Documentation/config.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
   2 <HTML
   3 ><HEAD
   4 ><TITLE
   5 >Configuring IPTraf</TITLE
   6 ><META
   7 NAME="GENERATOR"
   8 CONTENT="Modular DocBook HTML Stylesheet Version 1.64
   9 "><LINK
  10 REL="HOME"
  11 TITLE="IPTraf User's Manual"
  12 HREF="manual.html"><LINK
  13 REL="PREVIOUS"
  14 TITLE="ARP, RARP, and other Non-IP Packet Filters"
  15 HREF="nonipfilters.html"><LINK
  16 REL="NEXT"
  17 TITLE="Timers"
  18 HREF="timers.html"></HEAD
  19 ><BODY
  20 CLASS="CHAPTER"
  21 BGCOLOR="#FFFFFF"
  22 TEXT="#000000"
  23 LINK="#0000FF"
  24 VLINK="#840084"
  25 ALINK="#0000FF"
  26 ><DIV
  27 CLASS="NAVHEADER"
  28 ><TABLE
  29 WIDTH="100%"
  30 BORDER="0"
  31 CELLPADDING="0"
  32 CELLSPACING="0"
  33 ><TR
  34 ><TH
  35 COLSPAN="3"
  36 ALIGN="center"
  37 >IPTraf User's Manual</TH
  38 ></TR
  39 ><TR
  40 ><TD
  41 WIDTH="10%"
  42 ALIGN="left"
  43 VALIGN="bottom"
  44 ><A
  45 HREF="nonipfilters.html"
  46 >&#60;&#60;&#60; Previous</A
  47 ></TD
  48 ><TD
  49 WIDTH="80%"
  50 ALIGN="center"
  51 VALIGN="bottom"
  52 ></TD
  53 ><TD
  54 WIDTH="10%"
  55 ALIGN="right"
  56 VALIGN="bottom"
  57 ><A
  58 HREF="timers.html"
  59 >Next &#62;&#62;&#62;</A
  60 ></TD
  61 ></TR
  62 ></TABLE
  63 ><HR
  64 ALIGN="LEFT"
  65 WIDTH="100%"></DIV
  66 ><DIV
  67 CLASS="CHAPTER"
  68 ><H1
  69 ><A
  70 NAME="CONFIG"
  71 >Configuring IPTraf</A
  72 ></H1
  73 ><P
  74 >   IPTraf can be easily configured
  75 with the <I
  76 CLASS="EMPHASIS"
  77 ><A
  78 HREF="config.html"
  79 >Configure...</A
  80 ></I
  81 > item in the
  82   main menu. The configuration is stored in the
  83   <TT
  84 CLASS="FILENAME"
  85 >/var/local/iptraf/iptraf.cfg</TT
  86 > file. If the file is not found, IPTraf uses
  87   the default settings. Any changes to the configuration immediately get
  88   stored in the configuration file.</P
  89 ><DIV
  90 CLASS="FIGURE"
  91 ><A
  92 NAME="AEN1942"
  93 ></A
  94 ><P
  95 ><IMG
  96 SRC="iptraf-configmenu.png"></P
  97 ><P
  98 ><B
  99 >Figure 1. The IPTraf configuration menu</B
 100 ></P
 101 ></DIV
 102 ><DIV
 103 CLASS="SECT1"
 104 ><H1
 105 CLASS="SECT1"
 106 ><A
 107 NAME="TOGGLES"
 108 >Toggles</A
 109 ></H1
 110 ><DIV
 111 CLASS="SECT2"
 112 ><H2
 113 CLASS="SECT2"
 114 ><A
 115 NAME="AEN1947"
 116 >Reverse DNS Lookups</A
 117 ></H2
 118 ><P
 119 >  Activating reverse lookup
 120   causes IPTraf to find out the name of the hosts with the addresses
 121   in the IP packets. When this option is enabled, IPTraf's
 122   IP traffic monitor starts the rvnamed DNS lookup server to help resolve
 123   IP addresses in the background while allowing IPTraf to
 124   continue capturing packets.</P
 125 ><P
 126 >  This option is off by default.</P
 127 ></DIV
 128 ><DIV
 129 CLASS="SECT2"
 130 ><H2
 131 CLASS="SECT2"
 132 ><A
 133 NAME="AEN1951"
 134 >TCP/UDP Service Names</A
 135 ></H2
 136 ><P
 137 >&#13;  This option, when on, causes IPTraf to display the TCP/UDP service names
 138   (<TT
 139 CLASS="COMPUTEROUTPUT"
 140 >smtp</TT
 141 >, <TT
 142 CLASS="COMPUTEROUTPUT"
 143 >www</TT
 144 >,
 145   <TT
 146 CLASS="COMPUTEROUTPUT"
 147 >pop3</TT
 148 >, etc.) instead of their numeric ports (25, 80,
 149   110, etc). The number-to-name mappings will depend on the systems
 150   services database file (usually <TT
 151 CLASS="FILENAME"
 152 >/etc/services</TT
 153 >).
