useful if you're watching a very busy
       network and want to look at the display without connections jumping around (due to sorting
       and  new  connections  being  added)  and  disappearing (due to being closed for a certain
       time).

       When paused (via the p command) no new connections will  be  displayed,  however  tcptrack
       will  still  monitor  and  track all connections it sees as usual. This option affects the
       display only, not internals. When you unpause,  the  display  will  be  updated  with  all
       current information that tcptrack has been gathering all along.

EXAMPLES

       tcptrack  requires  only  one  parameter to run: the -i flag followed by an interface name
       that you want tcptrack to monitor. This is the most basic way to run tcptrack:

       # tcptrack -i eth0

       tcptrack can also take a pcap filter expression as an argument. The format of this  filter
       expression  is  the  same  as  that  of  tcpdump(8)  and other libpcap-based sniffers. The
       following example will only show connections from host 10.45.165.2:

       # tcptrack -i eth0 src or dst 10.45.165.2

       The next example will only show web traffic (ie, traffic on port 80):

       # tcptrack -i eth0 port 80

SEE ALSO

       tcpdump(8), pcap(3), http://www.rhythm.cx/~steve/devel/tcptrack

BUGS

       When picking up a connection that was already running before tcptrack was  started,  there
       is  no way tcptrack can know for sure which end of the connection is the client (ie, which
       peer started the connection) and which is the  server  (ie,  which  peer  was  listening).
       tcptrack  makes  a crude guess at which is which by looking at the port numbers; whichever
       end has the lower port number is considered the server side. This isn't always accurate of
       course, but future versions may have better heuristics to figure out which end is which.

       Currently the interface is not very flexible. Display timing settings (such as the refresh
       interval) can only be changed by editing the source code (defs.h in particular).  See  the
       TODO file included with the source distribution for further bugs.

                                                                                      tcptrack(1)