TRAFSHOW(1)

NAME
trafshow - full screen show network traffic

SYNOPSIS
trafshow [-dfknNOp -cnum -iname -rsec -tsec] [-Ffile|expr]

DESCRIPTION

TrafShow continuously display the information regarding packet traffic on the configured network interface that match the boolean expression. It periodically sort and updates this information.
It may be useful for locating suspicious network traffic on the net.

OPTIONS

-c  Exit after receiving number of packets.

-d  Dump the compiled packet-matching code to stdout and exit.

-f  Print `foreign' intrernet addresses numerically rather then symbolically.

-F  Use file as input for the filter expression.

-i  Listen on network interface name. If unspecified, trafshow searches the system interface list for the lowest numbered, configured up interface (excluding loopback).

-k  Disable input keyboard checking. It is intended to avoid loss of packets.

-n  Don't convert host addresses and port numbers to names.

-N  Don't print domain name qualification of host names.

-O  Don't run the packet-matching code optimizer. This is useful only if you suspect a bug in the optimizer.

-p  Don't put the interface into promiscuous mode.

-r  Set screen refresh interval to seconds.

-t  Set max timeout in DNS query to seconds.

expr
    Select which packets will be displayed. If no expression is given, all packets on the net will be displayed. Otherwise, only packets for which expression is `true' will be displayed.
    For more details refer to tcpdump(1) man page.

SEE ALSO
netstat(1), tcpdump(1), bpf(4)

ACKNOWLEDGEMENTS
Thanks to Van Jacobson <van@helios.ee.lbl.gov> and Steven McCanne <mccanne@helios.ee.lbl.gov>, all of Lawrence Berkeley Laboratory, University of California, Berkeley, CA.

AUTHOR
Vladimir Vorobyev <bob@turbo.nsk.su>.