 154    Should there be no corresponding service name for the
 155   port number, the numeric form will still be displayed.&#13;</P
 156 ><P
 157 >  This setting is off by default.</P
 158 ><DIV
 159 CLASS="NOTE"
 160 ><P
 161 ></P
 162 ><TABLE
 163 CLASS="NOTE"
 164 WIDTH="100%"
 165 BORDER="0"
 166 ><TR
 167 ><TD
 168 WIDTH="25"
 169 ALIGN="CENTER"
 170 VALIGN="TOP"
 171 ><IMG
 172 SRC="./stylesheet-images/note.gif"
 173 HSPACE="5"
 174 ALT="Note"></TD
 175 ><TH
 176 ALIGN="LEFT"
 177 VALIGN="CENTER"
 178 ><B
 179 >Note</B
 180 ></TH
 181 ></TR
 182 ><TR
 183 ><TD
 184 >&nbsp;</TD
 185 ><TD
 186 ALIGN="LEFT"
 187 VALIGN="TOP"
 188 ><P
 189 > Reverse lookup and service name lookup take some
 190  time and may impact performance and increase the chances of dropped
 191  packets. Performance and results are best (albeit more cryptic) with both
 192  these settings off.</P
 193 ></TD
 194 ></TR
 195 ></TABLE
 196 ></DIV
 197 ></DIV
 198 ><DIV
 199 CLASS="SECT2"
 200 ><H2
 201 CLASS="SECT2"
 202 ><A
 203 NAME="AEN1962"
 204 >Force promiscuous</A
 205 ></H2
 206 ><P
 207 >&#13;  If this option is enabled, your LAN interfaces will capture all packets
 208   on your LAN. Using this option enables you
 209   to see all TCP connections and packets passing your LAN segment, even if
 210   they're not from or for your machine. When this option is active
 211   in the statistics windows, the Activity indicators will show a
 212   good estimate of the load on your LAN segment.</P
 213 ><P
 214 >  When this option is disabled, you'll
 215   only receive information about packets coming from and entering your
 216   machine.</P
 217 ><P
 218 >  The setting of this option affects all LAN (
 219   Ethernet, FDDI, some Token Ring) interfaces on your machine, if you have more than one.</P
 220 ><P
 221 >  The interface's promiscuous flag is set only when a facility is started,
 222   and turned off when it exits. However, if promiscuous
 223   mode was already set when a facility was started, it remains set on exit.</P
 224 ><P
 225 >  If multiple instances of IPTraf are started, the promiscuous setting
 226   is restored only upon exit of the last facility.</P
 227 ><DIV
 228 CLASS="NOTE"
 229 ><P
 230 ></P
 231 ><TABLE
 232 CLASS="NOTE"
 233 WIDTH="100%"
 234 BORDER="0"
 235 ><TR
 236 ><TD
 237 WIDTH="25"
 238 ALIGN="CENTER"
 239 VALIGN="TOP"
 240 ><IMG
 241 SRC="./stylesheet-images/note.gif"
 242 HSPACE="5"
 243 ALT="Note"></TD
 244 ><TH
 245 ALIGN="LEFT"
 246 VALIGN="CENTER"
 247 ><B
 248 >Note</B
 249 ></TH
 250 ></TR
 251 ><TR
 252 ><TD
 253 >&nbsp;</TD
 254 ><TD
 255 ALIGN="LEFT"
 256 VALIGN="TOP"
 257 ><P
 258 >   Do not use other programs that change the interface's promiscuous flag at
 259   the same time you're using IPTraf. The programs can interfere with
 260   each other's expected operations. While IPTraf tries to obtain the
 261   initial setting of any promiscuous flags for restoration
 262   upon exit, other programs may not be as well-behaved, and they may
 263   turn off the promiscuous flags while IPTraf is still monitoring.</P
 264 ></TD
 265 ></TR
 266 ></TABLE
 267 ></DIV
 268 ></DIV
 269 ><DIV
 270 CLASS="SECT2"
 271 ><H2
 272 CLASS="SECT2"
 273 ><A
 274 NAME="AEN1972"
 275 >Color</A
 276 ></H2
 277 ><P
 278 >  Turn this on with color monitors. Turn it off with
 279   black-and- white monitors or non-color terminals (like xterms). Changes
