iftop - how to generate text file with its output?

Question

iftop is great tool to view almost live bandwidth usage distinguished by source-ip source-port destination-ip destination port.

I'm using it to see which client's ip is using most bandwidth. Now I would like to store output somewhere.

iftop uses ncurses so

iftop > log.txt

does not work as expected, result file is not readable.

Is there any tool like this which can be used to pipe output to a text file?

Solution 1

Since iftop-1.0pre3 (2014-01-01), a text output mode was added. This will be very useful to anyone trying to parse the output of iftop.

The command line option to activate text (batch) mode is:

-t          use text interface without ncurses

When using text mode, the following options are available:

-s num      print one single text output afer num seconds, then quit
-L num      number of lines to print

Use the -h option for help on iftop usage.

Example usage would be:

iftop -t > log.txt
iftop -t -s 180 > log.txt

If you want it to run in the background for 5 hours:

iftop -t -s 18000 > log.txt &

Check on background job with job command.

Solution 2

iptraf can log this level of detail. The output looks something like this:

Wed Apr 25 23:08:42 2012; UDP; eth0; 65 bytes; from 192.168.1.20:45061 to 192.168.1.254:53
Wed Apr 25 23:08:42 2012; UDP; eth0; 133 bytes; from 192.168.1.254:53 to 192.168.1.20:45061
Wed Apr 25 23:08:43 2012; UDP; eth0; 96 bytes; from 192.168.1.21:137 to 192.168.1.20:137
Wed Apr 25 23:08:44 2012; UDP; eth0; 472 bytes; from 192.168.1.21:1900 to 239.255.255.250:1900
Wed Apr 25 23:08:47 2012; ICMP; eth0; 159 bytes; from 192.168.1.20 to 173.176.222.82; dest unrch (port)

Solution 3

Seems that iftop can't output to a text file(there is a feature request but it is not already implemented), in the meantime take a look at bwm-ng utility that is similar to iftop but allow to output on a CSV file.

Here's an example of usage :

bwm-ng -o csv -c 6 -T rate -I eth0 >> bandwidth.log

Comments

[mickula]

thx Khaled for your reply, I know this already that's why I'm looking for iftop batch alternative.

[gies0r]

You could also go for tcpdump if you want to be very precise...

[mickula]

I already know this one, the problem is that output looks like: 1334421690;eth0;1909467.12;156131.73;2065598.88;78222;956643‌​;2562.87;1956.09;451‌​8.96;980;1284;0.00;0‌​.00;0;0 1334421690;total;1909467.12;156131.73;2065598.88;78222;95664‌​3;2562.87;1956.09;45‌​18.96;980;1284;0.00;‌​0.00;0;0 1334421690;eth0;1934056.00;142336.00;2076392.00;71168;967028‌​;2502.00;1874.00;437‌​6.00;937;1251;0.00;0‌​.00;0;0 1334421690;total;1934056.00;142336.00;2076392.00;71168;96702‌​8;2502.00;1874.00;43‌​76.00;937;1251;0.00;‌​0.00;0;0 so it's for whole interface not grouped by connected ip addresses

[mickula]

it's not about the format of file, it's that the stats is summary for interface not grouped by client IP

[Banjer]

What command line options do you use to get that output with iptraf?

[dwurf]

sudo iptraf -i eth0 -L /tmp/traffic_log

[Ehsan88]

A couple of notes: 1) I should run iptraf-ng on linux mint. 2) I should install car too by : sudo apt install ucommon-utils