iftop: display bandwidth usage on an interface by host

Synopsis: iftop -h | [-npblNBP] [-i interface] [-f filter code]  
                               [-F net/mask] [-G net6/mask6]

   -h                  display this message
   -n                  don't do hostname lookups
   -N                  don't convert port numbers to services
   -p                  run in promiscuous mode (show traffic between other
                       hosts on the same network segment)
   -b                  don't display a bar graph of traffic
   -B                  Display bandwidth in bytes
   -i interface        listen on named interface
   -f filter code      use filter code to select packets to count
                       (default: none, but only IP packets are counted)
   -F net/mask         show traffic flows in/out of IPv4 network
   -G net6/mask6       show traffic flows in/out of IPv6 network
   -l                  display and count link-local IPv6 traffic (default: off)
   -P                  show ports as well as hosts
   -m limit            sets the upper limit for the bandwidth scale
   -c config file      specifies an alternative configuration file
   -t                  use text interface without ncurses

   Sorting orders:
   -o 2s                Sort by first column (2s traffic average)
   -o 10s               Sort by second column (10s traffic average) [default]
   -o 40s               Sort by third column (40s traffic average)
   -o source            Sort by source address
   -o destination       Sort by destination address

   The following options are only available in combination with -t
   -s num              print one single text output afer num seconds, then quit
   -L num              number of lines to print

iftop, version 1.0pre4  
copyright (c) 2002 Paul Warren <pdw@ex-parrot.com> and contributors  



  • 包管理工具安装
  • 源码编译



# /usr/local/sbin/iftop -i any -s 10 -t -N -P -B -L 10000
interface: any  
Error getting hardware address for interface: any  
ioctl(SIOCGIFHWADDR): No such device  
Unable to get IP address for interface: any  
ioctl(SIOCGIFADDR): No such device  
Listening on any  
   # Host name (port/service if enabled)            last 2s   last 10s   last 40s cumulative
   1 10.204.xxx.xxx:41499                     =>     3.86KB     6.11KB     6.11KB     61.1KB
     10.221.xx.xx:32924                       <=     11.9KB     14.5KB     14.5KB      145KB
   2 10.204.xxx.xxx:443                       =>     1.47KB     6.67KB     6.67KB     66.7KB
     223.245.xxx.xx:1172                      <=       568B       569B       569B     5.55KB
Total send rate:                                      376KB      378KB      378KB  
Total receive rate:                                   130KB      126KB      126KB  
Total send and receive rate:                          506KB      505KB      505KB  
Peak rate (sent/received/total):                      452KB      135KB      586KB  
Cumulative (sent/received/total):                    3.69MB     1.23MB     4.93MB  

上面的指令是统计了10秒内(-s 10)所有网络设备(-i any)的流量情况,并打印端口(-P),=>是出流量,<=是进流量。使用sedawk再将需要统计的端口过滤及统计出来。



while :  
        ifdata=$(/usr/local/sbin/iftop -i any -s 10 -t -N -P -B -L 10000 2>/dev/null)
        for game in `ls -d /data/xxxx_*_*`
                server_id=$(echo ${game} | awk -F_ '{print $NF}')
                node_name=$(echo ${game} | awk -F/ '{print $NF}')
                GW=$(awk -F'[,}{]' '/port/{gsub(/\s*/,"",$0);print $3}' ${CONFIG})
                ret=$(echo "${ifdata}" | sed -n "/:${GW}/{p;n;p}")
                send=$(awk '{if($0~/=>/){if($NF~/KB/){sub(/KB/,"",$NF);sum+=$NF*1024}else{sub(/B/,"",$NF);sum+=$NF}}}END{printf("%d",sum/10)}' <<< "${ret}")
                recv=$(awk '{if($0~/<=/){if($NF~/KB/){sub(/KB/,"",$NF);sum+=$NF*1024}else{sub(/B/,"",$NF);sum+=$NF}}}END{printf("%d",sum/10)}' <<< "${ret}")
                echo "application.game.net_traffic `date +%s` ${recv} direction=recv unit=u_B/s server_id=${server_id} node_name=${node_name}"
                echo "application.game.net_traffic `date +%s` ${send} direction=send unit=u_B/s server_id=${server_id} node_name=${node_name}"
        sleep 60


application.game.net_traffic 1423722667 4463 direction=recv unit=u_B/s server_id=xxxx node_name=xxxx_xx_xxxx  
application.game.net_traffic 1423722667 11470 direction=send unit=u_B/s server_id=xxxx node_name=xxxx_xx_xxxx  
application.game.net_traffic 1423722667 94787 direction=recv unit=u_B/s server_id=yyyy node_name=yyyy_yy_yyyy  
application.game.net_traffic 1423722667 350172 direction=send unit=u_B/s server_id=yyyy node_name=yyyy_yy_yyyy