 280   to this setting will take effect the next time the program is started.</P
 281 ><P
 282 >  Color is on by default on consoles and color xterms, off on non-color terminals like xterms and VT100s.</P
 283 ></DIV
 284 ><DIV
 285 CLASS="SECT2"
 286 ><H2
 287 CLASS="SECT2"
 288 ><A
 289 NAME="AEN1976"
 290 >Logging</A
 291 ></H2
 292 ><P
 293 >  When this option is active, IPTraf will log information to a
 294   disk file, which can be examined or analyzed later. Since IPTraf
 295   2.4.0, IPTraf prompts you for the name of the file to which to write the
 296   logs. It will provide a default name, which you are free to accept
 297   or change. The IP traffic monitor and LAN station monitor will
 298   generate a log file name that is based on what instance they are (first,
 299   second, and so on). The general interface statistics' default log file
 300   name is constant, because it listens to all interfaces at once, and only
 301   one instance can run at one time.</P
 302 ><P
 303 >  The other facilities generate a log file name based
 304   on the interface they're listening on.</P
 305 ><P
 306 >  See the descriptions on the facilities above for the default log file names.</P
 307 ><P
 308 >  Press Enter to accept the log file name, or Ctrl+X to cancel. Canceling will turn logging off for that session.</P
 309 ><P
 310 >  The IP traffic monitor will write the following pieces of information to its log file:</P
 311 ><P
 312 ></P
 313 ><UL
 314 COMPACT="COMPACT"
 315 ><LI
 316 STYLE="list-style-type: disc"
 317 ><P
 318 >Start of the traffic monitor</P
 319 ></LI
 320 ><LI
 321 STYLE="list-style-type: disc"
 322 ><P
 323 >Receipt of the first TCP packet for a connection. If that packet is a
 324     SYN, (SYN) will be indicated in the log entry. (Of course, the traffic
 325     monitor may start in the middle of established connections. It
 326     will still count those packets. This also explains why some connection
 327     entries may become idle if the traffic monitor is started in the
 328     middle of a half-closed connection, and miss the first FIN.
 329     Such entries time out in a while.)</P
 330 ></LI
 331 ><LI
 332 STYLE="list-style-type: disc"
 333 ><P
 334 >Receipt of a FIN (with average flow rate)</P
 335 ></LI
 336 ><LI
 337 STYLE="list-style-type: disc"
 338 ><P
 339 >ACK of a FIN</P
 340 ></LI
 341 ><LI
 342 STYLE="list-style-type: disc"
 343 ><P
 344 >Timeouts of TCP entries (with average flow rate)</P
 345 ></LI
 346 ><LI
 347 STYLE="list-style-type: disc"
 348 ><P
 349 >Reset connections (with average flow rate)</P
 350 ></LI
 351 ><LI
 352 STYLE="list-style-type: disc"
 353 ><P
 354 >Everything that appears in the bottom window of the traffic monitor</P
 355 ></LI
 356 ><LI
 357 STYLE="list-style-type: disc"
 358 ><P
 359 >Stopping of the traffic monitor</P
 360 ></LI
 361 ></UL
 362 ><P
 363 >  Each log entry includes the date and time the entry was written. Logging
 364   is also affected by the defined filters.</P
 365 ><P
 366 >  Log files can grow very fast, so be prepared with plenty of
 367   free space and delete unneeded logs. Log write errors are not indicated.</P
 368 ><P
 369 >  Copies of the interface statistics, TCP/UDP statistics, packet
 370   size statistics, and LAN host statistics are also written
 371   to the log files at regular intervals. See <I
 372 CLASS="EMPHASIS"
 373 >Log
 374 Interval...</I
 375 > in this chapter.</P
 376 ><P
