iptraf-ng-1.1.4/0000775000076400007640000000000012173477703013701 5ustar npajkovsnpajkovsiptraf-ng-1.1.4/iptraf-ng.spec0000664000076400007640000000501412173477702016443 0ustar npajkovsnpajkovsSummary: A console-based network monitoring utility Name: iptraf-ng Version: 1.1.4 Release: 1%{?dist} Source0: https://fedorahosted.org/releases/i/p/iptraf-ng/%{name}-%{version}.tar.gz Source1: iptraf-ng-logrotate.conf URL: https://fedorahosted.org/iptraf-ng/ License: GPLv2+ Group: Applications/System BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: ncurses-devel Obsoletes: iptraf < 3.1 Provides: iptraf = 3.1 %description IPTraf-ng is a console-based network monitoring utility. IPTraf gathers data like TCP connection packet and byte counts, interface statistics and activity indicators, TCP/UDP traffic breakdowns, and LAN station packet and byte counts. IPTraf-ng features include an IP traffic monitor which shows TCP flag information, packet and byte counts, ICMP details, OSPF packet types, and oversized IP packet warnings; interface statistics showing IP, TCP, UDP, ICMP, non-IP and other IP packet counts, IP checksum errors, interface activity and packet size counts; a TCP and UDP service monitor showing counts of incoming and outgoing packets for common TCP and UDP application ports, a LAN statistics module that discovers active hosts and displays statistics about their activity; TCP, UDP and other protocol display filters so you can view just the traffic you want; logging; support for Ethernet, FDDI, ISDN, SLIP, PPP, and loopback interfaces; and utilization of the built-in raw socket interface of the Linux kernel, so it can be used on a wide variety of supported network cards. %prep %setup -q %build %configure make %{?_smp_mflags} %install rm -rf $RPM_BUILD_ROOT make install DESTDIR=$RPM_BUILD_ROOT # remove everything besides the html and pictures in Documentation find Documentation -type f | grep -v '\.html$\|\.png$\|/stylesheet' | \ xargs rm -f install -D -m 0644 -p %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/iptraf-ng install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/{lock,log,lib}/iptraf-ng %clean rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root,-) %doc CHANGES FAQ LICENSE README* RELEASE-NOTES %doc Documentation %{_sbindir}/iptraf-ng %{_sbindir}/rvnamed-ng %{_mandir}/man8/iptraf-ng.8* %{_mandir}/man8/rvnamed-ng.8* %{_localstatedir}/lock/iptraf-ng %{_localstatedir}/log/iptraf-ng %{_localstatedir}/lib/iptraf-ng %config(noreplace) %{_sysconfdir}/logrotate.d/iptraf-ng %changelog * Wed Jan 11 2011 Nikola Pajkovsky - 1.1.0-1 - Initialization build iptraf-ng-1.1.4/configure0000775000076400007640000033725312173477702015624 0ustar npajkovsnpajkovs#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.63 for iptraf-ng 1.1.3.1.94.g421e. # # Report bugs to . # # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, # 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc. # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## --------------------- ## ## M4sh Initialization. ## ## --------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi # PATH needs CR # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo if (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # Support unset when possible. if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then as_unset=unset else as_unset=false fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. case $0 in *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 { (exit 1); exit 1; } fi # Work around bugs in pre-3.0 UWIN ksh. for as_var in ENV MAIL MAILPATH do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # Required to use basename. if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi # Name of the executable. as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # CDPATH. $as_unset CDPATH if test "x$CONFIG_SHELL" = x; then if (eval ":") 2>/dev/null; then as_have_required=yes else as_have_required=no fi if test $as_have_required = yes && (eval ": (as_func_return () { (exit \$1) } as_func_success () { as_func_return 0 } as_func_failure () { as_func_return 1 } as_func_ret_success () { return 0 } as_func_ret_failure () { return 1 } exitcode=0 if as_func_success; then : else exitcode=1 echo as_func_success failed. fi if as_func_failure; then exitcode=1 echo as_func_failure succeeded. fi if as_func_ret_success; then : else exitcode=1 echo as_func_ret_success failed. fi if as_func_ret_failure; then exitcode=1 echo as_func_ret_failure succeeded. fi if ( set x; as_func_ret_success y && test x = \"\$1\" ); then : else exitcode=1 echo positional parameters were not saved. fi test \$exitcode = 0) || { (exit 1); exit 1; } ( as_lineno_1=\$LINENO as_lineno_2=\$LINENO test \"x\$as_lineno_1\" != \"x\$as_lineno_2\" && test \"x\`expr \$as_lineno_1 + 1\`\" = \"x\$as_lineno_2\") || { (exit 1); exit 1; } ") 2> /dev/null; then : else as_candidate_shells= as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. case $as_dir in /*) for as_base in sh bash ksh sh5; do as_candidate_shells="$as_candidate_shells $as_dir/$as_base" done;; esac done IFS=$as_save_IFS for as_shell in $as_candidate_shells $SHELL; do # Try only shells that exist, to save several forks. if { test -f "$as_shell" || test -f "$as_shell.exe"; } && { ("$as_shell") 2> /dev/null <<\_ASEOF if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi : _ASEOF }; then CONFIG_SHELL=$as_shell as_have_required=yes if { "$as_shell" 2> /dev/null <<\_ASEOF if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi : (as_func_return () { (exit $1) } as_func_success () { as_func_return 0 } as_func_failure () { as_func_return 1 } as_func_ret_success () { return 0 } as_func_ret_failure () { return 1 } exitcode=0 if as_func_success; then : else exitcode=1 echo as_func_success failed. fi if as_func_failure; then exitcode=1 echo as_func_failure succeeded. fi if as_func_ret_success; then : else exitcode=1 echo as_func_ret_success failed. fi if as_func_ret_failure; then exitcode=1 echo as_func_ret_failure succeeded. fi if ( set x; as_func_ret_success y && test x = "$1" ); then : else exitcode=1 echo positional parameters were not saved. fi test $exitcode = 0) || { (exit 1); exit 1; } ( as_lineno_1=$LINENO as_lineno_2=$LINENO test "x$as_lineno_1" != "x$as_lineno_2" && test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2") || { (exit 1); exit 1; } _ASEOF }; then break fi fi done if test "x$CONFIG_SHELL" != x; then for as_var in BASH_ENV ENV do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var done export CONFIG_SHELL exec "$CONFIG_SHELL" "$as_myself" ${1+"$@"} fi if test $as_have_required = no; then echo This script requires a shell more modern than all the echo shells that I found on your system. Please install a echo modern shell, or manually run the script under such a echo shell if you do have one. { (exit 1); exit 1; } fi fi fi (eval "as_func_return () { (exit \$1) } as_func_success () { as_func_return 0 } as_func_failure () { as_func_return 1 } as_func_ret_success () { return 0 } as_func_ret_failure () { return 1 } exitcode=0 if as_func_success; then : else exitcode=1 echo as_func_success failed. fi if as_func_failure; then exitcode=1 echo as_func_failure succeeded. fi if as_func_ret_success; then : else exitcode=1 echo as_func_ret_success failed. fi if as_func_ret_failure; then exitcode=1 echo as_func_ret_failure succeeded. fi if ( set x; as_func_ret_success y && test x = \"\$1\" ); then : else exitcode=1 echo positional parameters were not saved. fi test \$exitcode = 0") || { echo No shell found that supports shell functions. echo Please tell bug-autoconf@gnu.org about your system, echo including any error possibly output before this message. echo This can help us improve future autoconf versions. echo Configuration will now proceed without shell functions. } as_lineno_1=$LINENO as_lineno_2=$LINENO test "x$as_lineno_1" != "x$as_lineno_2" && test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { # Create $as_me.lineno as a copy of $as_myself, but with $LINENO # uniformly replaced by the line number. The first 'sed' inserts a # line-number line after each line using $LINENO; the second 'sed' # does the real work. The second script uses 'N' to pair each # line-number line with the line containing $LINENO, and appends # trailing '-' during substitution so that $LINENO is not a special # case at line end. # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the # scripts with optimization help from Paolo Bonzini. Blame Lee # E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 { (exit 1); exit 1; }; } # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in -n*) case `echo 'x\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. *) ECHO_C='\c';; esac;; *) ECHO_N='-n';; esac if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -p'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -p' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -p' fi else as_ln_s='cp -p' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p=: else test -d ./-p && rmdir ./-p as_mkdir_p=false fi if test -x / >/dev/null 2>&1; then as_test_x='test -x' else if ls -dL / >/dev/null 2>&1; then as_ls_L_option=L else as_ls_L_option= fi as_test_x=' eval sh -c '\'' if test -d "$1"; then test -d "$1/."; else case $1 in -*)set "./$1";; esac; case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ???[sx]*):;;*)false;;esac;fi '\'' sh ' fi as_executable_p=$as_test_x # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= SHELL=${CONFIG_SHELL-/bin/sh} # Identity of this package. PACKAGE_NAME='iptraf-ng' PACKAGE_TARNAME='iptraf-ng' PACKAGE_VERSION='1.1.3.1.94.g421e' PACKAGE_STRING='iptraf-ng 1.1.3.1.94.g421e' PACKAGE_BUGREPORT='iptraf-ng@fedorahosted.org' ac_unique_file="src/iptraf.c" ac_subst_vars='LTLIBOBJS LIBOBJS NO_NCURSES ASCIIDOC7 ASCIIDOC TAR ac_ct_AR AR INLINE OBJEXT EXEEXT ac_ct_CC CPPFLAGS LDFLAGS CFLAGS CC target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking with_lib with_ncurses ' ac_precious_vars='build_alias host_alias target_alias CC CFLAGS LDFLAGS LIBS CPPFLAGS' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *) ac_optarg=yes ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && { $as_echo "$as_me: error: invalid feature name: $ac_useropt" >&2 { (exit 1); exit 1; }; } ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && { $as_echo "$as_me: error: invalid feature name: $ac_useropt" >&2 { (exit 1); exit 1; }; } ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && { $as_echo "$as_me: error: invalid package name: $ac_useropt" >&2 { (exit 1); exit 1; }; } ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && { $as_echo "$as_me: error: invalid package name: $ac_useropt" >&2 { (exit 1); exit 1; }; } ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) { $as_echo "$as_me: error: unrecognized option: $ac_option Try \`$0 --help' for more information." >&2 { (exit 1); exit 1; }; } ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. expr "x$ac_envvar" : ".*[^_$as_cr_alnum]" >/dev/null && { $as_echo "$as_me: error: invalid variable name: $ac_envvar" >&2 { (exit 1); exit 1; }; } eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 : ${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option} ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` { $as_echo "$as_me: error: missing argument to $ac_option" >&2 { (exit 1); exit 1; }; } fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) { $as_echo "$as_me: error: unrecognized options: $ac_unrecognized_opts" >&2 { (exit 1); exit 1; }; } ;; *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac { $as_echo "$as_me: error: expected an absolute directory name for --$ac_var: $ac_val" >&2 { (exit 1); exit 1; }; } done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe $as_echo "$as_me: WARNING: If you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used." >&2 elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || { $as_echo "$as_me: error: working directory cannot be determined" >&2 { (exit 1); exit 1; }; } test "X$ac_ls_di" = "X$ac_pwd_ls_di" || { $as_echo "$as_me: error: pwd does not report name of working directory" >&2 { (exit 1); exit 1; }; } # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." { $as_echo "$as_me: error: cannot find sources ($ac_unique_file) in $srcdir" >&2 { (exit 1); exit 1; }; } fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || { $as_echo "$as_me: error: $ac_msg" >&2 { (exit 1); exit 1; }; } pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures iptraf-ng 1.1.3.1.94.g421e to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/iptraf-ng] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of iptraf-ng 1.1.3.1.94.g421e:";; esac cat <<\_ACEOF Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-lib=ARG ARG specifies alternative name for lib directory --with-ncurses support http(s):// transports (default is YES) ARG can be also prefix for curl library and headers Some influential environment variables: CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L if you have libraries in a nonstandard directory LIBS libraries to pass to the linker, e.g. -l CPPFLAGS C/C++/Objective C preprocessor flags, e.g. -I if you have headers in a nonstandard directory Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to . _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for guested configure. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF iptraf-ng configure 1.1.3.1.94.g421e generated by GNU Autoconf 2.63 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by iptraf-ng $as_me 1.1.3.1.94.g421e, which was generated by GNU Autoconf 2.63. Invocation command line was $ $0 $@ _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. $as_echo "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) ac_configure_args0="$ac_configure_args0 '$ac_arg'" ;; 2) ac_configure_args1="$ac_configure_args1 '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi ac_configure_args="$ac_configure_args '$ac_arg'" ;; esac done done $as_unset ac_configure_args0 || test "${ac_configure_args0+set}" != set || { ac_configure_args0=; export ac_configure_args0; } $as_unset ac_configure_args1 || test "${ac_configure_args1+set}" != set || { ac_configure_args1=; export ac_configure_args1; } # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo cat <<\_ASBOX ## ---------------- ## ## Cache variables. ## ## ---------------- ## _ASBOX echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:$LINENO: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) $as_unset $ac_var ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo cat <<\_ASBOX ## ----------------- ## ## Output variables. ## ## ----------------- ## _ASBOX echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then cat <<\_ASBOX ## ------------------- ## ## File substitutions. ## ## ------------------- ## _ASBOX echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then cat <<\_ASBOX ## ----------- ## ## confdefs.h. ## ## ----------- ## _ASBOX echo cat confdefs.h echo fi test "$ac_signal" != 0 && $as_echo "$as_me: caught signal $ac_signal" $as_echo "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; { (exit 1); exit 1; }' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h # Predefined preprocessor variables. cat >>confdefs.h <<_ACEOF #define PACKAGE_NAME "$PACKAGE_NAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_TARNAME "$PACKAGE_TARNAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_VERSION "$PACKAGE_VERSION" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_STRING "$PACKAGE_STRING" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" _ACEOF # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. ac_site_file1=NONE ac_site_file2=NONE if test -n "$CONFIG_SITE"; then ac_site_file1=$CONFIG_SITE elif test "x$prefix" != xNONE; then ac_site_file1=$prefix/share/config.site ac_site_file2=$prefix/etc/config.site else ac_site_file1=$ac_default_prefix/share/config.site ac_site_file2=$ac_default_prefix/etc/config.site fi for ac_site_file in "$ac_site_file1" "$ac_site_file2" do test "x$ac_site_file" = xNONE && continue if test -r "$ac_site_file"; then { $as_echo "$as_me:$LINENO: loading site script $ac_site_file" >&5 $as_echo "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special # files actually), so we avoid doing that. if test -f "$cache_file"; then { $as_echo "$as_me:$LINENO: loading cache $cache_file" >&5 $as_echo "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { $as_echo "$as_me:$LINENO: creating cache $cache_file" >&5 $as_echo "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { $as_echo "$as_me:$LINENO: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { $as_echo "$as_me:$LINENO: error: \`$ac_var' was not set in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { $as_echo "$as_me:$LINENO: error: \`$ac_var' has changed since the previous run:" >&5 $as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { $as_echo "$as_me:$LINENO: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 $as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { $as_echo "$as_me:$LINENO: former value: \`$ac_old_val'" >&5 $as_echo "$as_me: former value: \`$ac_old_val'" >&2;} { $as_echo "$as_me:$LINENO: current value: \`$ac_new_val'" >&5 $as_echo "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) ac_configure_args="$ac_configure_args '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { $as_echo "$as_me:$LINENO: error: changes in the environment can compromise the build" >&5 $as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} { { $as_echo "$as_me:$LINENO: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&5 $as_echo "$as_me: error: run \`make distclean' and/or \`rm $cache_file' and start over" >&2;} { (exit 1); exit 1; }; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu config_file=config.mak.autogen config_append=config.mak.append config_in=config.mak.in echo "# ${config_append}. Generated by configure." > "${config_append}" ## Definitions of macros # CONF_APPEND_LINE(LINE) # -------------------------- # Append LINE to file ${config_append} # CONF_APPEND_LINE # # ARG_SET_PATH(PROGRAM) # ------------------------- # Provide --with-PROGRAM=PATH option to set PATH to PROGRAM # Optional second argument allows setting NO_PROGRAM=YesPlease if # --without-PROGRAM version used. # ARG_SET_PATH # # CONF_APPEND_PATH(PROGRAM) # ------------------------------ # Parse --with-PROGRAM=PATH option to set PROGRAM_PATH=PATH # Used by ARG_SET_PATH(PROGRAM) # Optional second argument allows setting NO_PROGRAM=YesPlease if # --without-PROGRAM is used. # CONF_APPEND_PATH # # PARSE_WITH(PACKAGE) # ----------------------- # For use in AC_ARG_WITH action-if-found, for packages default ON. # * Set NO_PACKAGE=YesPlease for --without-PACKAGE # * Set PACKAGEDIR=PATH for --with-PACKAGE=PATH # * Unset NO_PACKAGE for --with-PACKAGE without ARG # PARSE_WITH # # PARSE_WITH_SET_MAKE_VAR(WITHNAME, VAR, HELP_TEXT) # --------------------- # Set VAR to the value specied by --with-WITHNAME. # No verification of arguments is performed, but warnings are issued # if either 'yes' or 'no' is specified. # HELP_TEXT is presented when --help is called. # This is a direct way to allow setting variables in the Makefile. # PARSE_WITH_SET_MAKE_VAR ## Site configuration related to programs (before tests) ## --with-PACKAGE[=ARG] and --without-PACKAGE # # Set lib to alternative name of lib directory (e.g. lib64) # Check whether --with-lib was given. if test "${with_lib+set}" = set; then withval=$with_lib; if test "$withval" = "no" || test "$withval" = "yes"; then \ { $as_echo "$as_me:$LINENO: WARNING: You should provide name for --with-lib=ARG" >&5 $as_echo "$as_me: WARNING: You should provide name for --with-lib=ARG" >&2;}; \ else \ lib=$withval; \ { $as_echo "$as_me:$LINENO: Setting lib to '$lib'" >&5 $as_echo "$as_me: Setting lib to '$lib'" >&6;}; \ echo "lib=$withval" >> "${config_append}"; \ fi; \ fi if test -z "$lib"; then { $as_echo "$as_me:$LINENO: Setting lib to 'lib' (the default)" >&5 $as_echo "$as_me: Setting lib to 'lib' (the default)" >&6;} lib=lib fi # # Define NO_CURL if you do not have curl installed. git-http-pull and # git-http-push are not built, and you cannot use http:// and https:// # transports. # # Define CURLDIR=/foo/bar if your curl header and library files are in # /foo/bar/include and /foo/bar/lib directories. # Check whether --with-ncurses was given. if test "${with_ncurses+set}" = set; then withval=$with_ncurses; PACKAGE=NCURSES; \ if test "$withval" = "no"; then \ NO_NCURSES=YesPlease; \ elif test "$withval" = "yes"; then \ NO_NCURSES=; \ else \ NO_NCURSES=; \ NCURSESDIR=$withval; \ { $as_echo "$as_me:$LINENO: Setting NCURSESDIR to $withval" >&5 $as_echo "$as_me: Setting NCURSESDIR to $withval" >&6;}; \ echo "${PACKAGE}DIR=$withval" >> "${config_append}"; \ fi \ fi ## Checks for programs. { $as_echo "$as_me:$LINENO: CHECKS for programs" >&5 $as_echo "$as_me: CHECKS for programs" >&6;} # ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then for ac_prog in cc gcc do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_CC+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:$LINENO: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cc gcc do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_ac_ct_CC+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:$LINENO: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:$LINENO: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi test -z "$CC" && { { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { { $as_echo "$as_me:$LINENO: error: no acceptable C compiler found in \$PATH See \`config.log' for more details." >&5 $as_echo "$as_me: error: no acceptable C compiler found in \$PATH See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; }; } # Provide some information about the compiler. $as_echo "$as_me:$LINENO: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 { (ac_try="$ac_compiler --version >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compiler --version >&5") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } { (ac_try="$ac_compiler -v >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compiler -v >&5") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } { (ac_try="$ac_compiler -V >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compiler -V >&5") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { ; return 0; } _ACEOF ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. { $as_echo "$as_me:$LINENO: checking for C compiler default output file name" >&5 $as_echo_n "checking for C compiler default output file name... " >&6; } ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` # The possible output files: ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ac_rmfiles= for ac_file in $ac_files do case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; * ) ac_rmfiles="$ac_rmfiles $ac_file";; esac done rm -f $ac_rmfiles if { (ac_try="$ac_link_default" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_link_default") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); }; then # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' # in a Makefile. We should not override ac_cv_exeext if it was cached, # so that the user can short-circuit this test for compilers unknown to # Autoconf. for ac_file in $ac_files '' do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; [ab].out ) # We found the default executable, but exeext='' is most # certainly right. break;; *.