ethertop

Section: User Commands (1)
Updated: 11/26/1991
Index Return to Main Contents

NAME

ethertop - display and update information about the top network using machines

SYNOPSIS

ethertop [ -it ] [ -s seconds ] hostname

DESCRIPTION

ethertop is a program which displays network usage in the form of top(1). ethertop uses the rpc.etherd(8) server running on the host specified host to gather information about the network. traffic(1) provides a visual display of this using Sunview. ethertop is purely text based, although an X version is in the works. ethertop is intended for quick diagnosis of network problems. Questions like "who is beating on the fileserver" are very quickly answered by a glance at the ethertop statistics. Note that rpc.etherd must be running on a machine on the network you are interested in observing. As rpc.etherd only sees packets recieved on the interface it is running on, ethertop will only monitor traffic on a given subnet. rpc.etherd puts the interface it monitors in promiscuous mode, and you must be root to start it. Placing the interface in promiscuous mode causes a perforance hit as all packets on the network are interpreted.

DISPLAY

The first lines of the display give information about the types of packets present on the network during the sample time. Usually, the information is given in per second units. Across the top are the following statistics: bytes (total bytes per second), pkts (packets per second), bcst (broadcast packets per seconds), tcp (tcp packets per second), udp (udp packets per second), icmp (icmp packets per second), arp (arp packets per second), nd (network disk packets per second), oth (other packets per second). Below those statistics is data on packet sizes. These lines show how many packets per second of a particular size of packet is being sent on the network. The two columns below the packet statistics show the top senders and top recievers of packets. Note that there is no direct correlation between the two columns on a line per line basis.

COMMANDS

Like top(1), ethertop runs in CBREAK mode and interprets commands on the fly from the terminal. The following keys are meaningful:

i: This toggles the IP number to hostname mapping. ethertop maintains a cache of IP to hostname mappings. Hostnames are added to the cache as they appear. This prevents beating on NIS or your local nameserver.
l: Redraws the screen.
n: This changes the the number of hosts displayed. Prompts for a number between 0 and the number of available lines on the screen.
s: Changes the number of seconds between display updates. Prompts for a number greater than 2. Any less than this and the rpc traffic usually becomes significantly greater than any other traffic being measured.
t: Statistics usually display on a per seconds basis. This can be changed with the to reflect total accumulated averages since the start of the program rather than during each sample interval.
q: Quit ethertop.

OPTIONS

-s seconds: Specifies the amount of time to between samples and display updates. The default value is 5 seconds. The can be set within the program with the s command.
-t: Specifies that the packet counts and byte counts are to be time averaged since the program began running. This is good for looking at long term trends in network usage, rather than pinpointing a specific abuser. This can be toggled within the program with the t command.
-i: Specifies that ethertop should not map IP numbers to hostnames in the display. This can be toggled in the program with the i command.

BUGS

Somewhere. The handling for when the remote rpc hosts dies could be better. I am implementing packet type and host filters. They will appear in the next release. Please feel free to send me bugs, comments, and suggestions. This program needed to be written. Lets make it better.

AUTHOR

Guy Cardwell, Office of Academic Computing

University of California, Irvine

gcardwel@uci.edu.

This document was created by man2html, using the manual pages.
Time: 06:17:07 GMT, December 12, 2024