 377 >  IPTraf closes and reopens the active log file when it receives a
 378   <TT
 379 CLASS="COMPUTEROUTPUT"
 380 >USR1</TT
 381 > signal. This is useful in cases where a facility is run for
 382   long periods of time but the log files have to be cleared or moved.</P
 383 ><P
 384 >  To clear or move an active log file, rename it first. IPTraf will
 385   continue to write to the file despite the new name. Then use the UNIX
 386   kill command to send the running IPTraf process a <TT
 387 CLASS="COMPUTEROUTPUT"
 388 >USR1</TT
 389 > signal. IPTraf
 390   will then close the log file and open another with the
 391   original name. You can then safely remove or delete the renamed file.</P
 392 ><P
 393 >  Do not delete an open log file. Doing so will only result in a file just
 394   as large but filled with null characters (ASCII code 0).</P
 395 ><P
 396 >  Logging comes disabled by default. The <TT
 397 CLASS="COMPUTEROUTPUT"
 398 >USR1</TT
 399 > signal is caught only if
 400   logging is enabled, it is ignored otherwise.</P
 401 ><P
 402 > A valid specification of <TT
 403 CLASS="COMPUTEROUTPUT"
 404 >-L</TT
 405 > on the command line with automatically
 406  enable logging for that particular session.  The saved configuration setting is not affected.</P
 407 ></DIV
 408 ><DIV
 409 CLASS="SECT2"
 410 ><H2
 411 CLASS="SECT2"
 412 ><A
 413 NAME="AEN2013"
 414 >Activity mode</A
 415 ></H2
 416 ><P
 417 >  Toggles activity indicators in the interface and LAN statistics
 418   facilities between kilobits per second (kbits/s) or kilobytes per second
 419   (kbytes/s).</P
 420 ><P
 421 >  The default setting is kilobits per second.</P
 422 ></DIV
 423 ><DIV
 424 CLASS="SECT2"
 425 ><H2
 426 CLASS="SECT2"
 427 ><A
 428 NAME="AEN2017"
 429 >Source MAC addrs in traffic monitor</A
 430 ></H2
 431 ><P
 432 >  When enabled, the IP traffic monitor retrieves the packets' source MAC
 433   addresses if they came in on an Ethernet, FDDI, or PLIP interface. The
 434   addresses appear in the lower window for non-TCP
 435   packets, while for TCP connections, they can be viewed by pressing M.</P
 436 ><P
 437 >  No such information is displayed
 438   if the network interface doesn't use MAC addresses (such
 439   as PPP interfaces).</P
 440 ><P
 441 >  This can be used to determine the actual source of the packets on your local LAN.</P
 442 ><P
 443 >  The traffic monitor also logs the MAC addresses with this option
 444   enabled. The default setting is off.</P
 445 ></DIV
 446 ></DIV
 447 ></DIV
 448 ><DIV
 449 CLASS="NAVFOOTER"
 450 ><HR
 451 ALIGN="LEFT"
 452 WIDTH="100%"><TABLE
 453 WIDTH="100%"
 454 BORDER="0"
 455 CELLPADDING="0"
 456 CELLSPACING="0"
 457 ><TR
 458 ><TD
 459 WIDTH="33%"
 460 ALIGN="left"
 461 VALIGN="top"
 462 ><A
 463 HREF="nonipfilters.html"
 464 >&#60;&#60;&#60; Previous</A
 465 ></TD
 466 ><TD
 467 WIDTH="34%"
 468 ALIGN="center"
 469 VALIGN="top"
 470 ><A
 471 HREF="manual.html"
 472 >Home</A
 473 ></TD
 474 ><TD
 475 WIDTH="33%"
 476 ALIGN="right"
 477 VALIGN="top"
 478 ><A
 479 HREF="timers.html"
 480 >Next &#62;&#62;&#62;</A
 481 ></TD
 482 ></TR
 483 ><TR
 484 ><TD
 485 WIDTH="33%"
 486 ALIGN="left"
 487 VALIGN="top"
 488 >ARP, RARP, and other Non-IP Packet Filters</TD
 489 ><TD
 490 WIDTH="34%"
 491 ALIGN="center"
 492 VALIGN="top"
 493 >&nbsp;</TD
 494 ><TD
 495 WIDTH="33%"
 496 ALIGN="right"
 497 VALIGN="top"
 498 >Timers</TD
 499 ></TR
 500 ></TABLE
 501 ></DIV
 502 ></BODY
 503 ></HTML
 504 >