* ) if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; then :; else ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` fi # We set ac_cv_exeext here because the later test for it is not # safe: cross compilers may not add the suffix if given an `-o' # argument, so we may need to know it at that point already. # Even if this section looks crufty: it has the advantage of # actually working. break;; * ) break;; esac done test "$ac_cv_exeext" = no && ac_cv_exeext= else ac_file='' fi { $as_echo "$as_me:$LINENO: result: $ac_file" >&5 $as_echo "$ac_file" >&6; } if test -z "$ac_file"; then $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { { $as_echo "$as_me:$LINENO: error: C compiler cannot create executables See \`config.log' for more details." >&5 $as_echo "$as_me: error: C compiler cannot create executables See \`config.log' for more details." >&2;} { (exit 77); exit 77; }; }; } fi ac_exeext=$ac_cv_exeext # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { $as_echo "$as_me:$LINENO: checking whether the C compiler works" >&5 $as_echo_n "checking whether the C compiler works... " >&6; } # FIXME: These cross compiler hacks should be removed for Autoconf 3.0 # If not cross compiling, check that we can run a simple program. if test "$cross_compiling" != yes; then if { ac_try='./$ac_file' { (case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); }; }; then cross_compiling=no else if test "$cross_compiling" = maybe; then cross_compiling=yes else { { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { { $as_echo "$as_me:$LINENO: error: cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details." >&5 $as_echo "$as_me: error: cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; }; } fi fi fi { $as_echo "$as_me:$LINENO: result: yes" >&5 $as_echo "yes" >&6; } rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { $as_echo "$as_me:$LINENO: checking whether we are cross compiling" >&5 $as_echo_n "checking whether we are cross compiling... " >&6; } { $as_echo "$as_me:$LINENO: result: $cross_compiling" >&5 $as_echo "$cross_compiling" >&6; } { $as_echo "$as_me:$LINENO: checking for suffix of executables" >&5 $as_echo_n "checking for suffix of executables... " >&6; } if { (ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); }; then # If both `conftest.exe' and `conftest' are `present' (well, observable) # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. for ac_file in conftest.exe conftest conftest.*; do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` break;; * ) break;; esac done else { { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { { $as_echo "$as_me:$LINENO: error: cannot compute suffix of executables: cannot compile and link See \`config.log' for more details." >&5 $as_echo "$as_me: error: cannot compute suffix of executables: cannot compile and link See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; }; } fi rm -f conftest$ac_cv_exeext { $as_echo "$as_me:$LINENO: result: $ac_cv_exeext" >&5 $as_echo "$ac_cv_exeext" >&6; } rm -f conftest.$ac_ext EXEEXT=$ac_cv_exeext ac_exeext=$EXEEXT { $as_echo "$as_me:$LINENO: checking for suffix of object files" >&5 $as_echo_n "checking for suffix of object files... " >&6; } if test "${ac_cv_objext+set}" = set; then $as_echo_n "(cached) " >&6 else cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.o conftest.obj if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>&5 ac_status=$? $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); }; then for ac_file in conftest.o conftest.obj conftest.*; do test -f "$ac_file" || continue; case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:$LINENO: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { { $as_echo "$as_me:$LINENO: error: cannot compute suffix of object files: cannot compile See \`config.log' for more details." >&5 $as_echo "$as_me: error: cannot compute suffix of object files: cannot compile See \`config.log' for more details." >&2;} { (exit 1); exit 1; }; }; } fi rm -f conftest.$ac_cv_objext conftest.$ac_ext fi { $as_echo "$as_me:$LINENO: result: $ac_cv_objext" >&5 $as_echo "$ac_cv_objext" >&6; } OBJEXT=$ac_cv_objext ac_objext=$OBJEXT { $as_echo "$as_me:$LINENO: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if test "${ac_cv_c_compiler_gnu+set}" = set; then $as_echo_n "(cached) " >&6 else cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then ac_compiler_gnu=yes else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:$LINENO: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:$LINENO: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if test "${ac_cv_prog_cc_g+set}" = set; then $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then ac_cv_prog_cc_g=yes else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 CFLAGS="" cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then : else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then ac_cv_prog_cc_g=yes else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:$LINENO: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:$LINENO: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if test "${ac_cv_prog_cc_c89+set}" = set; then $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ #include #include #include #include /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then ac_cv_prog_cc_c89=$ac_arg else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:$LINENO: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:$LINENO: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:$LINENO: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:$LINENO: checking for inline" >&5 $as_echo_n "checking for inline... " >&6; } if test "${ac_cv_c_inline+set}" = set; then $as_echo_n "(cached) " >&6 else ac_cv_c_inline=no for ac_kw in inline __inline__ __inline; do cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ #ifndef __cplusplus typedef int foo_t; static $ac_kw foo_t static_foo () {return 0; } $ac_kw foo_t foo () {return 0; } #endif _ACEOF rm -f conftest.$ac_objext if { (ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_compile") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then ac_cv_c_inline=$ac_kw else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_inline" != no && break done fi { $as_echo "$as_me:$LINENO: result: $ac_cv_c_inline" >&5 $as_echo "$ac_cv_c_inline" >&6; } case $ac_cv_c_inline in inline | yes) ;; *) case $ac_cv_c_inline in no) ac_val=;; *) ac_val=$ac_cv_c_inline;; esac cat >>confdefs.h <<_ACEOF #ifndef __cplusplus #define inline $ac_val #endif _ACEOF ;; esac case $ac_cv_c_inline in inline | yes | no) ;; *) INLINE=$ac_cv_c_inline ;; esac #AC_PROG_INSTALL # needs install-sh or install.sh in sources if test -n "$ac_tool_prefix"; then for ac_prog in gar ar do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_AR+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$AR"; then ac_cv_prog_AR="$AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_AR="$ac_tool_prefix$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AR=$ac_cv_prog_AR if test -n "$AR"; then { $as_echo "$as_me:$LINENO: result: $AR" >&5 $as_echo "$AR" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AR" && break done fi if test -z "$AR"; then ac_ct_AR=$AR for ac_prog in gar ar do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_ac_ct_AR+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_AR"; then ac_cv_prog_ac_ct_AR="$ac_ct_AR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_AR="$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_AR=$ac_cv_prog_ac_ct_AR if test -n "$ac_ct_AR"; then { $as_echo "$as_me:$LINENO: result: $ac_ct_AR" >&5 $as_echo "$ac_ct_AR" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_AR" && break done if test "x$ac_ct_AR" = x; then AR=":" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:$LINENO: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac AR=$ac_ct_AR fi fi for ac_prog in gtar tar do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_TAR+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$TAR"; then ac_cv_prog_TAR="$TAR" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_TAR="$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi TAR=$ac_cv_prog_TAR if test -n "$TAR"; then { $as_echo "$as_me:$LINENO: result: $TAR" >&5 $as_echo "$TAR" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$TAR" && break done for ac_prog in asciidoc do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:$LINENO: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if test "${ac_cv_prog_ASCIIDOC+set}" = set; then $as_echo_n "(cached) " >&6 else if test -n "$ASCIIDOC"; then ac_cv_prog_ASCIIDOC="$ASCIIDOC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ASCIIDOC="$ac_prog" $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ASCIIDOC=$ac_cv_prog_ASCIIDOC if test -n "$ASCIIDOC"; then { $as_echo "$as_me:$LINENO: result: $ASCIIDOC" >&5 $as_echo "$ASCIIDOC" >&6; } else { $as_echo "$as_me:$LINENO: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ASCIIDOC" && break done if test -n "$ASCIIDOC"; then { $as_echo "$as_me:$LINENO: checking for asciidoc version" >&5 $as_echo_n "checking for asciidoc version... " >&6; } asciidoc_version=`$ASCIIDOC --version 2>/dev/null` case "${asciidoc_version}" in asciidoc' '7*) ASCIIDOC7=YesPlease { $as_echo "$as_me:$LINENO: result: ${asciidoc_version} > 7" >&5 $as_echo "${asciidoc_version} > 7" >&6; } ;; asciidoc' '8*) ASCIIDOC7= { $as_echo "$as_me:$LINENO: result: ${asciidoc_version}" >&5 $as_echo "${asciidoc_version}" >&6; } ;; *) ASCIIDOC7= { $as_echo "$as_me:$LINENO: result: ${asciidoc_version} (unknown)" >&5 $as_echo "${asciidoc_version} (unknown)" >&6; } ;; esac fi ## Checks for libraries. { $as_echo "$as_me:$LINENO: CHECKS for libraries" >&5 $as_echo "$as_me: CHECKS for libraries" >&6;} if test -z "$NO_NCURSES"; then if test -n "$NCURSESSDIR"; then old_CPPFLAGS="$CPPFLAGS" old_LDFLAGS="$LDFLAGS" CPPFLAGS="-I$NCURSESSDIR/include $CPPFLAGS" LDFLAGS="-L$NCURSESSDIR/$lib $LDFLAGS" fi { $as_echo "$as_me:$LINENO: checking for initscr in -lncurses" >&5 $as_echo_n "checking for initscr in -lncurses... " >&6; } if test "${ac_cv_lib_ncurses_initscr+set}" = set; then $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lncurses $LIBS" cat >conftest.$ac_ext <<_ACEOF /* confdefs.h. */ _ACEOF cat confdefs.h >>conftest.$ac_ext cat >>conftest.$ac_ext <<_ACEOF /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char initscr (); int main () { return initscr (); ; return 0; } _ACEOF rm -f conftest.$ac_objext conftest$ac_exeext if { (ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\"" $as_echo "$ac_try_echo") >&5 (eval "$ac_link") 2>conftest.er1 ac_status=$? grep -v '^ *+' conftest.er1 >conftest.err rm -f conftest.er1 cat conftest.err >&5 $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5 (exit $ac_status); } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || $as_test_x conftest$ac_exeext }; then ac_cv_lib_ncurses_initscr=yes else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_cv_lib_ncurses_initscr=no fi rm -rf conftest.dSYM rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:$LINENO: result: $ac_cv_lib_ncurses_initscr" >&5 $as_echo "$ac_cv_lib_ncurses_initscr" >&6; } if test "x$ac_cv_lib_ncurses_initscr" = x""yes; then NO_NCURSES= else NO_NCURSES=YesPlease fi if test -n "$NCURSESDIR"; then CPPFLAGS="$old_CPPFLAGS" LDFLAGS="$old_LDFLAGS" fi fi CFLAGS="$CFLAGS -W -Wall -std=gnu99 -pedantic" ## Output files ac_config_files="$ac_config_files "${config_file}":"${config_in}":"${config_append}"" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:$LINENO: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) $as_unset $ac_var ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes (double-quote # substitution turns \\\\ into \\, and sed turns \\ into \). sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then test "x$cache_file" != "x/dev/null" && { $as_echo "$as_me:$LINENO: updating cache $cache_file" >&5 $as_echo "$as_me: updating cache $cache_file" >&6;} cat confcache >$cache_file else { $as_echo "$as_me:$LINENO: not updating unwritable cache $cache_file" >&5 $as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' # Transform confdefs.h into DEFS. # Protect against shell expansion while executing Makefile rules. # Protect against Makefile macro expansion. # # If the first sed substitution is executed (which looks for macros that # take arguments), then branch to the quote section. Otherwise, # look for a macro that doesn't take arguments. ac_script=' :mline /\\$/{ N s,\\\n,, b mline } t clear :clear s/^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\)/-D\1=\2/g t quote s/^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\)/-D\1=\2/g t quote b any :quote s/[ `~#$^&*(){}\\|;'\''"<>?]/\\&/g s/\[/\\&/g s/\]/\\&/g s/\$/$$/g H :any ${ g s/^\n// s/\n/ /g p } ' DEFS=`sed -n "$ac_script" confdefs.h` ac_libobjs= ac_ltlibobjs= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`$as_echo "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. ac_libobjs="$ac_libobjs \${LIBOBJDIR}$ac_i\$U.$ac_objext" ac_ltlibobjs="$ac_ltlibobjs \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs : ${CONFIG_STATUS=./config.status} ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { $as_echo "$as_me:$LINENO: creating $CONFIG_STATUS" >&5 $as_echo "$as_me: creating $CONFIG_STATUS" >&6;} cat >$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ## --------------------- ## ## M4sh Initialization. ## ## --------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in *posix*) set -o posix ;; esac fi # PATH needs CR # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo if (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # Support unset when possible. if ( (MAIL=60; unset MAIL) || exit) >/dev/null 2>&1; then as_unset=unset else as_unset=false fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. case $0 in *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 { (exit 1); exit 1; } fi # Work around bugs in pre-3.0 UWIN ksh. for as_var in ENV MAIL MAILPATH do ($as_unset $as_var) >/dev/null 2>&1 && $as_unset $as_var done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # Required to use basename. if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi # Name of the executable. as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # CDPATH. $as_unset CDPATH as_lineno_1=$LINENO as_lineno_2=$LINENO test "x$as_lineno_1" != "x$as_lineno_2" && test "x`expr $as_lineno_1 + 1`" = "x$as_lineno_2" || { # Create $as_me.lineno as a copy of $as_myself, but with $LINENO # uniformly replaced by the line number. The first 'sed' inserts a # line-number line after each line using $LINENO; the second 'sed' # does the real work. The second script uses 'N' to pair each # line-number line with the line containing $LINENO, and appends # trailing '-' during substitution so that $LINENO is not a special # case at line end. # (Raja R Harinath suggested sed '=', and Paul Eggert wrote the # scripts with optimization help from Paolo Bonzini. Blame Lee # E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2 { (exit 1); exit 1; }; } # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in -n*) case `echo 'x\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. *) ECHO_C='\c';; esac;; *) ECHO_N='-n';; esac if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -p'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -p' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -p' fi else as_ln_s='cp -p' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p=: else test -d ./-p && rmdir ./-p as_mkdir_p=false fi if test -x / >/dev/null 2>&1; then as_test_x='test -x' else if ls -dL / >/dev/null 2>&1; then as_ls_L_option=L else as_ls_L_option= fi as_test_x=' eval sh -c '\'' if test -d "$1"; then test -d "$1/."; else case $1 in -*)set "./$1";; esac; case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in ???[sx]*):;;*)false;;esac;fi '\'' sh ' fi as_executable_p=$as_test_x # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 # Save the log message, to keep $[0] and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by iptraf-ng $as_me 1.1.3.1.94.g421e, which was generated by GNU Autoconf 2.63. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files from templates according to the current configuration. Usage: $0 [OPTION]... [FILE]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE Configuration files: $config_files Report bugs to ." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_version="\\ iptraf-ng config.status 1.1.3.1.94.g421e configured by $0, generated by GNU Autoconf 2.63, with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\" Copyright (C) 2008 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) $as_echo "$ac_cs_version"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; esac CONFIG_FILES="$CONFIG_FILES '$ac_optarg'" ac_need_defaults=false;; --he | --h | --help | --hel | -h ) $as_echo "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) { $as_echo "$as_me: error: unrecognized option: $1 Try \`$0 --help' for more information." >&2 { (exit 1); exit 1; }; } ;; *) ac_config_targets="$ac_config_targets $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X '$SHELL' '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX $as_echo "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in ""${config_file}"") CONFIG_FILES="$CONFIG_FILES "${config_file}":"${config_in}":"${config_append}"" ;; *) { { $as_echo "$as_me:$LINENO: error: invalid argument: $ac_config_target" >&5 $as_echo "$as_me: error: invalid argument: $ac_config_target" >&2;} { (exit 1); exit 1; }; };; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= trap 'exit_status=$? { test -z "$tmp" || test ! -d "$tmp" || rm -fr "$tmp"; } && exit $exit_status ' 0 trap '{ (exit 1); exit 1; }' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || { $as_echo "$as_me: cannot create a temporary directory in ." >&2 { (exit 1); exit 1; } } # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=' ' ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || { { $as_echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 $as_echo "$as_me: error: could not make $CONFIG_STATUS" >&2;} { (exit 1); exit 1; }; } ac_delim_num=`echo "$ac_subst_vars" | grep -c '$'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || { { $as_echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 $as_echo "$as_me: error: could not make $CONFIG_STATUS" >&2;} { (exit 1); exit 1; }; } ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then { { $as_echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 $as_echo "$as_me: error: could not make $CONFIG_STATUS" >&2;} { (exit 1); exit 1; }; } else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\).*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\).