traffic-sort - Sort a network traffic report

traffic-sort [-Vh] [-i, --input file] [-o, --output file] [-H, --host-sort key] [-P, --peer-sort key] [-L, --limit-hosts num] [-K, --limit-peers num]

traffic-sort is a small program which will sort and limit the length of a network traffic report generated by traffic-collect(8) in various ways. It is designed to be used as a filter, expecting a report on standard input and writing a processed report to standard output. This way complex sorting can be achieved by chaining several traffic-sort processes together. Alternately, the input and output files can be specified using the '-i' and '-o' commandline options.

-i, --input file

Read input from file instead of standard input.

-o, --output file

Write output to file instead of standard output.

-H, --host-sort key

Sort hosts by sort-key (see SORTING section for details).

-P, --peer-sort key

Sort peer lists by sort-key (see SORTING section for details).

-L, --limit-hosts num

Limit number of hosts to display

-K, --limit-peers num

Limit number of peers to display per host

-h --help

Prints usage information

-V --version

Prints program version

The host and peer lists can be sorted in one of several ways with the -H and -P options. While several sort keys can be used for both hosts and peers, some cannot. The following table documents the function of each sort key and the context in which it is valid:

N, none Do not sort (hosts + peers).

b, bytes

Total bytes send and received (hosts + peers).

s, bsent

Bytes sent (hosts).

r, breceived

Bytes received (hosts + peers).

p, packets

Total packets sent and received (hosts + peers).

S, psent

Packets sent (hosts).

R, preceived

Packets received (hosts).

C, connects

Total TCP connection requests sent and received (hosts + peers).

c, csent

TCP connection requests sent (hosts).

l, creceived

TCP connections requests received (hosts).

P, peers

Number of peers (hosts).

h, hostname

Hostname (hosts).

I, ipaddr

IP address (hosts).

F, firstseen

Time of first detected traffic (hosts).

L, lastseen

Time of last recorded traffic (hosts).

X, random

Random (hosts + peers).

The simplest example:

traffic-sort -Hn

Will read a report from standard input, perform no sorting and write the report to standard output.

The following example will limit the number of hosts in a report to 50:

traffic-vis -L 50

This example will sort the hosts in order of decreasing traffic volume and limit the report to ten hosts. This will produce a list of the ten busiest hosts in the original report:

traffic-vis -H b -L 50

Complex processing can be achieved by chaining multiple invocations of traffic-sort together:

traffic-vis -Hb -Pb -L50 | traffic-sort -Hc

traffic-vis(8), traffic-collect(8), traffic-exclude(8), traffic-resolve(8), traffic-totext(8), traffic-tohtml(8), traffic-tops(8), traffic-togif(8),

Damien Miller <dmiller@ilogic.com.au>

http://www.ilogic.com.au/~dmiller/traffic-vis.html

Hopefully none, probably legion.