FLOWTOP(8)

💖 FLOWTOP — the flowtop manual, but make it cute 💖

okay bestie, welcome to flowtop(8), part of the netsniff-ng toolkit 🌈. This is the whole page, every flag, every warning, no skips, no cap. Let's get into it ✨

---

✨ NAME ✨

flowtop — it's a top-like tracker for netfilter TCP/UDP/SCTP/DCCP/ICMP(v6) flows 👑 like, it watches your flows the way you watch your group chat.

---

🦋 SYNOPSIS 🦋

flowtop { [options] }

that's it. that's the whole vibe. options go in, slay comes out 💅

---

🌸 DESCRIPTION 🌸

okay so flowtop is a top-like connection tracking tool, and it can run on an end host or on a small home router 🏠. It presents TCP, UDP/UDP-lite, SCTP, DCCP, and ICMP(v6) flows that the kernel's netfilter connection tracking framework already collected — which means no packet capturing in user space needs to be done. zero. none. the kernel did it for you, periodt 💖

so basically flowtop gives you a quick overview of the current connections on your local system — for debugging purposes, or just to answer questions like:

• If you access website X, what other connections are being opened in the background that I'm not aware of? 👀
• What connections are active that pass one's router?
• I have this proprietary binary Y, to where does it connect?
• To which countries am I sending data?
• Are there any suspicious background connections on my machine?
• How many active connections does binary Y have?
• How long are connections active already?
• At which rate am I sending/receiving data?

and here's everything that gets presented in flowtop's output 🎀:

• Application name and PID when run on local machine
• Reverse DNS for source and destination
• Geo-location information (country, city)
• Used protocols (IPv4, IPv6, TCP, UDP, SCTP, ICMP, ...)
• Flow port's service name heuristic
• Transport protocol state machine information
• Byte/packet counters (if they are enabled)
• Connection duration (if timestamping is enabled)
• Flow send/receive rate (if byte/packet counters are enabled)

---

🔥 making it actually work (netfilter check) 🔥

for flowtop to work, netfilter must be active and running on your machine — meaning kernel-side connection tracking is active. if netfilter is not running, you can activate it with iptables(8):

iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT

or by loading the following kernel modules:

modprobe nf_conntrack_ipv4

modprobe nf_conntrack_ipv6

💫 byte/packet counters 💫

to dump byte/packet counters, flowtop enables the sysctl(8) parameter net.netfilter.nf_conntrack_acct via:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_acct

and it resets it to the previously set value on exit 🫶. important: these counters will only be active on connections which were created after accounting was enabled. so if you want these counters active all the time, the parameter should be enabled after the system is up. to automatically enable it, sysctl.conf(8) or sysctl.d(8) might be used ✨

⏳ connection duration ⏳

to calculate the connection duration, flowtop enables the sysctl(8) parameter net.netfilter.nf_conntrack_timestamp via:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_timestamp

and resets it to the previously set value on exit 💖

real talk: flowtop's intention is just to get a quick look over your active connections. if you want logging support, go look at netfilter's conntrack(8) tools instead. it's giving different tool, different job 💅

---

💅 OPTIONS 💅

• -4, --ipv4 — Display IPv4 flows. That is the default when flowtop is started without any arguments.
• -6, --ipv6 — Display IPv6 flows. That is the default when flowtop is started without any arguments.
• -T, --tcp — Display TCP flows. That is the default when flowtop is started without any arguments.
• -U, --udp — Display UDP and UDP-lite flows.
• -D, --dccp — Display DCCP flows.
• -I, --icmp — Display ICMP version 4 and version 6 flows.
• -S, --sctp — Display SCTP flows.
• -n, --no-dns — Don't perform hostname lookup. Only numeric addresses will be shown for flow endpoints.
• -G, --no-geoip — Don't perform GeoIP lookup. No geographical information will be shown for flow endpoints.
• -s, --show-src — Also show source information of the flow, not only destination information.
• -b, --bits — Show flow rates in bits per second instead of bytes per second.
• -u, --update — The built-in database update mechanism will be invoked to get Maxmind's latest database. To configure search locations for databases, the file /etc/netsniff-ng/geoip.conf contains possible addresses. Thus, to save bandwidth or for mirroring Maxmind's databases (to bypass their traffic limit policy), different hosts or IP addresses can be placed into geoip.conf, separated by a newline.
• -t <time>, --interval <time> — Flow info refresh interval in seconds, default is 1s.
• -v, --version — Show version information and exit.
• -h, --help — Show user help and exit.

---

🎀 USAGE EXAMPLE 🎀

• flowtop — Default ncurses output for flowtop that tracks IPv4, IPv6 flows for TCP.
• flowtop -46UTDISs — This example enables the maximum display options for flowtop. it's giving maxed out, fully unlocked, no notes 🔥

---

🧚 CONFIG FILES 🧚

Files under /etc/netsniff-ng/ can be modified to extend flowtop's service resolution and lookup information 💜

• tcp.conf - TCP port/services map
• udp.conf - UDP port/services map
• geoip.conf - GeoIP database mirrors

---

😭 BUGS 😭

with a fairly high rate of connection tracking updates, flowtop can become unresponsive for short periods of time while scrolling 😵‍💫. the right fix would be to replace flowtop's connection management backend with a better design with respect to the locking approach. this is still on the "todo" list. so like… known, acknowledged, not fixed. we move 🫶

---

⚖️ LEGAL ⚖️

flowtop is licensed under the GNU GPL version 2.0.

---

👑 HISTORY 👑

flowtop was originally written for the netsniff-ng toolkit by Daniel Borkmann. It is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel Borkmann <dborkma@tik.ee.ethz.ch>. legends, fr fr 💖

---

🌈 SEE ALSO 🌈

netsniff-ng(8), trafgen(8), mausezahn(8), ifpps(8), bpfc(8), astraceroute(8), curvetun(8), iptables(8), sysctl(8), sysctl.conf(8), sysctl.d(8)

---

✍️ AUTHOR ✍️

Manpage was written by Daniel Borkmann.

---

🌟 COLOPHON 🌟

This page is part of the Linux netsniff-ng toolkit project. A description of the project, and information about reporting bugs, can be found at http://netsniff-ng.org/.

---

and that's the whole thing bestie 🫶 this page is from the Linux manual set, version date 03 March 2013, and it's the flowtop(8) page from the netsniff-ng toolkit 💖 go track some flows, you got this ✨🌸