*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$tmp/subs1.awk" > "$tmp/subs.awk" \ || { { $as_echo "$as_me:$LINENO: error: could not setup config files machinery" >&5 $as_echo "$as_me: error: could not setup config files machinery" >&2;} { (exit 1); exit 1; }; } _ACEOF # VPATH may cause trouble with some makes, so we remove $(srcdir), # ${srcdir} and @srcdir@ from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=/{ s/:*\$(srcdir):*/:/ s/:*\${srcdir}:*/:/ s/:*@srcdir@:*/:/ s/^\([^=]*=[ ]*\):*/\1/ s/:*$// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" eval set X " :F $CONFIG_FILES " shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) { { $as_echo "$as_me:$LINENO: error: invalid tag $ac_tag" >&5 $as_echo "$as_me: error: invalid tag $ac_tag" >&2;} { (exit 1); exit 1; }; };; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || { { $as_echo "$as_me:$LINENO: error: cannot find input file: $ac_f" >&5 $as_echo "$as_me: error: cannot find input file: $ac_f" >&2;} { (exit 1); exit 1; }; };; esac case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac ac_file_inputs="$ac_file_inputs '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { $as_echo "$as_me:$LINENO: creating $ac_file" >&5 $as_echo "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`$as_echo "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$tmp/stdin" \ || { { $as_echo "$as_me:$LINENO: error: could not create $ac_file" >&5 $as_echo "$as_me: error: could not create $ac_file" >&2;} { (exit 1); exit 1; }; } ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` { as_dir="$ac_dir" case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || { $as_mkdir_p && mkdir -p "$as_dir"; } || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || { { $as_echo "$as_me:$LINENO: error: cannot create directory $as_dir" >&5 $as_echo "$as_me: error: cannot create directory $as_dir" >&2;} { (exit 1); exit 1; }; }; } ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p ' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { $as_echo "$as_me:$LINENO: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 $as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$tmp/subs.awk" >$tmp/out \ || { { $as_echo "$as_me:$LINENO: error: could not create $ac_file" >&5 $as_echo "$as_me: error: could not create $ac_file" >&2;} { (exit 1); exit 1; }; } test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' "$tmp/out"`; test -z "$ac_out"; } && { $as_echo "$as_me:$LINENO: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined." >&5 $as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined." >&2;} rm -f "$tmp/stdin" case $ac_file in -) cat "$tmp/out" && rm -f "$tmp/out";; *) rm -f "$ac_file" && mv "$tmp/out" "$ac_file";; esac \ || { { $as_echo "$as_me:$LINENO: error: could not create $ac_file" >&5 $as_echo "$as_me: error: could not create $ac_file" >&2;} { (exit 1); exit 1; }; } ;; esac done # for ac_tag { (exit 0); exit 0; } _ACEOF chmod +x $CONFIG_STATUS ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || { { $as_echo "$as_me:$LINENO: error: write failure creating $CONFIG_STATUS" >&5 $as_echo "$as_me: error: write failure creating $CONFIG_STATUS" >&2;} { (exit 1); exit 1; }; } # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || { (exit 1); exit 1; } fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { $as_echo "$as_me:$LINENO: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi iptraf-ng-1.1.4/.gitignore0000664000076400007640000000100112173477702015660 0ustar npajkovsnpajkovs# NOTE! Please use 'git ls-files -i --exclude-standard' # command after changing this file, to see if there are # any tracked files which get ignored after the change. # normal rules .* *.o *.lo *.la # ignore binaries /iptraf-ng /rvnamed-ng # don't ignore git files !.gitignore # gnu global files GPATH GRTAGS GSYMS GTAGS # cscope files cscope.* ncscope.* # autotools /configure /autom4te.cache/ /config.log /config.mak.append /config.mak.autogen /config.status # misc *~ \#*# /iptraf-ng.spec VERSION-FILE iptraf-ng-1.1.4/AUTHORS0000664000076400007640000000121212173477702014744 0ustar npajkovsnpajkovsOriginal author of iptraf: -------------------------- 1997 - 2004 Gerard Paul Java Since no progress was made since 2004 and the author didn't answer any question if he will be working on iptraf anytime soon again, Nikola Pajkovsky from RedHat took over the project in 2010 and made a fork named iptraf-ng. iptraf-ng maintainer: --------------------- 2010 - Nikola Pajkovsky Contributors: ------------- 2010 - now Nikola Pajkovsky 2010 Jan Rafaj 2010 Petr Uzel 2011 Jan Engelhardt 2012 Vitezslav Samel iptraf-ng-1.1.4/CHANGES0000664000076400007640000000703112173477702014674 0ustar npajkovsnpajkovsCHANGES file for iptraf-ng * Tue Jul 23 2013 Nikola Pajkovsky - 1.1.4 - locking code rewrite: only one instance is allowed now - promiscuous mode rewrite - build system: install iptraf-ng to sbin - remove token-ring support - remove ISDN interfaces support - preparation for packet capturing into the file - source code cleanups - bugfix: don't segfault when there are no ports to remove - rvnamed: fix the IPv6 resolving - add 802.1ad and QinQ VLAN handling - optimize code (to not use that much CPU) * Wed May 23 2012 Nikola Pajkovsky - 1.1.3 - new building system (based only on make, no automake/autoconf) - code cleanups - SIT tunnels support - space for HW addresses fix - sort interfaces by ifindex - print rates every second using moving average (over last 5 seconds) - packet_get() bugfix (don't count packets when there's no packet ready) - fix segfault in the tui/* code - fix checksumming for odd-sized IPv4 header * Fri May 04 2012 Nikola Pajkovsky - 1.1.2 - massive code cleanup - fix PPP handling - move the splash screen to the main menu - fix capturing on tun-like interfaces - support GRE-over-IP tunnels - fix ethernet descriptions - change units: bits/sec (bytes/sec) to kbps (kBps) - use bind() to lock the socket on interface (should decrease CPU utilization on systems with very busy interfaces) - warnings cleanup - fix packet length counting for large packets - hostmon(): count IPv6 as IP protocol too * Thu Feb 02 2012 Nikola Pajkovsky - 1.1.1 - fix frames in UTF-8 locales - fix IPv6 port stats - fix IPv6 byte counting - fix port data rate - fix for interfaces with long name * Wed Jan 11 2012 Nikola Pajkovsky - 1.1.0 - build system fixes - brand new command line options parser - rename iptraf to iptraf-ng (binaries, mans) - code cleanup (useless code removal, warnings erradication, ...) - new ip checksum based on rfc1071 implementation - landesc.[c,h]: full rewrite * Sun Apr 11 2010 Nikola Pajkovsky - 1.0.3 - documentation cleanup * Wed Mar 24 2010 Nikola Pajkovsky - 1.0.2 - remove warnings - rif of PKG_CHECK_MODULES - tx_operate_listbox(): use proper format string for size_t in snprintf - ltrim(): simplify function and fix situation when strings overlap in strcpy - build: pass libpanel_CFLAGS and ncurses_CFLAGS to compiler - selectiface(): use strncpy to prevent buffer overflow and thus avoid gcc warning - init_promisc_list(): use IF_NAMESIZE as size of buffer for interface name - main(): allow regular users to run iptraf if the sticky-bit is set - fix strcpy overlap memory - remove -Werror option * Thu Mar 04 2010 Nikola Pajkovsky - 1.0.1 - remove dereferencing type-punned pointer will break strict-aliasing rules - convmacaddr(): fix assignment casting. One more warning gone. - ipmon(), servmon(): unnecessary casting is gone. Fixes strict-aliasing. - Fix compilation issues and crash within LAN station monitor * Mon Mar 01 2010 Nikola Pajkovsky - 1.0.0 - compile with -std=gnu99 -pedantic -Wall -Werror - add support for devices(used patches from gentoo, debian and fedora): vlan, hsi, ctc, ath, bond, ra, bnep, dsl, modem, ni, br, tap, dummy, vmnet - add longer intefaces names(18 chars) - add iptraf -u - show unsupported interfaces(fpeters@debian.org) - check if macro is defined ICMP6_DST_UNREACH_NOTNEIGHBOR(jer@gentoo.org) - add ipv6 support - remove wierd Setup compilation and replaced it by autotools - import original iptraf-3.0.0 iptraf-ng-1.1.4/CHANGES.old0000664000076400007640000011107412173477702015454 0ustar npajkovsnpajkovsCHANGES File for IPTraf 3.0.0 Changes to IPTraf 2.7.0 and new features in IPTraf 3.0.0 New filter behavior. Except for TCP traffic in the IP traffic monitor, filters now do not automatically match reverse packets for TCP and UDP IPTraf-wide. Rather, each filter entry has a field which tells IPTraf whether to match packets flowing in the direction opposite that specified. The filters for non-TCP, non-UDP IP traffic (ICMP, IGRP, OSPF, etc.) which never automatically matched packets flowing in the opposite direction, now have that same option field. This way related packets (like ICMP echo request/echo reply) can be matched with a single entry. Because reverse-matching is no longer the default IPTraf-wide, the labels are now changed to read Source and Destination. Default value for blank address filter fields is now 0.0.0.0, rather than 255.255.255.255. Fields are therefore no longer pre-filled with 0.0.0.0. Miscellaneous IP filter entries feature a field for other IP protocols not specifically indicated in the dialog. The user must enter a comma-separated list of individual protocols or a range. IP protocols are defined in the /etc/protocols file. The IP traffic monitor consults the /etc/protocols file for miscellaneous IP packets for the protocol names. Previously recognized protocols (ICMP, UDP, OSPF, etc) are still looked up internally for performance reasons. The filter rule selection now indicates the mask in CIDR format (e.g. 10.1.0.0/16) for clarity and to save screen space. Filter selection list box is now alphabetically sorted. Likewise, the CIDR notation can be used when entering IP address data. However the CIDR notation is translated into a mask and discarded. Subsequent editing of the filter will show the corresponding mask. Changed color coding for unknown IP packets (those looked up from /etc/services to bright white on blue (instead of yellow on red, which looked like "errors"). Added internal recognition for L2TP, IPSec AH, and IPSec ESP packets. Changed size of the IP traffic monitor's TCP hash table to 1033 buckets. Prime number used to improve hash efficiency. A new function tx_box() has been added to the screen support library as a solution to the ncurses box() function not accepting the color set by wattrset(), at least on Red Hat 7.3. All calls to box() have been replaced with this tx_box() instead. It takes exactly the same parameters. Added support for tun and brg (tunneling and bridging) interfaces. Thanks to Marcio Gomes . Modified logging options. The -L parameter now works with any command-line invocation of a facility, even in foreground mode. Added -I command-line parameter to override logging interval configuration option. (Thanks to the contributors of the -I and -L patches. I lost your emails when SEUL reinstalled. Please acknowledge. Thanks. Corrected promiscuous mode control code. It ignored Token Ring interfaces. Changes to IPTraf 2.6.1 and new features in IPTraf 2.7.0 Corrected bug wherein the detailed interface statistics did not filter out the packets based on the selected interface. Thanks to the members of the mailing list for this. Corrected minor interface name comparison bugs in the general interface statistics and TCP/UDP service statistics. Corrected stale locks when IPTraf did not start due to an improper terminal size. Added support for additional DVB interfaces sm2*, sm3*, penta*. Added support for wireless LAN interfaces (wlan*, wvlan*). Fixed segfault that occurs when /proc/net/dev is empty or contains no active interfaces. Thanks to Chris Armstrong for actually trying it out. Added error box to handle the /proc/net/dev error condition mentioned above. Added error box when tx_operate_listbox is invoked on an empty list. Changes to IPTraf 2.6.0 Corrected a segfault in the IP traffic monitor and TCP/UDP service breakdown when a sort is attempted on an empty screen. Thanks to for the report. Corrected segfaults in the TCP/UDP service monitor when scrolling using PgUp and PgDn (or space and '-'). Thanks to Ross Gibson . Corrected post-sorting PgUp problem in TCP/UDP monitor. Corrected inaccuracies in the IP traffic monitor's TCP byte counts and flow rates. *** THE BUG ADDRESSED BY THIS CORRECTION DEFERS IPTRAF 2.6.0. *** Adjusted black-and-white color scheme. Minor adjustments to the printlargenumber() function. Minor cosmetic adjustments. New features in IPTraf 2.6.0 and changes to IPTraf 2.5.0 Added support for Token Ring interfaces. Thanks to many people for help with patches and testing, including J. Kahn Koontz , Dan Seto , and Tomas Dvorak . Added support for sbni long-range modem interfaces (Dmitry Sergienko ). Added support for Free s/WAN IPSec logical interfaces (Doug Nazar ). Code cleanup. Got rid of an ugly goto in itrafmon.c. I hate goto no matter what. Moved write_timeout_log.c to tcptable.c. Recoded the PgUp/PgDn routines in the IP traffic monitor, TCP/UDP service monitor, and LAN station monitor. These routines now directly manipulate the table pointers instead of merely calling the single-line scrolling routines repeatedly. Faster. More efficient. Added a highlight bar to the IP traffic monitor, allowing better readability, especially on long-line screens (> 80 characters), and individual flow rate computation. Added flow rates for the highlighted TCP flows (IP traffic monitor) and TCP/UDP ports (TCP/UDP statistical breakdown) I believe this is the best way to allow viewing of data rates without excessively sacrificing CPU time for packet capture. Filters now apply to all facilities except the packet size breakdown and LAN station monitor. You can now view the loads and protocol breakdowns on selected packets only using the filters. No more byte counters in the IP traffic monitor. This line now just contains a simple packet counter at one end, and the TCP flow rate information at the other. Moved menu, selection listbox, and dialog box functions to a separate support/ directory. These routines are first compiled into a library and later on linked into iptraf. Added a confirmation box to the main menu's Exit command. This is as much for me as it is for a lot of people. I accidentaly exit too. Added broadcast packet and byte counts to the detailed interface statistics log. Some cosmetic adjustment. Added 5-minute timeout for rvnamed child processes. New features in IPTraf 2.5.0 and changes to IPTraf 2.4.0 Now includes a more specific dialog for non-TCP and non-UDP filters. Allows specification of packets by source and destination IP addresses. Better organized the filter management and manipulation functions in fltedit.c, fltselect.c, othipflt.c, and utfilter.c. othfilter.c renamed to fltselect.c, same thing with the .h. All filters are now unified in a single data structure allowing handling of TCP, UDP, misc IP, and non-IP toggles with one set of functions. Separate TCP and non-TCP filter menus abolished, everything is now grouped under a Filters... submenu under the main menu. Corrected wrong placement of timer in the packet size breakdown. Corrected scanning code for timed out entries in the IP traffic monitor sort function. Wrong computation for elapsed time resulted in active connections being placed in the list of closed entries. Thanks to Gal Laszlo for pointing out the symptom. Added support for Frame Relay FRAD/DLCI interfaces. Thanks to Raffaele Gariboldi for the information and testing. Sorting is now done with the Quicksort algorithm. IP Traffic Monitor now adds connection entries to the TCP window upon the receipt of header-only packets. There are cases in which we have to check for possible TCP scans which are implemented with non-SYN packets. The reverse DNS lookup function revname() now times out after five seconds, and stops reverse lookups for that session in case rvnamed dies. Added some notes to the packet size breakdown window. Moved rvnamed cache index update code such that updating of the cache indexes will only be performed once fork() succeeds, otherwise, the allocated slot will just be reallocated for the next queries. This is so that should the fork() fail, future invocations for that IP address won't have the rvnamed parent thinking its resolving when there actually wasn't a child performing the resolution. If the fork() problem condition was temporary, the next invocation can still have rvnamed fork() off to resolve the address. This of course assumes the IP address hasn't expired from the cache. Some cosmetic updates (as always). The manual features a new format for the sidebars. Corrected typos and spelling errors. iptraf-x.y.z.tar.gz no longer comes with precompiled binaries. However a separate iptraf-x.y.z.i386.bin.tar.gz will come only with the precompiled x86 executable programs (i386/glibc-2.1/ncurses-5.0). New features in IPTraf 2.4.0 and changes to IPTraf 2.3.1 This version now allows multiple instances of the same facility in different processes, but only one instance can monitor an interface. Please see the RELEASE-NOTES file. As a consequence of the above changes, the default names of the logfiles then reflect the instance or interface being monitored. See the RELEASE-NOTES file. Implemented a dialog box allowing the user to log to a custom log file. Implemented -L command-line parameter to allow specification of the log file name when IPTraf is started with the -B parameter. Removed hardcoded UNIX-domain socket name bound by IPTraf, instead a socket name is generated from the current time and pid. Also removed hardcoded socket name in rvnamed, to which it directs replies to IPTraf. rvnamed still binds to hardcoded socket names though. IP Traffic Monitor can optionally display the source MAC addresses for LAN-based packets. Added appropriate configuration item. IPTraf now reads /etc/ethers in addition to its own database of MAC addresses. Thanks to Frederic Peters for the patch. Moved time-related configuration items to a Timers... submenu to save on screen space. The version.h file no longer exists, rather, a plain version file is in place containing merely the version number. The Makefile reads this file, determines the target machine information and passes this data to the compiler with -D parameters. Imposed an upper limit of 200 on rvnamed child processes. rvnamed should really not go runaway with a normally-functioning DNS server, but I had the good fortune of experiencing a dead DNS server while monitoring. Took my machine down real fast. Precompiled executables now require glibc-2.1 dynamic libaries. Included a Setup installation script to ease somewhat the installation process (installation can still be done the old way though). Cosmetic/color changes. Reflected changes to manual. Changes to IPTraf 2.3.0 Fixed segfault bug when sorting is attempted on an empty TCP window. Thanks to Ramon van Elten for the report and for the assistance in diagnosis. Fixed cosmetic error (sort progress window doesn't disappear) when attempt is made to sort a TCP window with only 1 entry. Thanks again to Ramon for the report. Updated some comments. New features in IPTraf 2.3.0 and changes to IPTraf 2.2.2 Implemented sorting in the IP traffic monitor, TCP/UDP statistical breakdown, and LAN station monitor. Great thanks go to Gal Laszlo for the patch. (Note to Gal: I had to do a heck of a lot of overhaul, and had to implement a clearer screen design, but your patch provided the basis :) Thanks a lot.) Implemented better bounds checking in the text input routine. Added information boxes to TCP/UDP delete and detach filter functions. Added recognition of GRE packets. Modified non-TCP display filters accordingly. Fixed bug in unrecognized IP display and filter code. Added filter item for unrecognized IP packets. Removed leftover code from the old warning on IP masquerading. Reflected changes and corrected typos in manual. Changes to IPTraf 2.2.1 Fixed recognition problem with DVB interfaces. Fixed small buffer overrun in TCP timeout log routine, which can cause a segmentation fault under certain conditions. Minor cosmetic adjustment in TCP connection window. Changes to IPTraf 2.2.0 Fixed segfault in IP Traffic Monitor due to packets from an unsupported link type. Fixed segfault in promiscuous mode management module in the (rare) case of a failure to save or load the interface flags from the temporary storage files. Normally due to a bad installation. Thanks to Udo A. Steinberg for the report. Added support for Ethernet-emulated FDDI interfaces. Thanks to Udo A. Steinberg for the report and help with the testing. Added support for DVB interfaces, thanks to Alex for the notification and the help. Replaced inet_addr() references on filter address entries with inet_aton(). This fixes failure of filters on packets with 255.255.255.255 in their source or destination address fields. Thanks for Peter Magnusson for the report and the test environment. Overhauled TCP/UDP editing facility. Fixed bug wherein garbage entries remain in the filter's parameter list even if an insert/ add dialog is aborted. Fixed detailed interface statistics logging bug (activity and packets-per-second figures were the same). Apologies to Dustin Trammell for my failure to credit him for his report on the behavior of IPTraf on bridges. Changes to IPTraf 2.1.1 and new features in IPTraf 2.2.0 Immediate flushing of disk buffers after a log file write to better accomodate separate logfile parsing scripts. Addition of a manual and automatic clearing of closed and idle TCP entries in the IP Traffic Monitor Added a TCP closed/idle persistence configuration option to control the TCP closed/idle clearing interval. Clarified TCP timeout logfile entries. Saves the state of the interface flags at startup of a facility, and restores them on exit, allowing interfaces previously set to promiscuous mode to retain that state. Important on bridges. Thanks to Dustin D. Trammell and Holger Friese for the patch. However, I had to modify it a little more than a bit and had to overhaul quite a good deal of the rest of the software to better accomodate multiple instances. Promiscuous mode is set only when a facility is started, and restored when it exits. Promiscuous mode is no longer forced at menus. Restoration is not performed though if there is still another facility running, but the interface state remains saved. Fixed a minor bug in the LAN station monitor. The raw socket is now closed when the facility exits. duh. Fixed rare bug in the packet size distribution. The lock file didn't get deleted if the raw socket open failed. Changed the promiscuous mode option to "Force promiscuous". Cosmetic. Added PID's (a la syslog) to daemon log entries. Minor cosmetic adjustments. Changes to IPTraf 2.1.0 Fixed bug in the packet size statistical breakdown. The facility didn't filter packets based on interface name, thus causing inaccurate counts on systems with multiple network interfaces. Fixed a few minor cosmetic errors. Corrected some typographical errors in the manual. Added a FAQ (or the beginnings thereof). Added a spec file for RPM generation. Thanks to Dag Wieers . I'm not a really good RPM'er beyond RPM installation and removal. :) Changes to IPTraf 2.0.2 and new features in IPTraf 2.1.0 Added non-IP to the display/logging filter selections Added interface selection to the IP Traffic Monitor and LAN Station Monitor (with an "All Interfaces" option). Related to the above: now requires an interface name as an argument to the -i and -l command-line parameters. 