This is traffic-vis, a free network traffic monitor package.
traffic-vis is a suite of tools to help determine which hosts have
been communicating on an IP network, with whom they have been
communicating and the volume of communication taking place on a host
by host basis.

This release (0.30) breaks the monolithic traffic-vis program into
man pieces. traffic-collector, a daemon which collects (duh) and
summarises network traffic and will produce a report upon receipt of a
SIGUSR1. This report is in text format, but is not designed to be read
by humans. A bunch of tools are provided to process this and convert
it into a human-readable report:

traffic-resolve, a small tool to resolve the hostnames in a
traffic-collect log. traffic-sort, which sorts and limits the size
of a report and three front-ends: traffic-tops, traffic-totext and
traffic-tohtml which take produce postscript, text and HTML reports
respectively.

A worked example:

traffic-collector --summary-file /tmp/summary.tv
# (wait 5 minutes while it collects network traffic)
killall -USR1 traffic-collector

traffic-sort -Hb -Pb -L60 < /tmp/summary.tv > /tmp/report-sorted.tv
traffic-resove < /tmp/report-sorted.tv > /tmp/report-resolved.tv
traffic-tohtml < /tmp/report-resolved.tv > /tmp/report.html
traffic-tops < /tmp/report-resolved.tv > /tmp/report.ps

Of course, several of these steps could be combined onto a single 
commandline.

This approach offers a lot more flexability than the previous "one
program does everything" system. It also allows for the manipulation
of reports by non-root users.

traffic-vis requires libpcap 0.4 to build. This is available from
ftp://ftp.ee.lbl.gov. The collector reads raw network frames, so it
needs to be run as root (I strongly recommend against making it SUID).

You will also need glib. I have developed traffic-vis using glib-1.1.4
but I think older versions should work too. glib is available from
ftp://ftp.gimp.org/pub/gtk/v1.1/ RedHat users will probably want to
use the RPM version, this is included on the RedHat 5.2 CD in the 
directory "/gnome", otherwise it can be downloaded from 
ftp://ftp.gnome.org/pub/GNOME/redhat/latest/i386/

Traffic-vis has its very own homepage at
http://www.ilogic.com.au/~dmiller/traffic-vis.html

Your ideas, flames, bug-reports and (hopefully) patches greatfully
accepted.

Damien Miller <dmiller@ilogic.com.au>

