Skip to content
The Linux netlink-based TCP connection flow printer
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
_tools Embed oss credits to go binary Jun 17, 2018
netutil
tcpflow
vendor
.gitignore
.travis.yml Add .travis.yml Mar 4, 2018
CHANGELOG.md
CREDITS
Gopkg.lock Improve performance for getting connection stats in linux by netlink Jun 16, 2018
Gopkg.toml
LICENSE Add README and LICENSE Mar 4, 2018
Makefile
README.md Add README about sorting Jun 28, 2018
cli.go
cli_test.go
credits.go
main.go
version.go

README.md

lstf

lstf prints host flows (aggregated network connection flows to the same source or destination ports) by Linux netlink and enables you to simply grasp the network relationship between localhost and other hosts.

friend: yuuki/lsconntrack

Features

  • Distinction of active open and passive open
  • Print also the number of connections of each flows (the absolute values are meaningless)
  • Go portability
  • JSON support
  • TCP support only

How to use

HTTP requests --> Web:80 --> MySQL:3306

$ lstf -n
Local Address:Port   <-->   Peer Address:Port     Connections
10.0.1.9:many        -->    10.0.1.10:3306        22
10.0.1.9:many        -->    10.0.1.11:3306        14
10.0.2.10:22         <--    192.168.10.10:many    1
10.0.1.9:80          <--    10.0.2.13:many        120
10.0.1.9:80          <--    10.0.2.14:many        202
  • --> indicates active open
  • <-- indicates passive open

Sort flows by the number of connection.

$ lstf -n | sort -nrk4

JSON format

$ lstf -n --json | jq -r -M '.'
[
  {
    "direction": "active",
    "local": {
      "Addr": "10.0.1.9",
      "Port": "many"
    },
    "peer": {
      "addr": "10.0.100.1",
      "port": "3306"
    },
    "connections": 20
  },
  {
    "direction": "passive",
    "local": {
      "addr": "10.0.1.9",
      "port": "80"
    },
    "peer": {
      "addr": "10.0.200.1",
      "port": "many"
    },
    "connections": 27
  },
  ...
]

License

MIT

Author

yuuki

You can’t perform that action at this time.