Network Traffic Monitor?

[Craig Sheppard]

Is there a terminal command similar to fs_usage for the network? I would like to be able to see each attempt to access my machine, and what each of my apps is doing WRT the internet.

If no terminal command, is there a UNIX app? Seems like a pretty fundamental utility!

Thanks!

Craig Sheppard

[mervTormel]

consult the man pages for:

lsof - list open files (try -i -n -P)

netstat - show network status (try -f inet)



WRT? what that mean?

as for access to your machine, you might want a firewall app, like brickhouse.

[Craig Sheppard]

Thanks- I was hoping for more of a realtime display (like fs_usage). I'll have to dig in with this one...

I already have a firewall, but I wanted to do some testing of my LAN.

WRT= With Regards To

Thanks again!

Craig Sheppard

[blb]

I think you're looking for tcpdump. For example, if you want to watch all web traffic,


sudo tcpdump -i en0 port 80


should do it (unless you have use a proxy, in which case you'll want to watch the port for it). For some reason, you need to specify which interface (at least on my machine) as whatever the compiled default is, it doesn't work. Removing the port 80 option will show all traffic, which could be noisy...

[monickels]

I am assuming you have a Fink installation; that's the best way to install some of these. They may only be listed in Fink's unstable tree, but they seem to work in some fashion for me. Try fink install *packagename*. A couple may require an XWindows installation. Some you can find on Versiontracker.

ethereal (XWindows)
tethereal (command line version of ethereal)
MacSniffer (Aqua front-end to tcpdump)
ettercap (terminal)
ntop
nmap
nmapfe (XWindows version of nmap)
Sniffles (Aqua)

[Craig R. Arko]

There's Sniffer (Aqua) - look on VersionTracker for ths packet sniffer;

Brickhouse (Aqua) - a GUI for the builtin firewall but with some good logging capabilities;

And the irrepressible Skwonk! from Stimpsoft (www.stimpsoft.com), which plays background noises according to which IP port is being accessed, in real time.

[sao]

With fink you could also install "sniffit".

It has various functions that aren't offered in any other non-commercial sniffer.

Cheers...