iptstate - Top-like state for netfilter/iptables

February 3, 2010 · General · Email This Post
Share
{lang: 'en-GB'}

iptstate  displays  information  held  in  the IP Tables state table in real-time in a top-like format.  Output can be sorted by any field,  or any field reversed. Users can choose to have the output only print once and  exit,  rather  than  the  top-like   system.   Refresh   rate   is configurable,  IPs  can  be resolved to names, output can be formatted,the display can be filtered, and color coding are  among  some  of  the many features.
Install iptstate in ubuntu

sudo apt-get install iptstate

Using iptstate

Syntax

iptstate [<options>]

Available options

-c, --no-color -  Toggle color-code by protocol

-C, --counters  - Toggle display of bytes/packets counters

-d, --dst-filter IP-  Only  show  states with a destination of IP Note, that this must be an IP, hostname matching is not yet supported.

-D --dstpt-filter port -  Only show states with a destination port of port

-h, --help - Show help message

-l, --lookup - Show hostnames instead of IP addresses

-m, --mark-truncated - Mark truncated hostnames with a ’+’

-o, --no-dynamic - Toggle dynamic formatting

-L, --no-dns - Skip outgoing DNS lookup states

-f, --no-loopback - Filter states on loopback

-p, --no-scroll - No scrolling (don’t use a “pad”). See  SCROLLING  AND  PADS  for more information.

-r, --reverse - Reverse sort order

-R, --rate seconds - Refresh rate, followed by rate in seconds. Note that this is for statetop  mode,  and  not   applicable   for   single-run   mode (--single).

-1, --single - Single run (no curses)

-b, --sort column - This determines what column to sort by. Options:
S Source Port
d Destination IP (or Name)
D Destination Port
p Protocol
s State
t TTL
b Bytes
P Packets
To  sort  by  Source  IP  (or  Name),  don’t  use -b. Sorting by bytes/packets is only available for kernels that support it, and only when compiled against libnetfilter_conntrack (the default).

-s, --src-filter IP - Only show states with a source of IP. Note, that this must be an IP, hostname matching is not yet supported.

-S, --srcpt-filter port - Only show states with a source port of port

-t, --totals - Toggle display of totals

Incoming search terms:

Share

Related posts

←
→

4 Comments to “iptstate - Top-like state for netfilter/iptables”

  1. Mathieu says:
    February 3, 2010 at 2:22 am

    I’m using Ubuntu Karmic (9.10). I ran apt-get update then apt-get install ipsate and just got an error saying that the package does not exist.

    [Reply]

  2. admin says:
    February 3, 2010 at 7:08 am

    correct command is

    sudo apt-get install iptstate

    [Reply]

  3. Tom says:
    February 4, 2010 at 4:02 pm

    Synaptic Package Manager says: Iptstate is only useful if netfilter CONNTRACK is enabled in
    the kernel.

    How does one discover if CONNTRACK is enable in the kernel?

    [Reply]

  4. FirstByte says:
    May 6, 2010 at 12:01 am

    @Tom:
    How does one discover if CONNTRACK is enable in the kernel?

    try
    ~$ lsmod | grep conntrack

    [Reply]

Leave a Reply

←
→