'all' may be specified for monitoring all interfaces. Added -B command-line parameter to fork program into the background solely for logging purposes. Several people had requested this. Corrected TCP/UDP filter file placement error. Included cfconv program to move files to the proper place. Added program-wide Ctrl+L sequence to redraw the screen if corrupted by outside factors (write, talk, syslog). Added TCP/UDP filter editing facility. Corrected several possible buffer overruns in TCP/UDP filter module. Corrected errors and reflected changes to manual and man pages. Changes to IPTraf 2.0.1 Fixed a rarely-occuring but nevertheless severe segmentation fault bug when long hostnames are coupled with long service names. Great thanks go to Ronald Wahl for the advice and the help. Ron, I'm really gonna find the time to do the code the Right Way :) Changes to IPTraf 2.0.0 Fixed minor non-IP byte count bug in detailed interface statistics. Fixed minor cosmetic bug causing elapsed time indicator to appear in the wrong line on screens not containing 25 lines. Thanks to Uwe Storbeck for the patch. New features/changes in IPTraf 2.0 from 1.4.2 Now uses the new PF_PACKET socket family as its packet capture mechanism. Requires Linux 2.2. Added target/source IP addresses in ARP packet request/reply packet entries in the IP traffic monitor. Also added target/source MAC addresses to RARP request/reply entries. Reorganized menu structure, see the README file for details. Moved packet counts by size to a facility of its own. Added corresponding -z command-line option. New incoming/outgoing packet and byte counts and activity rates in the detailed interface statistics facility. Corrected a bug in the FDDI packet parsing code (wrong link type). Added a check for the IFF_UP flag when generating interface lists, to omit inactive interfaces (but still in /proc/net/dev). This covers the General Interface Statistics and all interface selection lists. Now uses the maximum number of columns on the screen. High thanks to Michael "M." Brown for the patch. Saved me a lot of tedious work. :) Reformatted TCP screen to show only one hostname:port per line, with connections indicated by the green "brackets". I think that's clear enough. Added ARP/RARP opcode and target addresses in the ARP/RARP indicator lines. Added vertical scrolling to the lower (non-TCP) window in the IP traffic monitor to allow for long lines (ICMP, OSPF, some UDP). Allowed for slightly longer host names in the lower IP traffic monitor window. Still increased the rvnamed cache size to 2048 entries. Miscellaneous cosmetic changes. Manual now includes screen shots and comes in HTML format only. Changes to IPTraf 1.4.1 Fixed SEGV condition when attempts are made to load a filter list application or deletion with a zero-length filter list file, which could be caused by deleting the last filter. Thanks to Daniel Savard for the report. Makefile comes with the -m486 option commented out Changes to IPTraf 1.4.0 Moved configuration status window to unobscure a long menu option. Changes to IPTraf 1.3.0 and new features in 1.4.0 Support for PLIP interfaces. Support for other ISDN encapsulations (specifically raw IP and Cisco HDLC) high thanks to Gerald Richter for the information and testing. Added -q parameter to suppress the 1.3.0 masquerading warning for users who wish to automate the various facilities from their inittab and similar non-interactive fashions. Incorporated into the Debian version of 1.3.0 by Debian maintainer Frederic Peters (, carried over to general release 1.4.0. Added an option to change activity indications between kbits/s and kbytes/s. On a suggestion by Paul G. Fitzgerald . Incorporated more flexible compile-time control of directories for configuration, log, and other files. Thanks to Stefan Luethje for the patch. Corrected minor flaws in the default screen update delay code (visually insignificant), that led to occasional skips of the delays. (Call it nitpicking if you will. :)) Moved signal() calls to after terminal checks in iptraf.c, allowing standard behavior of signals when error/warning messages may still be sent to stderr. Allows the user to break out of it with Ctrl+C at the terminal warning if so desired. Reformatted IP traffic monitor log entries on Gerald Richter's suggestions for easier processing with Perl scripts. Included logfile rotation with the USR1 signal. Again on Gerald Richter's suggestion. Moved first-instance tag sequence to after the initscr() call. Indicated IP fragments with no additional information in the lower traffic monitor window. Datagram size, addresses, and interface are still indicated. Changed Non-IP count in IP traffic monitor to byte count (including data-link header lengths) from packet counts. Consistency purposes. Added some extra information for certain non-IP packets. These may eventually grow, but not in too much detail, since this is an IP-oriented utility. Thanks to David Harbaugh for the patch. Removed bind() operation on raw socket to address a condition in which the detailed interface statistics and TCP/UDP statistics stop counting if an interface goes down then up again. This will be studied further. Symptom report sent in by Roeland Jansen . Changed Ethernet/FDDI/PLIP description file formats from binary to plain text, allowing database appends. Other files (configuration and filters) are still binary. On a suggestion by David Harbaugh . Copied IP and upper-layer headers and some data from Ethernet, PLIP, FDDI, and loopback frames into an aligned buffer. Avoids SIGBUS on picky systems (like SPARCs) and general alignment problems. I don't know yet which is worse, the overhead of a 96-byte transfer or the performance hit with misaligned reads. Thanks to Jonas Majauskas for reports and tests. Replaced __-type references with u_int-type references. Increased cache array size in rvnamed to 1024 entries from the previous 512, to better handle combinations of busy networks and slow DNS servers. Cleared up a few instructions in the Makefile, thanks to Arjan Opmeer New features in IPTraf 1.3.0 and changes to IPTraf 1.2.0 Experimental FDDI support. High thanks to Paonia Ezrine for the initial tests on the FDDI code. More feedback is requested on the FDDI functionality. Bugs may still be present. Reestablished ippp interfaces (synchronous PPP over ISDN) after reports that the ISDN problem was fixed with Linux 2.0.34. Fixed fragmentation oversight in TCP/UDP service monitor. Applied the bind() system call to the raw socket to have the kernel filter out packets from interfaces we're not interested in. Makes for better capture times on multiple-interfaced machines. However, a strncmp() is still performed on the returned interface name to counter the race condition between the socket() and bind() calls. Fixed interface statistics print routines to print unsigned rather than signed numbers. Added additional option to adjust screen updates. Useful for IPTraf sessions run on remote terminals (thanks to Lutz Vieweg for the suggestion and Dean Gaudet for the base patch. I modified it a bit, Dean.) Discovered terrible performance penalty due to screen refresh with heavily loaded LAN segments. Therefore, with the new screen update interval option set to 0, all facilities have a 50 ms delay between refreshes (exception: the LAN station monitor has a delay of 100 ms). This is still visually fast (although updates look kinda slower), but this gives more time to packet capture, therefore increasing accuracy and capture performance. Thanks to everyone who responded to my request for advice on this matter and to Ronald Wahl for giving me the symptom report. Modified IP traffic monitor to mark TCP connection entries for reuse once one side is fully closed and acknowledged ("CLOSED" on the screen) and the other closed but even if not acknowledged ("DONE" on the screen. This is because many times, the last ACK gets lost. Included an additional parameter used together with the other command-line arguments to specify an amount of time for which the selected facility would run before automatically terminating (on a suggestion by Linux HOWTO coordinator Tim Bynum . Supplemented the main data structure for the IP traffic monitor with an open hash table for increased search efficiency, especially after the facility has been running for quite some time (the other facilities, which don't grow as much still use linearly-searched linked lists. I'll probably hash them depending on feedback.) Fixed rare bugs in various facilities that caused IPTraf to attempt to proceed even in the event of a raw socket open failure. Fixed SEGV condition when IPTraf is invoked with a command-line parameter that cannot be parsed with getopt(). Added labels to LAN address description selection box. Fixed unsightly LAN address description dialog scrolling. Added a separator feature to the menurt.c module, allowing separation lines within menus. Added separator lines between related groups of menu items in both main and configuration menus. Changed the Options main menu item to Configure. Added the space bar and the '-' key as "unofficial" alternates to the PgUp and PgDn keys (it's not in the manual). Transferred Ethernet description facility option to the Configure submenu, and added a related facility for FDDI addresses. Removed Ethernet-specific references where FDDI and (potentially) other LAN technologies also fit. We'll just use "LAN" as a general term. Adjusted detailed statistics screen to automatically generate the appropriate packet size distribution brackets based on interface MTU. This means the brackets may no longer end on numbers divisible by 10, but rather on boundaries based on the MTU divided by 16 (the number of brackets). But at least 1500 is not hardcoded anymore as the maximum. Related to the immediately preceeding change: packet size distribution updates are done one at a time now, no longer as a whole bunch. In other words, as a frame arrives, only the appropriate bracket is updated. Also related to previous two: changed basis for packet size distribution to the Ethernet frame length from the IP datagram length (which really doesn't matter except for a few frames). Fixed bug which causes the existing log interval to multiply by 60 when the dialog is aborted (instead of retaining the current setting). Thanks to Chris Higgins for the bug report and the patch. (I had to modify it a bit to fit in with the screen update interval patch sent in by Dean Gaudet.) Potentially large counts have been changed to type "unsigned long long" to significantly increase running time on heavily loaded networks, plus automatic switching of denominations (from exact counts to K(ilo) to M(ega) to G(iga) to T(era)) to prevent screen disruption (on a suggestion by Lutz Vieweg ). Separated log file into different logs for each facility. Moved log files to /var/log/iptraf to avoid mixing them with the mess in the /var/local/iptraf directory. At least that way, we humans don't have to look in /var/local/iptraf anymore. Relaxed multiple-instance restriction from a no-multiple-instances-of-IPTraf requirement to a no-multiple-instance-of-the-same-facility. In other words, several copies of IPTraf can run, but only one instance of each facility can run at any one time. The -f parameter removes the tags, overriding the restrictions on that IPTraf instance. This modification was done to address needs indicated by Chris Panayis ). Added a startup warning box if IPTraf detects IP Masquerading enabled on the computer. IPTraf will continue to work, but its results may be quite confusing. The detection is done by opening /proc/net/ip_masquerade. Modified additional port facility to accept ranges of ports rather than several single port numbers (on a suggestion by Lutz Vieweg ) Reduced minimum number of lines from 25 to 24 for better VT100 terminal compliance. Miscellaneous cosmetic retouches. (I consider user interface an important factor too, ya know! :) Distribution binary now comes statically linked with ncurses 4.2. You may recompile to suit your system. Included manual pages derived from the Debian GNU/Linux 2.0 distribution. Man pages written by Frederic Peters who is now maintaining the Debian IPTraf package. Reversed version order (newest first) in the CHANGES file. New features in IPTraf 1.2.0 and changes to IPTraf 1.1.0 Increased buffer size in ifstats.c for /proc/net/dev lines to 161 to better accomodate the longer lines in the new 2.1.x kernels (which will be carried over to the new stable kernel series). Based on bug reports by Dop Ganger and Christoph Lameter et al. Fixed rarely occuring high CPU utilization bug occuring whenever a terminal connection is lost, resulting in a SIGHUP which is ignored. (This is an example of a software author's temporary insanity. I mean, what sane programmer would set SIGHUP to SIG_IGN for a terminal-based program huh? Thought so :) Thanks to Dop Ganger for the symptom report. Refined Ethernet station monitor rate updates and scrolling code. Fixed autosave bug for non-TCP filters (this was working before 1.1.0. All of a sudden, the function call disappeared mysteriously. Must have been sleepy that time :) Fixed bug in UDP filter default settings. Added option to display TCP and UDP ports in either name form or numeric form (on a suggestion by Felix von Leitner and others). Added facility to describe Ethernet addresses for the Ethernet station monitor (to address needs as presented by Erlend Middtun via James Ullman ) Added an additional field to the TCP/UDP filter dialogs to allow the user to "exclude" certain addresses from the display allowing all others. Details on the new behavior are in the manual (on a suggestion by Sean Hough ) Relaxed screen management code to better adjust to the number of lines on the screen. As of this release, columns are still based on a maximum number of 80 though. Also under study is a SIGWINCH handler, but this will have to come later (on comments and suggestions by a *lot* of users...thanks guys :-) ). Fixed a subtle bug in the rvnamed interface IPC code, resulting in an accurate transfer of data but causing recvfrom() to return an EINVAL at unpredictable intervals. Bug was an uninitialized address structure length parameter. Code in both iptraf and rvnamed was fixed. Eliminated unsupported interfaces from interface selection lists. Included enforced restriction disallowng multiple instances of IPTraf and an overriding command-line parameter. (This may just be temporary, in lieu of a more elegant solution). Included autosave for TCP and UDP filters. Filters now survive IPTraf exits and restarts without requiring manual reapplication (on a suggestion by Chad Clark ). Included upgrade program and makefile rule to convert IPTraf 1.1.0 configuration and filter files to 1.2.0 format. Clarified TCP/UDP and non-TCP/UDP filter error messages. Color-coded the TCP and UDP protocol/port indicators in the TCP/UDP service monitor for better identification. Revised IP traffic monitor to query rvnamed only once per invocation of the facility. Less overhead. Revised IP traffic monitor to open and close the rvnamed communication socket only once per invocation of the facility. Less overhead. Added a 2-second delay after the rvnamed invocation to give the daemon more than enough time to open its sockets. Fixed SEGV condition which occurs when an attempt is made to destroy an interface list never loaded (which could only occur if the /proc system is unreadable, something which shouldn't happen on any decent Linux system). Moved filter list load routine to fltmgr.c, for better linking with the cfconv module. Makefile now installs rvnamed together with the iptraf executable in /usr/local/bin by default. Added table of contents (hyperlinked in the HTML version) to the manual. Cleaned up the Makefile. New features in IPTraf 1.1.0 and changes to IPTraf 1.0.3 Added command-line options for direct facility access from the shell, and an appropriate help screen for IPTraf invocation (on a suggestion by BJ Goodwin ). Added separate DNS reverse name lookup program (rvnamed) for quicker response time on reverse DNS lookups. Subsequently modified the revname function to use the new functionality. This also required additions of address resolution state fields to struct tcptableent in tcptable.h. Added checkrvnamed() and killrvnamed() to revname.c, used by itrafmon.c to query and stop the rvnamed daemon. Added scrolling capability to the general interface statistics. Interface list will now grow as packets from newly created interfaces are received (e.g. PPP interfaces). This now makes IPTraf better suited to monitor Linux machines configured as access servers. Interface selection lists can now be scrolled. Increased maximum number of entries in for the non-TCP window in the IP traffic monitor from 256 to 512. Fixed SEGV condition in itrafmon.c that happens whenever the Down cursor key is pressed with the lower window active, but not yet full. Added elapsed time indicators to each facility, showing the hours and minutes that have passed since the start of the monitor (on a suggestion by James Ullman ) Changed ncurses include file references from to Cleaned up preprocessor code for glibc2 support. Thanks for help and suggestions from John Labovitz . Thanks also for a test account on debs.fuller.edu opened by Christoph Lameter . Fixed SEGV condition which may occur when trying to close the log file which may never have opened (thanks to John Labovitz for the patch). Adjusted cosmetic code to better indicate the closed status in the TCP monitor. TCP and UDP filters now accept host names in in place of IP addresses. Host names will be resolved and can still be used with wildcard masks (may be useful for names that resolve to several IP addresses) Distribution now includes an HTML-formatted manual. Changes to IPTraf 1.0.2 Fixed SEGV condition when scrolling commands are applied to an empty Ethernet station monitor Distribution executable now comes compiled with -m486 by default. Binary will still execute on a 386, but a 486 or higher is still preferred. Changes to IPTraf 1.0.1 Fixed conflicting hotkey for non-TCP filter menu items RARP and IGRP (the "R" key). Changed the shortcut key for RARP to "P". Modified layer-2 header stripping code to cleanly ignore packets from unrecognized interfaces (see README). Fixed "duplicate port" misbehavior for the "Additional port" dialog's Cancel command Added error-checking for the port list file open sequence. Added PgUp/PgDn capability to the facilities that can be scrolled (IP traffic monitor, TCP/UDP services, and Ethernet station monitor). Cleaned up scrolling code a bit. Fixed bug in the non-TCP logging facility that caused extraneous log entries whenever the window is scrolled. Sent non-fancy messages to standard error rather than standard output. Changed a few messages Changes to IPTraf 1.0.0 Fixed X/Ctrl-X keystroke bug in the General Interface Statistics module (thanks to BJ Goodwin ). This was kinda an emergency, so I fixed this and released 1.0.1 immediately. iptraf-ng-1.1.4/Documentation/0000775000076400007640000000000012173477702016511 5ustar npajkovsnpajkovsiptraf-ng-1.1.4/Documentation/Makefile0000664000076400007640000000051012173477702020145 0ustar npajkovsnpajkovs# # Makefile for Documentation # html: manual.sgml docbook2html manual.sgml pspdf: manual.sgml docbook2ps manual.sgml ps2pdf manual.ps manual.sgml: cat manual.template | sed -e s/@@version@@/`cat version`/ \ -e s/@@major@@/`awk -F '.' -f version.awk < version`/ \ > manual.sgml clean: rm -f *~ *.html manual.sgml iptraf-ng-1.1.4/Documentation/backop.html0000664000076400007640000001053512173477702020642 0ustar npajkovsnpajkovs Background Operation
IPTraf User's Manual
<<< PreviousNext >>>

