iftopdoes for network usage what
top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question “why is our ADSL link so slow?”.
I was reading a post on Twitter about
iftop and thought I should install it in OS X.
In Linux you’ll probably find it in your package manager (pacman, dnf, apt, etc.). But, on my Mac I prefer to install things manually. I don’t use any package managers there.
It’s really a great tool, and the installation is not too hard. I only experienced 1 issue… (I’ll get back to that one later).
First you need a couple of dependencies.
I think both are already installed in OS X, but let’s add new fresh ones - in
/usr/local. Make sure you have that in front of
PATH, something like:
You can find the lastest version here. At the moment it’s 6.0. Download the tarpackage and signature, verify the download and unpack it.
cd to the folder, and when looking at my old notes I used:
cd ncurses-6.0/ mkdir __build && cd __build ../configure --with-shared --enable-widec make -j5 sudo make install
So clone the repository and print out the help file to see what’s in there.
git clone email@example.com:the-tcpdump-group/libpcap.git cd libpcap ./configure --help > ../libpcap_help.txt
The bluetooth option failed for me here, but it was nice to see there’s an OS X option. I only use 64bit and don’t need any universal build. My configure/installation was:
mkdir __build && cd __build ../configure --enable-ipv6 --disable-universal --enable-shared --enable-usb make -j5 sudo make install
Note: Many ISP’s doesn’t use IPv6 (mine doesn’t), but the local network does.
Ok, here’s the “issue” I mentioned before… You can’t build from your own build directory. When doing so, you’ll get an error when running
checking POSIX threads compilation... cat: config/pthread.c: No such file or directory cat: config/pthread.c: No such file or directory cat: config/pthread.c: No such file or directory cat: config/pthread.c: No such file or directory etc...
Looks like they can’t handle the paths when compiling and using a
__build folder. Anyway, it was ok when I run it directly from the source folder - even though I didn’t like that. I prefer the separate build directory.
Clone the repository and install:
git clone firstname.lastname@example.org:soarpenguin/iftop.git cd iftop ./configure --with-libpcap=/usr/local make -j5 sudo make install
Confirming the installation:
$ which iftop /usr/local/sbin/iftop
iftop -h to bring the help.
$ iftop -h iftop: display bandwidth usage on an interface by host Synopsis: iftop -h | [-npblNBP] [-i interface] [-f filter code] [-F net/mask] [-G net6/mask6] -h display this message -n don't do hostname lookups -N don't convert port numbers to services -p run in promiscuous mode (show traffic between other hosts on the same network segment) -b don't display a bar graph of traffic -B Display bandwidth in bytes -i interface listen on named interface -f filter code use filter code to select packets to count (default: none, but only IP packets are counted) -F net/mask show traffic flows in/out of IPv4 network -G net6/mask6 show traffic flows in/out of IPv6 network -l display and count link-local IPv6 traffic (default: off) -P show ports as well as hosts -m limit sets the upper limit for the bandwidth scale -c config file specifies an alternative configuration file iftop, version 1.0pre2 copyright (c) 2002 Paul Warren <email@example.com> and contributors
And when running
iftop, you can press
h any time to bring up some options, how to toggle some views etc.
$ iftop -l
To run on a specific ethernet port:
$ iftop -l -i en0
I haven’t read the manual yet, but it looks convinient to use a config file… or multiple files to use with different scenarios.
Here’s a screenshot running on
en1, my second ethernet port. It’s empty here, but
en1 is one of my “back legs” (off grid networks). This one is just connected to the printer and an old (turned off) router.
Here’s another screenshot on another port, bringing up the options by pressing
Thanks @tecmint for the tip.