flodo(8)

NAME
flodo - simple network flow sampling tool

SYNOPSIS
flodo [ -1 ] [ -ddirection ] [ -ggroup_layer ] [ -idevice ] [ -p ] [ -sN_secs ] [ -ttop_N ] [ packet_filter ]

DESCRIPTION
flodo is a simple network flow sampling tool. It snoops traffic for a specified interval, then displays the top flows, then it repeats the process.

  OPTIONS

-1  One-shot mode. In this mode flodo will snoop flows and print a summary only once. This is useful in combination with watch(1). For example:

    watch -n0 flodo -1

-ddirection
    Specify in, out, or, either. Default is either. There is no portable way to distinguish in/out in libpcap -- flodo attempts to discover all local MAC addresses and considers any packet originating from one of those MAC addresses to be outbound. All other packets (which should include all inbound broadcasts and multicasts) are considered inbound.

-ggroup_layer
    Legal values are 2, 3, or 4. Default is 4. This specifies the network layer at which flodo accumulates statistics.

-idevice
    Specify a device from which to gather flows.

-p  Enable promiscuous capture mode (this is the opposite of tcpdump -p).

-sN_secs
    Specifiy the number of seconds for which to accumulate statistics before dumping a summary. Default is 5.

-ttop_N
    Each summary the flows are sorted by the number of bytes transferred. This option selects how many of the top-most flows are displayed.

packet_filter
    An optional pcap packet filter can be specified. The language is the same as supported by tcpdump(8).

SEE ALSO
tcpdump(8), watch(1)

CAVEATS
flodo understands only ethernet devices, IPv4, tcp and udp. Other device types cause an error. Packets from ethernet protocols other than IPv4 are accumulated/displayed only with their MAC addresses and ethernet protocol number. IPv4 protocols other than tcp/udp are accumulated/displayed only with their IPv4 addresses and protocol number.

The inbound/outbound distinction is implemented by discovering all local MAC addresses -- regardless of the device the address belongs to. This means that flodo considers a packet to be outbound even if it has a source MAC address from a device it is not currently snooping.

AUTHOR
dean gaudet
dean@arctic.org