Background Operation

IPTraf's facilities can be placed in the background solely for logging. When running in the background, it doesn't display any output on the screen, and doesn't receive input from the keyboard, and drops you back to the shell.

Before starting a statistical facility in the background, configure IPTraf in the usual way (set filters, add TCP/UDP ports, etc).

Once that's done, exit all instances of IPTraf on the system, then invoke IPTraf from the command line with the parameter to start the facility you want, the timeout (-t) parameter if you wish, and the -B parameter to actually daemonize the program. For example, to run the IP traffic monitor in the background for all interfaces, issue the command

iptraf -i all -B

To run the detailed interface statistics on interface eth0 for 5 minutes in the background:

iptraf -d eth0 -t 5 -B

If the timeout parameter is not specified, the facility will run until the process receives a USR2 signal. To stop a facility in the background, do a

ps x

at the command line, and find the process id (pid) of the iptraf process you're looking for. Then send that process a USR2 signal with the kill command:

kill -USR2 pid

Since IPTraf cannot send error messages to the terminal, all messages are written to the file daemon.log in the IPTraf logging directory.

The -B parameter automatically enables logging regardless of its configured setting. The parameter is ignored if not used with one of the parameters to start a facility from the command line.

The log file can be specified with the -L command-line parameter. If this parameter is not specified, the default log file name for the facility will be used (see the descriptions of the facilities above for the default log name patterns). If you don't specify an path, the log file will be placed in /var/log/iptraf.

The logging interval for all facilities (except the IP traffic monitor) can also be overriden with the -I command-line parameter.

<<< PreviousHomeNext >>>
Custom Information Messages
iptraf-ng-1.1.4/Documentation/cmdline.html0000664000076400007640000001621512173477702021017 0ustar npajkovsnpajkovs Command-line Options
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Command-line Options

IPTraf has a few optional command-line parameters. As with most UNIX commands, IPTraf command-line parameters are case-sensitive (-l is NOT the same as -L).

The following command-line parameters can be supplied to the iptraf command:

-i iface

causes the IP traffic monitor to start immediately on the specified interface. If -i all is specified, all interfaces are monitored.

-g

starts the general interface statistics

-d iface

shows detailed statistics for the specified interface

-s iface

starts the TCP/UDP traffic monitor for the specified interface

-z iface

starts the packet size breakdown for the specified interface

-l iface

starts the LAN station monitor on the specified interface. If -l all is specified, all LAN interfaces are monitored.

-t timeout

The -t parameter, when used with one of the other parameters that specify a facility to start, tells IPTraf to run the indicated facility for only timeout minutes, after which the facility exits. The -t parameter is ignored in menu mode.

If this parameter is not specified, the facility runs until the exit keystroke is pressed.

-B

Redirects all terminal output to the "bit bucket" /dev/null, closes standard input, and places the program in the background. This parameter can be used only with one of the -i, -g, -d, -s, -z, or -l parameters. See Background Operation in Chapter 9. -B is ignored in menu mode.

-L filename

Allows you to specify an alternate log file name when the any facility is directly started from the command line, whether in foreground or background mode. If specified in foreground mode, the log filename prompt is bypassed, even when logging is turned on in the Configure... menu. If this parameter is omitted in background mode, the default log filename is used.

This parameter always turns on logging.

If an absolute path is not specified, the log file will be created in the default log file directory

-I interval

Sets the logging interval (in minutes) when the -L parameter is used. This overrides the Log interval... setting in the Configure... menu. If omitted, the configured value is used. This parameter is ignored when the -L parameter is omitted and logging is disabled.

The value specified here will affect all facilities except for the IP traffic monitor.

-q

Previously used to suppress the warning screen when IPTraf is run on kernels with IP masquerading. Since the masquerading code now processes packets in a way better suited to raw capture, this parameter is no longer needed and is retained only for compatibility.

-f

Forces IPTraf to clear all lock files and reset all instance counters to zero before running any facilities. IPTraf will then think it's the first instance of itself.

The -f parameter overrides the existing locks and counters imposed by the IPTraf process and by the various facilities, causing this instance to think it is the first and that there are no other facilities running. Use this parameter with great caution. A common use for this parameter is to recover from abrupt or abnormal terminations which may leave stale locks and counters still lying around.

The -f parameter may be used together with the others.

iptraf -h

displays a short help screen

While the command-line options are case-sensitive, interactive keystroke at the IPTraf full-screen interface are not.

<<< PreviousHomeNext >>>
Starting and Stopping IPTrafUpUsing the Menus
iptraf-ng-1.1.4/Documentation/config.html0000664000076400007640000002571312173477702020654 0ustar npajkovsnpajkovs Configuring IPTraf
IPTraf User's Manual
<<< PreviousNext >>>

Configuring IPTraf

IPTraf can be easily configured with the Configure... item in the main menu. The configuration is stored in the /var/local/iptraf/iptraf.cfg file. If the file is not found, IPTraf uses the default settings. Any changes to the configuration immediately get stored in the configuration file.

Figure 1. The IPTraf configuration menu

Toggles

Reverse DNS Lookups

Activating reverse lookup causes IPTraf to find out the name of the hosts with the addresses in the IP packets. When this option is enabled, IPTraf's IP traffic monitor starts the rvnamed DNS lookup server to help resolve IP addresses in the background while allowing IPTraf to continue capturing packets.

This option is off by default.

TCP/UDP Service Names

This option, when on, causes IPTraf to display the TCP/UDP service names (smtp, www, pop3, etc.) instead of their numeric ports (25, 80, 110, etc). The number-to-name mappings will depend on the systems services database file (usually /etc/services). Should there be no corresponding service name for the port number, the numeric form will still be displayed.

This setting is off by default.

NoteNote
 

Reverse lookup and service name lookup take some time and may impact performance and increase the chances of dropped packets. Performance and results are best (albeit more cryptic) with both these settings off.

Force promiscuous

If this option is enabled, your LAN interfaces will capture all packets on your LAN. Using this option enables you to see all TCP connections and packets passing your LAN segment, even if they're not from or for your machine. When this option is active in the statistics windows, the Activity indicators will show a good estimate of the load on your LAN segment.

When this option is disabled, you'll only receive information about packets coming from and entering your machine.

The setting of this option affects all LAN ( Ethernet, FDDI, some Token Ring) interfaces on your machine, if you have more than one.

The interface's promiscuous flag is set only when a facility is started, and turned off when it exits. However, if promiscuous mode was already set when a facility was started, it remains set on exit.

If multiple instances of IPTraf are started, the promiscuous setting is restored only upon exit of the last facility.

NoteNote
 

Do not use other programs that change the interface's promiscuous flag at the same time you're using IPTraf. The programs can interfere with each other's expected operations. While IPTraf tries to obtain the initial setting of any promiscuous flags for restoration upon exit, other programs may not be as well-behaved, and they may turn off the promiscuous flags while IPTraf is still monitoring.

Color

Turn this on with color monitors. Turn it off with black-and- white monitors or non-color terminals (like xterms). Changes to this setting will take effect the next time the program is started.

Color is on by default on consoles and color xterms, off on non-color terminals like xterms and VT100s.

Logging

When this option is active, IPTraf will log information to a disk file, which can be examined or analyzed later. Since IPTraf 2.4.0, IPTraf prompts you for the name of the file to which to write the logs. It will provide a default name, which you are free to accept or change. The IP traffic monitor and LAN station monitor will generate a log file name that is based on what instance they are (first, second, and so on). The general interface statistics' default log file name is constant, because it listens to all interfaces at once, and only one instance can run at one time.

The other facilities generate a log file name based on the interface they're listening on.

See the descriptions on the facilities above for the default log file names.

Press Enter to accept the log file name, or Ctrl+X to cancel. Canceling will turn logging off for that session.

The IP traffic monitor will write the following pieces of information to its log file:

  • Start of the traffic monitor

  • Receipt of the first TCP packet for a connection. If that packet is a SYN, (SYN) will be indicated in the log entry. (Of course, the traffic monitor may start in the middle of established connections. It will still count those packets. This also explains why some connection entries may become idle if the traffic monitor is started in the middle of a half-closed connection, and miss the first FIN. Such entries time out in a while.)

  • Receipt of a FIN (with average flow rate)

  • ACK of a FIN

  • Timeouts of TCP entries (with average flow rate)

  • Reset connections (with average flow rate)

  • Everything that appears in the bottom window of the traffic monitor

  • Stopping of the traffic monitor

Each log entry includes the date and time the entry was written. Logging is also affected by the defined filters.

Log files can grow very fast, so be prepared with plenty of free space and delete unneeded logs. Log write errors are not indicated.

Copies of the interface statistics, TCP/UDP statistics, packet size statistics, and LAN host statistics are also written to the log files at regular intervals. See Log Interval... in this chapter.

IPTraf closes and reopens the active log file when it receives a USR1 signal. This is useful in cases where a facility is run for long periods of time but the log files have to be cleared or moved.

To clear or move an active log file, rename it first. IPTraf will continue to write to the file despite the new name. Then use the UNIX kill command to send the running IPTraf process a USR1 signal. IPTraf will then close the log file and open another with the original name. You can then safely remove or delete the renamed file.

Do not delete an open log file. Doing so will only result in a file just as large but filled with null characters (ASCII code 0).

Logging comes disabled by default. The USR1 signal is caught only if logging is enabled, it is ignored otherwise.

A valid specification of -L on the command line with automatically enable logging for that particular session. The saved configuration setting is not affected.

Activity mode

Toggles activity indicators in the interface and LAN statistics facilities between kilobits per second (kbits/s) or kilobytes per second (kbytes/s).

The default setting is kilobits per second.

Source MAC addrs in traffic monitor

When enabled, the IP traffic monitor retrieves the packets' source MAC addresses if they came in on an Ethernet, FDDI, or PLIP interface. The addresses appear in the lower window for non-TCP packets, while for TCP connections, they can be viewed by pressing M.

No such information is displayed if the network interface doesn't use MAC addresses (such as PPP interfaces).

This can be used to determine the actual source of the packets on your local LAN.

The traffic monitor also logs the MAC addresses with this option enabled. The default setting is off.

<<< PreviousHomeNext >>>
ARP, RARP, and other Non-IP Packet Filters Timers
iptraf-ng-1.1.4/Documentation/conventions.html0000664000076400007640000000723712173477702021755 0ustar npajkovsnpajkovs Document Conventions
IPTraf User's Manual
<<< PreviousAbout This DocumentNext >>>

Document Conventions

The following symbols and typefaces are used throughout this manual:

[ ]

items in brackets are optional. Brackets also denote items that may or may not be displayed onscreen depending on settings or conditions.

{ }

curly braces enclose items you choose from

|

the vertical bar separates choices in curly braces

normal monospace

normal monospace text in syntax specifications should be typed in exactly as presented. Because UNIX and variants are case-sensitive, case must be preserved. Monospace is also used in presenting items that appear on the screen.

monospace italics

italics in syntax specifications indicate items that are to be replaced with an actual item (e.g. interface should be replaced with an actual interface name, like eth0).

Additional information appears distinctively set apart from the main text. This information includes Notes, Tips, or Technical Notes.

