Creating iptraf-ng traffic filters

gosssamer · 06-02-2014, 07:42 AM

Hi,

Is anyone using iptraf-ng and can show me an example filter? The examples and documentation for iptraf don't directly correlate to iptraf-ng, and I can't get filters to work with iptraf-ng.

I'm trying to create a simple filter that monitors incoming ssh traffic.

I've experimented quite a bit, but it seems once I create any type of filter, the packet views always shows zero or very low values that are completely wrong.

Any ideas greatly appreciated.

dijetlo · 06-04-2014, 09:18 PM

Quote:

Is anyone using iptraf-ng and can show me an example filter?

I don't think it does what you think it does.....

Code:

root@kahuna:/home/willie# iptraf-ng --help
usage: iptraf-ng [options]
   or: iptraf-ng [options] -B [-i <iface> | -d <iface> | -s <iface> | -z <iface> | -l <iface> | -g]

    -h, --help            show this help message

    -i <iface>            start the IP traffic monitor (use '-i all' for all interfaces)
    -d <iface>            start the detailed statistics facility on an interface
    -s <iface>            start the TCP and UDP monitor on an interface
    -z <iface>            shows the packet size counts on an interface
    -l <iface>            start the LAN station monitor (use '-l all' for all LAN interfaces)
    -g                    start the general interface statistics

    -B                    run in background (use only with one of the above parameters
    -f                    clear all locks and counters
    -t <n>                run only for the specified <n> number of minutes
    -L <logfile>          specifies an alternate log file

gosssamer · 06-04-2014, 09:21 PM

Quote:

Originally Posted by dijetlo

I don't it does what you think it does.....

Code:

root@kahuna:/home/willie# iptraf-ng --help
usage: iptraf-ng [options]
   or: iptraf-ng [options] -B [-i <iface> | -d <iface> | -s <iface> | -z <iface> | -l <iface> | -g]

    -h, --help            show this help message

    -i <iface>            start the IP traffic monitor (use '-i all' for all interfaces)
    -d <iface>            start the detailed statistics facility on an interface
    -s <iface>            start the TCP and UDP monitor on an interface
    -z <iface>            shows the packet size counts on an interface
    -l <iface>            start the LAN station monitor (use '-l all' for all LAN interfaces)
    -g                    start the general interface statistics

    -B                    run in background (use only with one of the above parameters
    -f                    clear all locks and counters
    -t <n>                run only for the specified <n> number of minutes
    -L <logfile>          specifies an alternate log file

The curses interface has an option for building ip/port filters. Its usage is unclear, and the documentation is non-existent. The original iptraf docs differ to much to be useful.