# flowtop

## NAME



           flowtop - top-like netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flow
           tracking
    


## SYNOPSIS



           **flowtop**{ [_options_] }
    


## DESCRIPTION



           flowtop is a top-like connection tracking tool that can run on an
           end host or small home router. It is able to present TCP, UDP/UDP-
           lite, SCTP, DCCP, and ICMP(v6) flows that have been collected by
           the kernel's netfilter connection tracking framework, thus no
           packet capturing in user space needs to be done.
    
           flowtop is able to give you a quick overview of current
           connections on your local system, e.g. for debugging purposes or
           to answer questions like:
    
               * If you access website X, what other connections are being
           opened in
                 the background that I'm not aware of?
               * What connections are active that pass one's router?
               * I have this proprietary binary Y, to where does it connect?
               * To which countries am I sending data?
               * Are there any suspicious background connections on my
           machine?
               * How many active connections does binary Y have?
               * How long are connections active already?
               * At which rate am I sending/receiving data?
    
           The following information will be presented in flowtop's output:
    
               * Application name and PID when run on local machine
               * Reverse DNS for source and destination
               * Geo-location information (country, city)
               * Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...)
               * Flow port's service name heuristic
               * Transport protocol state machine information
               * Byte/packet counters (if they are enabled)
               * Connection duration (if timestamping is enabled)
               * Flow send/receive rate (if byte/packet counters are enabled)
    
           In order for flowtop to work, netfilter must be active and running
           on your machine, thus kernel-side connection tracking is active.
           If netfilter is not running, you can activate it with iptables(8):
    
               iptables -A INPUT -p tcp -m state --state ESTABLISHED -j
               ACCEPT
    
               iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j
               ACCEPT
    
           or by loading the following kernel modules:
    
               modprobe nf_conntrack_ipv4
    
               modprobe nf_conntrack_ipv6
    
           To dump byte/packet counters flowtop enables the sysctl(8)
           parameter **net.netfilter.nf_conntrack_acct** via:
    
               echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct
    
           and resets it to the previously set value on exit. These counters
           will only be active on connections which were created after
           accounting was enabled. Thus, to have these counters be active all
           the time the parameter should be enabled after the system is up.
           To automatically enable it, **sysctl.conf**(8) or **sysctl.d**(8) might be
           used.
    
           To calculate the connection duration flowtop enables the sysctl(8)
           parameter **net.netfilter.nf_conntrack_timestamp** via:
    
               echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp
    
           and resets it to the previously set value on exit.
    
           flowtop's intention is just to get a quick look over your active
           connections.  If you want logging support, have a look at
           netfilter's **conntrack**(8) tools instead.
    


## OPTIONS



           **-4, --ipv4**
                  Display IPv4 flows. That is the default when flowtop is
                  started without any arguments.
    
           **-6, --ipv6**
                  Display IPv6 flows. That is the default when flowtop is
                  started without any arguments.
    
           **-T, --tcp**
                  Display TCP flows. That is the default when flowtop is
                  started without any arguments.
    
           **-U, --udp**
                  Display UDP and UDP-lite flows.
    
           **-D, --dccp**
                  Display DCCP flows.
    
           **-I, --icmp**
                  Display ICMP version 4 and version 6 flows.
    
           **-S, --sctp**
                  Display SCTP flows.
    
           **-n, --no-dns**
                  Don't perform hostname lookup. Only numeric addresses will
                  be shown for flow endpoints.
    
           **-G, --no-geoip**
                  Don't perform GeoIP lookup. No geographical information
                  will be shown for flow endpoints.
    
           **-s, --show-src**
                  Also show source information of the flow, not only
                  destination information.
    
           **-b, --bits**
                  Show flow rates in bits per second instead of bytes per
                  second.
    
           **-u, --update**
                  The built-in database update mechanism will be invoked to
                  get Maxmind's latest database. To configure search
                  locations for databases, the file /etc/netsniff-
                  ng/geoip.conf contains possible addresses. Thus, to save
                  bandwidth or for mirroring Maxmind's databases (to bypass
                  their traffic limit policy), different hosts or IP
                  addresses can be placed into geoip.conf, separated by a
                  newline.
    
           **-t <time>, --interval <time>**
                  Flow info refresh interval in seconds, default is 1s.
    
           **-v, --version**
                  Show version information and exit.
    
           **-h, --help**
                  Show user help and exit.
    


## USAGE EXAMPLE



           **flowtop**
                  Default ncurses output for flowtop that tracks IPv4, IPv6
                  flows for TCP.
    
           **flowtop -46UTDISs**
                  This example enables the maximum display options for
                  flowtop.
    


## CONFIG FILES



           Files under /etc/netsniff-ng/ can be modified to extend flowtop's
           service resolution and lookup information.
    
               * tcp.conf - TCP port/services map
               * udp.conf - UDP port/services map
               * geoip.conf - GeoIP database mirrors
    


## BUGS



           With a fairly high rate of connection tracking updates, flowtop
           can become unresponsive for short periods of time while scrolling.
           The right fix would be to replace flowtop's connection management
           backend with a better design with respect to the locking approach.
           This is still on the "todo" list.
    


## LEGAL



           flowtop is licensed under the GNU GPL version 2.0.
    


* * *