Notes are additional pieces of information that may be useful or may clarify the preceeding paragraphs of the manual.

Tips provide shortcuts, clarify tasks that may not be immediately obvious, or provide references to additional sources of information.

Technical notes are explanations of a more technical nature and may be of more use to programmers and advanced users.

<<< PreviousHomeNext >>>
About This DocumentUpGetting Started
iptraf-ng-1.1.4/Documentation/customports.html0000664000076400007640000001504512173477702022006 0ustar npajkovsnpajkovs Custom Information
IPTraf User's Manual
<<< PreviousConfiguring IPTrafNext >>>

Custom Information

The remaining configuration items allow you to enter information which IPTraf uses for its displays and logs.

Additional ports

Select this item to enter a port number to be included in the TCP/UDP counts in the TCP/UDP service statistics main menu item described above. By default, port numbers above 1023 are not monitored. If you do have a higher-numbered port to monitor, enter it here.

You will see two fields. If you have only one port to enter, just fill up the first field. To specify a range, fill both fields, the first port in the first field, the last port in the second field.

You can select this option multiple times to add more values or ranges.

Delete port/range

Select this item to remove a higher-numbered port number or port range you entered earlier with the Additional ports... option. A window will come up containing the entered ports and ranges. Select the entry you want delete and press Enter.

LAN Station Identifiers

The LAN station statistics facility monitors stations based on their respective MAC addresses. The hexadecimal notation of these addresses make them even more difficult to remember than the dotted-decimal IP addresses, so these facilities were added to help you better determine which station is which.

Selecting the Ethernet/PLIP host descriptions... or FDDI/Token Ring host descriptions... options brings up a submenu asking you to add, edit, or delete descriptions.

To add a new description, select the Add description... option. A dialog box will appear, asking you for the MAC address and an appropriate description. Type in the address in hexadecimal notation with no punctuation of any kind. The dialog box is case-insensitive for the address; the alphabetical digits A to F will be stored in lowercase.

Use the Tab key to move between fields and Enter to accept. Press Ctrl+X to discard this dialog and return to the main menu.

The description may be anything: the IP address, a fully-qualified domain name, or a description of your liking as long as the field can hold.

Enter as many descriptions as you need. Press Ctrl+X at a blank dialog after you have entered the last entry

These descriptions will be displayed alongside the MAC addresses in the LAN station monitor, together with the type of frame (Ethernet, PLIP, or FDDI).

An existing address or description may be edited by selecting the Edit description... option from the submenu. A panel will appear with a list of existing address descriptions. Select the one you wish to edit and press Enter. A dialog box identical to that when you add a description will appear with prefilled fields. Just backspace over and edit the fields. Press Enter to accept or Ctrl+X to cancel.

Selecting the Delete description... submenu item brings up the selection panel. Select the description you want to delete and press Enter. You can also press Ctrl+X to cancel the operation.

IPTraf 2.4 and later also recognizes the /etc/ethers file. Should a hardware address be present in the IPTraf definition files and in /etc/ethers, the IPTraf definition will be used.

NoteNote
 

The description file for Ethernet and PLIP is ethernet.desc, while the FDDI and Token Ring mappings are stored in fddi.desc in the IPTraf working directory. These files are in colon-delimited text format. Database engines or custom scripts can be told to append data lines to those files. Each line follows this simple format:

address:description

For example

00201e457e:Cisco 3640 gateway

Do not put colons, periods, or any invalid characters in the MAC address.

<<< PreviousHomeNext >>>
TimersUpBackground Operation
iptraf-ng-1.1.4/Documentation/detstats.html0000664000076400007640000001633212173477702021237 0ustar npajkovsnpajkovs Detailed Interface Statistics
IPTraf User's Manual
<<< PreviousNetwork Interface StatisticsNext >>>

Detailed Interface Statistics

The third menu option displays packet statistics for any selected interface. It provides basically the same information as the General interface statistics option, with additional details. This facility provides the following information:

  • Total packet and byte counts

  • IP packet and byte counts

  • TCP packet and byte counts

  • UDP packet and byte count

  • ICMP packet and byte counts

  • Other IP-type packet and byte counts

  • Non-IP packet and byte counts

  • Checksum error count

  • Interface activity

  • Broadcast packet and byte counts

All IP byte counts (IP, TCP, UDP, ICMP, other IP) include IP header data and payload. The data link header is not included. The full frame length (including data-link header) is included in the non-IP and Total byte count. All data-link headers are also included in the Total byte counts.

Figure 2. The detailed interface statistics screen

The upper portion of the screen contains the packet and byte counts for all IP and non-IP packets intercepted on the interface. The lower portion contains the total, incoming, and outgoing interface data rates.

This facility also displays incoming and outgoing counts and data rates. The packet size breakdown in versions prior to 2.0.0 has been moved to its own facility under Statistical breakdowns.../By packet size as described in Chapter 5.

An outgoing packet is one that exits your interface, regardless of whether it originated from your machine or came from another machine and was routed through yours. An incoming packet is one that enters your interface, either addressed to you directly, broadcast, multicast, or captured promiscuously.

The rate indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option.

NoteNote
 

Buffering and some other factors may affect the data rates, notably the outgoing rate, causing it to reflect a higher figure than the actual rate at which the interface is sending.

The figures are logged at regular intervals if logging is enabled. The default log file name at the prompt is iface_stats_detailed-iface.log where iface is the selected interface for this session (for example, iface_stats_detailed-eth0.log).

If you wish to start this facility directly from the command line, you can specify the -d parameter and an interface to monitor. For example,

iptraf -d eth0

starts the statistics for eth0. The interface must be specified, or IPTraf will not start the facility.

When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.

NoteNote
 

In both the general and detailed statistics screens, as well as in the IP traffic monitor, the packet counts are for actual network packets (layer 2), not the logical IP packets (layer 3) that may be reconstructed after fragmentation. That means, if a packet was fragmented into four pieces, and these four fragments pass over your interface, the packet counts will indicate four separate packets.

The figure for the IP checksum errors is a packet count only, because the corrupted IP header cannot be relied upon to give a correct IP packet length value.

This facility's output is also affected by IPTraf's filters. See Chapter 7 for more information on filters.

Pressing X or Q takes you back to the main menu (if this facility was started with the command-line option, X or Q drops you back to the shell).

<<< PreviousHomeNext >>>
Network Interface StatisticsUpStatistical Breakdowns
iptraf-ng-1.1.4/Documentation/exiting.html0000664000076400007640000000467012173477702021055 0ustar npajkovsnpajkovs Exiting IPTraf
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Exiting IPTraf

You can exit IPTraf with the Exit command in the main menu.

When started with one of the command-line options to directly start a statistical facility, pressing X or Q will exit the facility directly, without any confirmation. The -t command-line parameter will automatically exit the facility after the specified length of time without any confirmation as well. Daemon facilities started with the -B parameter will immediately terminate after being sent a USR2 signal. See background operation in chapter 9 for more information.

<<< PreviousHomeNext >>>
Using the MenusUpPreparing to Use IPTraf
iptraf-ng-1.1.4/Documentation/filters.html0000664000076400007640000011744412173477702021062 0ustar npajkovsnpajkovs Filters
IPTraf User's Manual
<<< PreviousNext >>>

Filters

Filters are used to control the information displayed by all facilities. You may want to view statistics only on particular traffic so you must restrict the information displayed. The filters also apply to logging activity.

The IPTraf filter management system is accessible through the Filters... submenu.

Figure 1. The Filters submenu

IP Filters

The Filters/IP... menu option allows you to define a set of rules that determine what IP traffic to pass to the monitors. Selecting this option pops up another menu with the tasks used to define and apply custom IP filters.

Figure 2. The IP filter menu

Defining a New Filter

A freshly installed program will have no filters defined, so before anything else, you will have to define a filter. You can do this by selecting the Define new filter... option.

Selecting this option displays a box asking you to enter a short description of the filter you are going to define. Just enter any text that clearly identifies the nature of the filter.

Figure 3. The IP filter name dialog

Press Enter when you're done with that box. As an alternative, you can also press Ctrl+X to cancel the operation.

The Filter Rule Selection Screen

After you enter the filter's description, you will be taken to a blank rule selection box. At this screen you manage the various rules you define for this filter. You can opt to insert, append, edit, or delete rules.

Figure 4. The filter rule selection screen. Selecting an entry displays that set for editing

Any rules defined will appear here. You will see the source and destination addresses, masks and ports (long addresses and masks may be truncated) and whether this rule includes or excludes matching packets.

Between the source and destination parameters is an arrow that indicates whether the rule matches packets (single-headed) only exactly or whether it matches packets flowing in the opposite direction (double-headed).

At this screen, press I to insert at the current position of the selection bar, A to append a rule to the end of the list, Enter to edit the highlighted rule and D to delete the selected rule. With an empty list, A or I can be used to add the first rule.

To add the first rule, press A or I. You will then be presented with a dialog box that allows you to enter the rule's parameters.

Entering Filter Rules

You can enter addresses of individual hosts, networks, or a catch-all address. The nature of the address will be determined by the wildcard mask.

You'll notice two sets of fields, marked Source and Destination. You fill these out with the information about your source and targets.

Fill out the host name or IP address of the hosts or networks in the first field marked Host name/IP Address. Enter it in standard dotted-decimal notation. When done, press Tab to move to the Wildcard mask field. The wildcard mask is similar but not exactly identical to the standard IP subnet mask. The wildcard mask is used to determine which bits to ignore when processing the filter. In most cases, it will work very closely like a subnet mask. Place ones (1) under the bits you want the filter to recognize, and keep zeros (0) under the bits you want the filter to ignore. For example:

To recognize the host 207.0.115.44

IP address207.0.115.44
Wildcard mask255.255.255.255

To recognize all hosts belonging to network 202.47.132.x

IP address202.47.132.0
Wildcard mask255.255.255.0

To recognize all hosts with any address:

IP address0.0.0.0
Wildcard mask0.0.0.0

The IP address/wildcard mask mechanism of the display filter doesn't recognize IP address class. It uses a simple bit- pattern matching algorithm.

The wildcard mask also does not have to end on a byte boundary; you may mask right into a byte itself. For example, 255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in binary).

IPTraf also accepts host names in place of the IP addresses. IPTraf will resolve the host name when the filter is loaded. When the filter is interpreted, the wildcard mask will also be applied. This can be useful in cases where a single host name may resolve to several IP addresses.

TipTip
 

See the Linux Network Administrator's Guide if you need more information on IP addresses and subnet masking.

TipTip
 

IPTraf allows you to specify the wildcard mask in Classless Interdomain Routing (CIDR) format. This format allows you to specify the number of 1-bits that mask the address. CIDR notation is the form address/bits where the address is the IP address or host name and bits is the number of 1-bits in the mask. For example, if you want to mask 10.1.1.0 with 255.255.255.0, note that 255.255.255.0 has 24 1-bits, so instead of specifying 255.255.255.0 in the wildcard mask field, you can just enter 10.1.1.0/24 in the address field. IPTraf will translate the mask bits into an appropriate wildcard mask and fill in the mask field the next time you edit the filter rule.

If you specify the mask in CIDR notation, leave the wildcard mask fields blank. If you fill them up, the wildcard mask fields will take precedence.

The Port fields should contain a port number or range of any TCP or UDP service you may be interested in. If you want to match only a single port number, fill in the first field, while leaving the second blank or set to zero. Fill in the second field if you want to match a range of ports (e.g. 80 to 90). Leave the first field blank or set to zero to let the filter ignore the ports altogether. You will most likely be interested in target ports rather than source ports (which are usually unpredictable anyway, perhaps with the exception of FTP data).

Non-TCP and non-UDP packets are not affected by these fields, and these are used only when filtering TCP or UDP packets.

Fill out the second set of fields with the parameters of the opposite end of the connection.

TipTip
 

Any address or mask fields left blank default to 0.0.0.0 while blank Port fields default to 0. This makes it easy to define filter rules if you're interested only in either the source or destination, but not the other. For example, you may be interested in traffic originating from network 61.9.88.0, in which case you just enter the source address, mask and port in the Source fields, while leaving the Destination fields blank.

The next fields let you specify which IP-type protocols you want matched by this filter rule. Any packet whose protocol's corresponding field is marked with a Y is matched against the filter's defined IP addresses and ports, otherwise they don't pass through this filter rule.

If you want to evaluate all IP packets just mark with Y the All IP field.

For example, if you want to see only all TCP traffic, mark the TCP field with Y.

The long field marked Additional protocols allows you to specify other protocols by their IANA number. (You can view the common IP protocol number in the /etc/protocols file). You can specify a list of protocol numbers or ranges separated by commas, Ranges have the beginning and ending protocol numbers separated with a hyphen.

For example, to see the RSVP (46), IP mobile (55), and protocols (101 to 104), you use an entry that looks like this:

46, 55, 101-104

It's certainly possible to specify any of the protocols listed above in this field. Entering 1-255 is functionally identical to marking All IP with a Y.

The next field is marked Include/Exclude. This field allows you to decide whether to include or filter out matching packets. Setting this field to I causes the filter to pass matching packets, while setting it to E causes the filter to drop them. This field is set to I by default.

The last field in the dialog is labeled Match opposite. When set to Y, the filter will match packets flowing in the opposite direction. Previous versions of IPTraf used to match TCP packets flowing in either direction, so the source and destination address/mask/port combinations were actually interchangeable. Starting with IPTraf 3.0, when filters extended to more than just the IP traffic monitor, this behavior is no longer the default throughout IPTraf except in the IP traffic monitor's TCP window.

NoteNote
 

For TCP packets, this field is used in all facilities except the IP traffic monitor. Because the IP traffic monitor must capture TCP packets in both directions to properly determine a closed connection, the filter automatically matches packets in the opposite direction, regardless of this field's setting. However iin all other facilities, automatic matching of the reverse packets is not performed unless you set this field to Y.

Filters for UDP and other IP protocols do not automatically match packets in the opposite direction unless you set the field to Y, even in the IP traffic monitor.

Press Enter to accept all parameters when done. The parameters will be accepted and you'll be taken back to the rule selection box. You can then add more rules by pressing A or you can insert new rules at any point by pressing I. Should you make a mistake, you can press Enter to edit the selected filter. You may enter as many sets of parameters as you wish. Press Ctrl+X when done.

NoteNote
 

Because of the major changes in the filtering system since IPTraf 2.7, old filters will no longer work and will have to be redefined.

Figure 5. The IP filter parameters dialog

Examples

To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port

Host name/IP Address202.47.132.2207.0.115.44
Wildcard mask255.255.255.255255.255.255.255
Port00
ProtocolsTCP: Y 
Include/ExcludeI 
Match oppositeY 

To see all traffic from host 207.0.115.44 to all hosts on network 202.47.132.x

Host name/IP Address207.0.115.44202.47.132.0
Wildcard mask255.255.255.255255.255.255.0
Port00
ProtocolsAll IP: Y 
Include/ExcludeI 
Match oppositeN 

To see all Web traffic (to and from port 80) regardless of source or destination

Host name/IP Address0.0.0.00.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port800
ProtocolsTCP: Y 
Include/ExcludeI 
Match oppositeY 

To see all IRC traffic from port 6666 to 6669

Host name/IP Address0.0.0.00.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port06666 to 6669
ProtocolsTCP: Y 
Include/ExcludeI 
Match oppositeY 

To see all DNS traffic, (TCP and UDP, destination port 53) regardless of source or destination

Host name/IP Address0.0.0.00.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port053
ProtocolsTCP: Y UDP: Y 
Include/ExcludeI 
Match oppositeY 

To see all mail (SMTP) traffic to a single host (202.47.132.2) from anywhere

Host name/IP Address0.0.0.0202.47.132.2
Wildcard mask0.0.0.0255.255.255.255
Port025
ProtocolsTCP: Y 
Include/ExcludeI 
Match oppositeN 

To see traffic from from/to host sunsite.unc.edu to/from cebu.mozcom.com

Host name/IP Addresssunsite.unc.educebu.mozcom.com
Wildcard mask255.255.255.255255.255.255.255
Port00
ProtocolsAll IP: Y 
Include/ExcludeI 
Match oppositeY 

To omit display of traffic to/from 140.66.5.x from/to anywhere

Host name/IP Address140.66.5.00.0.0.0
Wildcard mask255.255.255.00.0.0.0
Port00
ProtocolsAll IP: Y 
Include/ExcludeE 
Match oppositeY 

You can enter as many parameters as you wish. All of them will be interpreted until the first match is found.

Excluding Certain Sites

Filters follow an implicit "no-match" policy, that is, only packets matching defined rules will be matched, others will be filtered out. This is similar to the access-list policy "whatever is not explicitly permitted is denied". If you want to show all traffic to/from everywhere, except certain places, you can specify the sites you wish to exclude, mark them with E in the Include/Exclude field, and define a general catch-all entry with source address 0.0.0.0, mask 0.0.0.0, port 0, and destination 0.0.0.0, mask 0.0.0.0, port 0, tagged with an I in the Include/Exclude field as the last entry.

For example:

To see all traffic except all SMTP (both directions), Web (both directions), and traffic (only) from 207.0.115.44

Host name/IP address0.0.0.00.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port250
ProtocolsTCP: Y 
Include/ExcludeE 
Match oppositeY 
   
Host name/IP address0.0.0.0 0.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port800
ProtocolsTCP: Y 
Include/ExcludeE 
Match oppositeY 
   
Host name/IP address207.0.115.440.0.0.0
Wildcard mask255.255.255.2550.0.0.0
Port00
ProtocolsAll IP: Y 
Include/ExcludeE 
Match oppositeN 
   
Host name/IP address0.0.0.00.0.0.0
Wildcard mask0.0.0.00.0.0.0
Port00
ProtocolsAll IP: Y 
Include/ExcludeI 
Match oppositeN 

TipTip
 

To filter out all TCP, define a filter with a single entry, with a source of 0.0.0.0 mask 0.0.0.0 port 0, and a destination of 0.0.0.0 mask 0.0.0.0 port 0, with the Include/Exclude field marked E (exclude). Then apply this filter.

Applying a Filter

The above steps only add the filter to a defined list. To actually apply the filter, you must select Apply filter... from the menu. You will be presented with a list of filters you already defined. Select the one you want to apply, and press Enter.

The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached.

Editing a Defined Filter

Select Edit filter... to modify an existing filter. Once you select this option, you will be presented with the list of defined filters. Select the filter you want to edit by moving the selection bar and press Enter.

Edit the description if you wish. Pressing Ctrl+X at this point will abort the operation, and the filter will remain unmodified. Press Enter to accept any changes to the filter description.

After pressing Enter, you will see the filter's rules. To edit an existing filter rule, move the selection bar to the desired entry and press Enter. A prefilled dialog box will appear. Edit its contents as desired. Press Enter to accept the changes or Ctrl+X to discard.

You can add a new filter rule by pressing I to insert at the selection bar's current position. When you press I, you will be presented with a dialog box asking you to enter the new rule data. Pressing A results in a similar operation, except the rule will be appended as the last entry in the rule list.

Pressing D deletes the currently pointed entry.

Press X or Ctrl+X to end the edit and save the changes.

NoteNote
 

If you're editing the currently applied filter, you will need to re-apply the filter for the changes to take effect.

NoteNote
 

Be aware that the filter processes the rules in order. In other words, if a packet matches more than one rule, only the first matching rule is followed.

Deleting a Defined Filter

Select Delete filter... from the menu to remove a filter from the list. Just move the selection bar to the filter you want to delete, and press Enter.

Detaching a Filter

The Detach filter option deactivates the filter currently in use. Selecting this option causes all TCP traffic to be passed to the monitors.

When you're done with the menu, just select the Exit menu option.

<<< PreviousHomeNext >>>
Additional Information ARP, RARP, and other Non-IP Packet Filters
iptraf-ng-1.1.4/Documentation/gettingstarted.html0000664000076400007640000000673612173477702022443 0ustar npajkovsnpajkovs Getting Started
IPTraf User's Manual
<<< PreviousNext >>>

Getting Started

About IPTraf

IPTraf is a network monitoring utility and traffic analyzer for IP networks. It intercepts packets and returns data about captured the network traffic in various statistical facilities.

IPTraf comes with these major features:

  • An IP traffic monitor that shows TCP connection information (hosts, packet/byte counts, flags, window sizes), and color-coded information about other IP packets

  • Statistics (counts and load rates) for network interfaces in general and detailed views

  • Statistics per TCP/UDP port

  • Statistical breakdown according to packet sizes

  • A LAN host monitor that returns counts and loads per detected MAC address

  • A powerful filtering system for users to view only interesting traffic

  • Logging

  • An asynchronous DNS resolver for the IP traffic monitor

  • A text-based, full-color, menu-driven user interface suitable for use on all Linux systems with terminals, especially Linux consoles and color xterms

  • Easy configuration

  • Fully software-based. No additional hardware required

Basic knowledge of the important TCP/IP protocols (IP, TCP, UDP, ICMP, etc.) is necessary for you to best understand the information generated by the program.

<<< PreviousHomeNext >>>
Document Conventions Installation
iptraf-ng-1.1.4/Documentation/gfdl-1.html0000664000076400007640000001215512173477702020455 0ustar npajkovsnpajkovs APPLICABILITY AND DEFINITIONS
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

APPLICABILITY AND DEFINITIONS

This License applies to any manual or other work that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. The "Document", below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as "you".

A "Modified Version" of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language.

A "Secondary Section" is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document's overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (For example, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them.

The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License.

The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License.

A "Transparent" copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, whose contents can be viewed and edited directly and straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup has been designed to thwart or discourage subsequent modification by readers is not Transparent. A copy that is not "Transparent" is called "Opaque".

Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML designed for human modification. Opaque formats include PostScript, PDF, proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML produced by some word processors for output purposes only.

The "Title Page" means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, "Title Page" means the text near the most prominent appearance of the work's title, preceding the beginning of the body of the text.

<<< PreviousHomeNext >>>
GNU Free Documentation LicenseUpVERBATIM COPYING
iptraf-ng-1.1.4/Documentation/gfdl-10.html0000664000076400007640000000541212173477702020533 0ustar npajkovsnpajkovs FUTURE REVISIONS OF THIS LICENSE
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

FUTURE REVISIONS OF THIS LICENSE

The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/copyleft/.

Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License "or any later version" applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation.

<<< PreviousHomeNext >>>
TERMINATIONUpHow to use this License for your documents
iptraf-ng-1.1.4/Documentation/gfdl-11.html0000664000076400007640000000575012173477702020541 0ustar npajkovsnpajkovs How to use this License for your documents
IPTraf User's Manual
<<< PreviousGNU Free Documentation License 

How to use this License for your documents

To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:

Copyright (c) YEAR YOUR NAME. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being LIST THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST. A copy of the license is included in the section entitled "GNU Free Documentation License".

If you have no Invariant Sections, write "with no Invariant Sections" instead of saying which ones are invariant. If you have no Front-Cover Texts, write "no Front-Cover Texts" instead of "Front-Cover Texts being LIST"; likewise for Back-Cover Texts.

If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software.

<<< PreviousHome 
FUTURE REVISIONS OF THIS LICENSEUp 
iptraf-ng-1.1.4/Documentation/gfdl-2.html0000664000076400007640000000505612173477702020460 0ustar npajkovsnpajkovs VERBATIM COPYING
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

VERBATIM COPYING

You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3.

You may also lend copies, under the same conditions stated above, and you may publicly display copies.

<<< PreviousHomeNext >>>
APPLICABILITY AND DEFINITIONSUpCOPYING IN QUANTITY
iptraf-ng-1.1.4/Documentation/gfdl-3.html0000664000076400007640000000754112173477702020462 0ustar npajkovsnpajkovs COPYING IN QUANTITY
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

COPYING IN QUANTITY

If you publish printed copies of the Document numbering more than 100, and the Document's license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects.

If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages.

If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a publicly-accessible computer-network location containing a complete Transparent copy of the Document, free of added material, which the general network-using public has access to download anonymously at no charge using public-standard network protocols. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public.

It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document.

<<< PreviousHomeNext >>>
VERBATIM COPYINGUpMODIFICATIONS
iptraf-ng-1.1.4/Documentation/gfdl-4.html0000664000076400007640000001573412173477702020466 0ustar npajkovsnpajkovs MODIFICATIONS
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

MODIFICATIONS

You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version:

  1. Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission.

  2. List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has less than five).

  3. State on the Title page the name of the publisher of the Modified Version, as the publisher.

  4. Preserve all the copyright notices of the Document.

  5. Add an appropriate copyright notice for your modifications adjacent to the other copyright notices.

  6. Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below.

  7. Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document's license notice.

  8. Include an unaltered copy of this License.

  9. Preserve the section entitled "History", and its title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section entitled "History" in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence.

  10. Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the "History" section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission.

  11. In any section entitled "Acknowledgements" or "Dedications", preserve the section's title, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein.

  12. Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles.

  13. Delete any section entitled "Endorsements". Such a section may not be included in the Modified Version.

  14. Do not retitle any existing section as "Endorsements" or to conflict in title with any Invariant Section.

If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version's license notice. These titles must be distinct from any other section titles.

You may add a section entitled "Endorsements", provided it contains nothing but endorsements of your Modified Version by various parties--for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard.

You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one.

The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version.

<<< PreviousHomeNext >>>
COPYING IN QUANTITYUpCOMBINING DOCUMENTS
iptraf-ng-1.1.4/Documentation/gfdl-5.html0000664000076400007640000000603212173477702020456 0ustar npajkovsnpajkovs COMBINING DOCUMENTS
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

COMBINING DOCUMENTS

You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice.

The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work.

In the combination, you must combine any sections entitled "History" in the various original documents, forming one section entitled "History"; likewise combine any sections entitled "Acknowledgements", and any sections entitled "Dedications". You must delete all sections entitled "Endorsements."

<<< PreviousHomeNext >>>
MODIFICATIONSUpCOLLECTIONS OF DOCUMENTS
iptraf-ng-1.1.4/Documentation/gfdl-6.html0000664000076400007640000000475412173477702020470 0ustar npajkovsnpajkovs COLLECTIONS OF DOCUMENTS
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

COLLECTIONS OF DOCUMENTS

You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects.

You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document.

<<< PreviousHomeNext >>>
COMBINING DOCUMENTSUpAGGREGATION WITH INDEPENDENT WORKS
iptraf-ng-1.1.4/Documentation/gfdl-7.html0000664000076400007640000000534212173477702020463 0ustar npajkovsnpajkovs AGGREGATION WITH INDEPENDENT WORKS
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

AGGREGATION WITH INDEPENDENT WORKS

A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, does not as a whole count as a Modified Version of the Document, provided no compilation copyright is claimed for the compilation. Such a compilation is called an "aggregate", and this License does not apply to the other self-contained works thus compiled with the Document, on account of their being thus compiled, if they are not themselves derivative works of the Document.

If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one quarter of the entire aggregate, the Document's Cover Texts may be placed on covers that surround only the Document within the aggregate. Otherwise they must appear on covers around the whole aggregate.

<<< PreviousHomeNext >>>
COLLECTIONS OF DOCUMENTSUpTRANSLATION
iptraf-ng-1.1.4/Documentation/gfdl-8.html0000664000076400007640000000471412173477702020466 0ustar npajkovsnpajkovs TRANSLATION
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

TRANSLATION

Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License provided that you also include the original English version of this License. In case of a disagreement between the translation and the original English version of this License, the original English version will prevail.

<<< PreviousHomeNext >>>
AGGREGATION WITH INDEPENDENT WORKSUpTERMINATION
iptraf-ng-1.1.4/Documentation/gfdl-9.html0000664000076400007640000000437112173477702020466 0ustar npajkovsnpajkovs TERMINATION
IPTraf User's Manual
<<< PreviousGNU Free Documentation LicenseNext >>>

TERMINATION

You may not copy, modify, sublicense, or distribute the Document except as expressly provided for under this License. Any other attempt to copy, modify, sublicense or distribute the Document is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

<<< PreviousHomeNext >>>
TRANSLATIONUpFUTURE REVISIONS OF THIS LICENSE
iptraf-ng-1.1.4/Documentation/gfdl.html0000664000076400007640000000652412173477702020322 0ustar npajkovsnpajkovs GNU Free Documentation License
IPTraf User's Manual
<<< PreviousNext >>>

GNU Free Documentation License

Version 1.1, March 2000

Copyright (C) 2000 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.

PREAMBLE

The purpose of this License is to make a manual, textbook, or other written document "free" in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others.

This License is a kind of "copyleft", which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software.

We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference.

<<< PreviousHomeNext >>>
rvnamed Messages APPLICABILITY AND DEFINITIONS
iptraf-ng-1.1.4/Documentation/hostmon.html0000664000076400007640000001121112173477702021062 0ustar npajkovsnpajkovs LAN Station Statistics
IPTraf User's Manual
<<< PreviousNext >>>

LAN Station Statistics

The LAN station monitor (Ethernet station monitor on versions prior to 1.3.0) discovers MAC addresses and displays statistics on the number of incoming, and outgoing packets. It also includes figures for incoming and outgoing kilobits per second for each discovered station.

The entry above each line of statistics is the station's LAN type (Ethernet, PLIP, Token Ring, or FDDI) and the hardware MAC address. Each statistics line consists of the following information:

  • Total packets incoming

  • IP packets incoming

  • Total bytes incoming

  • Incoming rate

  • Total packets outgoing

  • IP packets outgoing

  • Total bytes outgoing

  • Outgoing rate

The byte counts include the data link header. The activity indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option.

This facility works only for Ethernet, PLIP, Token Ring, and FDDI frames. Loopback. ISDN, and SLIP/PPP networks are not monitored here.

Figure 1. The LAN station monitor

Copies of the statistics are written to a log file at regular intervals if logging is enabled. The default log file name is lan_statistics-n.log, where n is the instance number of this facility (for example, if this is the first instance, the generated default log file name is lan_statistics-1.log).

Sorting the LAN Station Monitor Entries

Press S to sort the entries. A box will pop up and display the keys you can press to select the field by which the entries will be sorted. Press P to sort by total incoming packets, I to sort by incoming IP packets, B to sort by total incoming bytes, K to sort by total outgoing packets, O to sort by outgoing IP packets, and Y to sort by total outgoing bytes. Pressing any other key cancels the sort.

Figure 2. The LAN station monitor's sort criteria

When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.

<<< PreviousHomeNext >>>
TCP and UDP Traffic Statistics Additional Information
iptraf-ng-1.1.4/Documentation/ifaces.html0000664000076400007640000001310512173477702020631 0ustar npajkovsnpajkovs Supported Network Interfaces
IPTraf User's Manual
<<< PreviousPreparing to Use IPTrafNext >>>

Supported Network Interfaces

IPTraf currently supports the following network interface types and names.

lo

The loopback interface. Every machine has one, and has an IP address of 127.0.0.1. lo is also indicated if data is detected on the dummyn interface(s).

ethn

An Ethernet interface. n starts from 0. Therefore, eth0 refers to the first Ethernet interface, eth1 to the second, and so on. Most machines only have one.

fddin

An FDDI interface. n starts from 0.

trn

A Token Ring interface, where n starts from 0.

pppn

A PPP interface. n starts from 0.

slin

A SLIP interface. n starts from 0.

ipppn

A synchronous PPP interface using ISDN. n starts from 0.

isdnn

ISDN interfaces can be given arbitrary names, but for them to work with IPTraf, they must be named isdnn. IPTraf supports synchronous PPP (the ipppn interfaces above), raw IP, and Cisco-HDLC encapsulation.

plipn

PLIP interfaces. These are point-to-point IP connections using the PC parallel port.

ipsecn

This refers to Free s/WAN (and possibly other) logical VPN interfaces.

sbnin

SBNI long-range modem interfaces

dvbn, sm200, sm300

DVB satellite-receive interfaces

wlann, wvlann

Wireless LAN interfaces

tunn

general logical tunnel interfaces

brgn

general logical bridge interfaces

hdlcn

Frame Relay base (FRAD) interfaces (non-PVC)

pvcn

Frame Relay Permanent Virtual Circuit interfaces

Your system's network interfaces must be named according to the schemes specified above.

<<< PreviousHomeNext >>>
Screen Update DelaysUpThe IP Traffic Monitor
iptraf-ng-1.1.4/Documentation/installation.html0000664000076400007640000002505112173477702022103 0ustar npajkovsnpajkovs Installation
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Installation

IPTraf is most readily available on the Internet, but some may receive it on a diskette. Here are the instructions for both types of distributions.

System Requirements

IPTraf requires:

Hardware Requirements

  • 16 megabytes of physical RAM (more recommended, at least 64 MB for very busy networks)

  • 2 megabytes of free disk space for installation (more will be needed if you log high amounts of traffic over time)

  • Pentium-class processor or higher (Pentium-II 200 MHz or higher recommended) or equivalent.

  • One or more of the supported network interfaces.

Operating System Requirements

  • Linux kernel 2.2.0 or higher

  • GNU C Library 2.1 or later

  • ncurses 4.2 or later with the complete terminfo database in /usr/share/terminfo. Support for linux, vt100, xterm, xterm-color recommended.

Compilation Requirements

The following components are required when compiling IPTraf from the source code.

  • gcc 2.7.2.3 or later

  • GNU C (glibc) development library 2.1 or later

  • ncurses development libraries 4.2 or later

Availability

IPTraf can be downloaded from the Internet from the official FTP site at ftp://iptraf.seul.org/pub/iptraf/.

The software is available in source form in compressed .tar.gz files named iptraf-x.y.z.tar.gz where x.y.z is the version number. Precompiled ready-to-run software is available in the iptraf-x.y.z.machinetype.bin.tar.gz files. (machinetype indicates what platform the precompiled binaries run on. The official distribution will only be for the Intel x86 architecture indicated as i386.)

Installing Downloaded Packages

You will need to have GNU tar and GNU zip installed. All modern Linux installations already have these utilities ready.

  1. Decompress the .tar.gz file by entering

    tar zxvf iptraf-x.y.z.tar.gz

    for the source code or

    tar zxvf iptraf-x.y.z.i386.bin.tar.gz

    for the precompiled x86 programs.

    If your tar doesn't support the z option, you can separately decompress the .tar.gz file then extract the resulting .tar archive.

    gunzip iptraf-x.y.z.tar.gz
tar xvf iptraf-x.y.z.tar

    This will decompress the sources into a directory called iptraf-x.y.z (source code) or iptraf-x.y.z.bin (precompiled). (x.y.z here should be the IPTraf version number you're installing, like 3.0.0).

  2. Change to the created top level directory.

  3. To compile and install the software, run the Setup program by entering

    ./Setup

    while you are logged in as root. The Setup script will recognize the source distribution and compile the software before installing. It will immediately install a precompiled distribution.

The resulting binaries will be placed in the /usr/local/bin directory. All needed directories will also be created.

After installation, you will be asked if you want to read the RELEASE-NOTES file. It is recommended that you do so at that point, since the RELEASE-NOTES file contains important information about the new version.

Installing a Floppy Distribution

If you received IPTraf on a diskette, the sources are already decompressed. The diskette is in Second Extended filesystem format. Perform the following steps to install the software.

  1. Insert the floppy in the drive.

  2. Mount the floppy on an empty directory. For example, to mount the floppy in the first floppy drive under a directory called /mnt, enter

    mount -t ext2 /dev/fd0 /mnt

    This assumes your floppy is in /dev/fd0. You can use any empty directory in place of /mnt. With most Linux installations, this will work fine.

  3. After mounting, change to the /mnt (or whatever) directory.

  4. Enter

    ./Setup

    while logged in as root. Setup will determine whether the diskette contains a source code distribution or ready-to-run precompiled software. This will copy the binaries to /usr/local/bin, and create the necessary working directories.

  5. Unmount the diskette by typing

    umount /mnt

    (That's umount, not unmount.)

    You can then eject the diskette. Store it in a safe place.

    You will also be asked if you want to view the RELEASE-NOTES file. It is recommended that you do so at that point.

    In both cases (downloaded and floppy), the installation will store the program in /usr/local/bin with the binaries owned by user root, readable, writable, and executable by the owner, no permissions for the group, no permissions for all others. (700 octal, or -rwx------).

    NoteNote
     

    You must be root to do the installation. The old style of installation (cd src;make install) is still supported.

Be sure /usr/local/bin is included in your environment's PATH variable. You can edit the appropriate command in your login customization file (.profile for the Bourne-type shells, .cshrc for the C shell and its relatives).

<<< PreviousHomeNext >>>
Getting StartedUpUpgrading from Earlier Versions
iptraf-ng-1.1.4/Documentation/instances.html0000664000076400007640000000703312173477702021371 0ustar npajkovsnpajkovs Instances and Logging
IPTraf User's Manual
<<< PreviousPreparing to Use IPTrafNext >>>

Instances and Logging

Since version 2.4, IPTraf allows multiple instances of the facilities at the same time in different processes (for example, you can now run two or more IP Traffic Monitors at the same time). However only one can listen on a specific interface or all interfaces at once. The only exception is the general interface statistics, which is still restricted to only one instance at a time.

Because of this relaxation, each instance now generates log files with unique names for instances, depending on either their instance or the interface they're listening on. If the Logging option is turned on (see the Configuration chapter), IPTraf will prompt you for a log file name while presenting a default. You may accept this default or change it. Press Enter to accept, or Ctrl+X to cancel. Canceling will turn logging off for that particular session.

If you don't specify an absolute path, the log file will be placed in /var/log/iptraf.

Figure 1. The logfile prompt dialog

See the Logging section in the Configuration chapter for detailed information on logging. See also the documentation on each statistical facility for the default log file names.

The default log file names will also be used if the -B parameter is used to run IPTraf in the background. You can override the defaults with the -L parameter. See Background Operation in Chapter 9.

<<< PreviousHomeNext >>>
Preparing to Use IPTrafUpScreen Update Delays
iptraf-ng-1.1.4/Documentation/iptraf-configmenu.png0000664000076400007640000001554512173477702022646 0ustar npajkovsnpajkovs‰PNG  IHDR2n¬¶zgAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}<ÿ‚ÃÃY‚ÿÿÿš¾]ÿÃÃÃÿÿÿÿÏ00}¾Ó×Óš00ó÷óóûûÛçãš0ÿûÿÏÏÏÿÿÃ}ÿÿ}}ÿÿ}<<¾ûÿÿÏÏÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿçççMMMÏÏÏÏÏ›¢ødbKGDˆH pHYs  ÒÝ~ütIMEÒ;ŒwJÓIDATxœí ¶«ª²…óú`OlʃÓÿžÜYE”â_2ç½g™ ŸÅ_t¿^åT (‡ˆ å"3*XaÔ/Iz™7H¤ZÿÉÌok2Ôok ™Ø=Å^ŠÈü¼:ùðòXçš’R7‘… :üSí­¨_RÅËÄ/éÛ´Œ{‰ÌÏ«™ö˜˜ú%9aÇD½e-奯AtLD†z‹”SD†rê2ÿOQÊ)"C9Ed(§ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ å‘¡œ*¹zkº‘ˆ å‘©ùŸz£6ÒÍ2Jo–'‰È ÔœþtÆ­¤#2?£ƒ¹™ˆÌ@aSÏïÿ½»›å°t>1PtEÉà¹å“:çfW8\Df 2³8ˆÀb,éÌŽ r™}îl¸º‘™)¥¥=ç|¿k/S? >Ï+Èää:õÙ•îGf/œß&cÀa “?¯!³t=ó܇L¸¨_"2{TCf® #¢ÔÓY2!û´K„ÈìQ™ÙDFz™ÙH‡çŠ¾*¥¹l,CdöÈ@&l>=ö³¯ˆ®%§[€ƒèÐäôë|™=²9ç¢6‘Ù£K¹tA&l@fyóøÿ}tÀ;Í£p2k32ð÷GˆŒ™¿Ùd>¯0úwx^¾Š³e‚M z¼‚‰ÌÖw“.éâëžT.F–'¼j6»Àȼ¶y™7 ™HŽ8[Æ¿¥B™Í©^Š«r¹™e^V‡«™ˆŒ¼w{2ˆ: ™ÜÏLSþöénäaQ‰ êæ[²NnÉÊó…&2¹ŸÉ,¨7²ËΧD¦ @¤[²VïêÎïfÞÏL^ýÓ^d ƒíZï|2Ó2–íÙÉE í.PùmÝàÁð$ð6î]2EÖò_yŽó2yùq72Ãß 2¯elûŽZA&Ò"¡±Y<‘õ¥ª!ƒÃXL€R¦‚ @±‚Œ~Á{ÎzŒpy—ù “; 9z _) û„@;ô"cÍ­NV ðS¢&õK$ˆ¢‘I°è±L2ÖÜêFȼ¢—yed–/É®S1^ȘÃßvÇ”\ÍL¼Û“£Q ”A cÛSJ€wédòX&[_0¨me¬sd›‡e°û™„÷¨Že¬sd¤KÓÎfÜðw,2iê’&àW ÓJÍ‹}—1›ÂVÌÉÊó5‘Q®"öR1Žð&9¬¶”½œ˜1¥˜©“KéFôOËú(dàšÌE9ì]ÑÓ¶%‰Œ­;#CîƒÌ‰:™¿ZDÆLpÁ_1¯T1z1zo2íÚ>ª~ƒv²³Ì•$\ì”óƾR>ʤ¶%ŸT¿QÛ’Y‡ ó,ÜÉîÒ©f<‰Oh#³x;ÑiáBUh®[`ºJÌUC&T¿s«9j';k2ËÂ6®s›+ “È šâJ?VË„pTý®ð2»w²³$2ñ°7ÇXi äÚFª!„I/ëöìSÙØϬߨ ƒ¬ÂËÈ@éeDIf°KL uÆÙÝçñÖ>]µIvnõ'×ïHdŒš7ù+‹BÍ6©q5Ãq#öIZÙ–_¿k:¦p$2P± 2z,ƒ™…f_Ÿ Ç}~7¿hu'{pý¬ûï8„L·úÜPÞ*!3¦23µc‹Ðiˆ"bž¨ÆRÞ1õ;·–ƒv²›ºfDq¸a@dœ"2»‘ù5"ã‘ñ “Fi{5ª3»ÍŒ©i–Gu݃w²‡Õýëi–åIȌޖ¼]ÝŸŒ[Úù(dÄŒ¹â°ì„Ê(°ÒÖ;ÅbFŠ#¿¼ªLW¼aãxµ–òÆÔö¢§?ÞɆõ&4A(×5—PW§Œ%Óʯ®cUQÎP™1µ½ÞË ÛÉN뼡\×ȽE àcŤÒv%2Ug¨>üZÛ‹4zÃÀ¨°Ü/0‘)7,¥¯1 ‹n4Ìåȇݵ½Hç"S^yňxkU}GηîeNÕVdµ½CÇŽFF÷i,#£ K³M•oéê™"ÊÚ†Œ§¶WÜQ! íÒ·TéåÊËŒI'H1õÞ®X̘ ¹å ­"³¿¶WöOgìdW.<¢ø·7 ˆŒSDæd¾XD†È8Ed\Ȩeä Gö×ÉBFÁŸl—Á;Ùz}éÐþ*õlK>×.£·%‰LØÌ#Œu2!¨XTx‚Qöª¾.Ó¶Ë3Ì3z'{É$ßTb]szÈ´S+Kyu»<Â8£w²ÛÈ„‡Xe§ÜÈ„'Ùeô†Á*2¿ -Èü]±Ë#,DdÐVdža¢áÏd‹g«åìì1D¥¼¶]ža¡Ëv²¿XÜ0 2N"ã‘!2N2+?œzÆøn¯=Ã.i‹@–“Èl×—"“ö#—ùÒûgÃ1Èü†üȘºGˆLúžÏ†1;Ù¸þ0-?,šä¹/ÔúNv]ngc‘uÍ ^¼„}îw ÒêSŸ]îfù«‡ƒ~üP1M 2O´Ë•^&ÜÛ4»Ed¶#“7âÀdêÜjýÇ]v¹›yÎB&Ô¹/T2jÛåv·ÔaȘÿ®ÎÒýu;›Œ’‰ŒÜ»î±Ëí¬¼c‘‘Bï« `~‡V7 ¾Ñ.£ö˜ð6ªœûB­ï1}¡]¸-¹GÜ–$2Ný2ƒÿ9ÒI|“GüÖç~è¤Mdža—bd÷¬íx¶"£fÏw5Í¡²yˆ]:‘þBz¨M«b¿„̱vg#sþ|2rááã•Ó*,F([Šå ˆó¬9DË.¸[°É.Í“~“–`æ¼Ø?± ð-×v2©Âè€óÂ!8`Ã4׿Rs§êȘvÉß·Úe¨—Yà€Õ^ü(—€Ç Ë—a2µ¯;«¾úkÚe2Ù×w52¹;²Þ2ÄËd#,Çäɼ¦yXÏ´âeÒ÷"üz»4‘ ³õ-¦ g"3­™f˜EÎÑ(dºír@Ç,d´9j,÷Kþ™çòw‚¡ mšïË@µ@~» ¼«òðW#“ýod¥÷ “jDýâH&ß(hªl͘ YêYžfuÆÐ.0’Ùj—¡^&Îp®pÆ”û¥!^ƭǹYKy^Ý×.•‡HÎCæq.¤C#¹¯]®Gæ 5™§‰Èì‘q!ãõ§ià « V<1 mDX K£K÷б;~cø»ZMq¸™Žy&Û=j‹/DŠ3ËZòqÈLéiga÷!3-ÿ­TSî%Ü+ˆ8NFF¯[ZEÆÒ¸œVò”ª#³^MqX¦:è ƒ¼¢ –žÄò“ðÊø¿ÞÚX†Ð™ATXÙÈ©‹¬[!ctØ´å®3f&¯'¬WØeÂŒêÕÔYwÊ ÑAȤ&È5úa`*G”ðX7j(@ lê[;%IéR,|Š ë'¯Ö ýȈjæNó}\Î5Á*Â’Ë|ÞÉч¼½™¿Ф*3+—x ³ì±y4K€he«kdd™[¢°­8`IÖ«YÁBZž¥£¼Ì[-V’áD9l/¢?02‹þ â¶I™G¦ÔêS£š‚yˤJëÀ“täXf ™²ömÛʬÈi ™ôù.ÈØÕ,ѵ•Êt¸NCf’Èh{­!3‰\ŠÌä• dD‚fÇ„î«LÍ[ õVíR©f€CJ×<4 2VuO¹uT»Œ<—*3ÓàHýcÝÌ:'Âf%K½œ3l+ùj¹€õjê¬Í[Fò/“–òËüº¸a@dœ"2DÆ)"Cdœ"2DÆ)"Cdœ"2DÆ)"Cdœ"2DÆ)"ÓƒÌL- ™«Ks’¶ CèeˆŒSD†È8EdˆŒSD†È8EdˆŒSD†È8EdˆŒSDÆL^Ù9ëÇ…wT‰Lú©øe*œ–ǺN°j~QÉ|åE!§Âf/#_nö“2½LñdBùðÀ-™ááÆÉzº°™ÖfdÖÕ×FÍMdZ Ã^dÄOà¥;V^ùû´‚Lå!Ófò1Œy˜Å;ò–ÞÏ©®kPÇ4é [·Ø÷ɉŒ~¦JÚ,›îeàI%xWkf&r3îœmd>Õõ½ê@¦>üíCæ@•oõÕÈ„¿ºz»x™IéËû¥N/£Ï…ªÍî‰Ì¨·‹×½ÌÆñÞÕ7üÕçBÕfwë˜B¬Û c™\[ãžûŒ¶ PT:¦åOŠtXéû>–ÉnU ûã9mC­p²êÈ(KÀÉɶ™8¤YÕÁ“ìø¡ó(ËŒš19ôS^æÛÅ=¦="2DÆ)"Cdœ"2DÆ)™•š8Ý1¨;t”ÿ5ãd=] 2Ûu<2GΘÂòöp "süÈ9NNz·ohòa¥ Df»ÈÈÕ–|Vï¨ÝµXƒ«<ƒ‹˺r)oùpÄN6Õ@F,æªÓ°ˆ‡1'HP[8Xt\®«­þÎÙÉJ»é}x÷û¶#£?è ƒ€A#A†GZÅX‡^fÆ “w²ÂF&ô"3n'›ZG¦„T¼ŒÕwtÝÌ°lª ™B#SnÕâNwÊï á¯žd›È Üɦld`°ËÉ'qSìyÃF¸xÓùð²'3CìdÏ™ª™^f”V7 >Í}NaΑ٣õ=&µ.ó "2{ÄmI"ã‘ñ!“ÇDj–CZ£¶‡}{—^›1©‰µ:[èÒím¹èÒ“ lEfg›é° ‘©h a*;Ù­a#28[/—›ÆÔûWr˜n€}ÎÜɎȔ۲),¯F•·Afnêª÷SUøfÐfK¤Å=4Ý»(d–%ó€•ÞƒŒ4 Ô&°É‹A##¶æ&‘Rƽ“šÈÀ⿱E ™I&Q*¹æeä.ÂèÕßey—»× Æç ‘Á”wÅå­2p¾ŠŒþ sŽeœI /1xÔN6x2ÑÓ® ¹Ü¶_êG»—ØmÉ4)ç7Úéê±L7´“½™JÇTDÁ\nëhz‘1\HPiÌ(™ã;¦%±ôÇÇ2åmu/™´S.5CÝ#ÏX&^í˜*7Oiä1̨~éÀ±L0fLÉ›&“MyS7${Lj7~˜1<Ù¿pT7`ÆZý•Õô‹L îŒÒ™‘iôö¶œ 9cª¾º?ÂË,ºCéÒ“¹ŸˆÌeÈ“ýAFÞTåô"i=4›NÞf”)®ˆŠö¸‡V‘ù”:`+¦zåÈÙ¥ý>ç+v©Y>t›êŒg²ÅÅ|Èh³È`Ÿê^&™›ê/ƒî$!Ó¹©¼ÃߌLjP=– &2!#2‘$™ŠÈÜYKy5½8y®™ $‡Å:³ æJÈÜWçlÜ‹·ˆ ê¤=¦[-³¸EdPÜ–ì‘A™‘é‘A™‘é‘A™‘é‘A™ÈPJDd!Cº¦yî("Ó©kšçŽ"2º¦yî("Ó©kšçŽ"2º¦yî("Ó©kšçŽ*¡¨¶ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ å‘¡œ"2”SD†rŠÈPNÊ)"C9Ed(§ˆ åÔ?dþ£(‡ˆ åTFæõQ=âÖ ˆoêØ™ðS²zù^ݹÖW³¨äú³·šh„¦¶šh#2/é™)‰Ì‰ºg²C‘i]¶‘+‘ùûƒ^Ë™W:ÄKç^Jê(ÐØ©gyAf/U†E•ó¿«œÍ²X…_ʲ¤{YQÌ<_(Ébæõ¯™Ø¼ÿ¥Î¡lúï“Q^Å•ÙKd•Kd°œùÐ(‹Yø˜uÌ_–»^?•…ŠòJýªq½§k2FgóRçÈüáv‹Ä ‚£× /ÈÔ.¼YÀ*›˜\S—<‹Bæ«pyˉLöÜ*•>w2ºèVÊr¾ª…7 ØD&婲ø³Ö ½LåzOW™x&EPöÒŸä¹ã‘©»«œ¯JáͶ‘Ñç²¼Z×{ºÈ@XüPoåJBºè|tëìA1ùP+‹y=Y–¥€-ddÌ2JÑ1×{ºª3¦8‡€¹À+žÓ3Šÿ qX\Öâ´tfʤæŒé“@S$¦tq±R]xÌZPÖϨ»%’S»ÞóU­Î·Þ#Ô^Õï€/½G¨½úÄÕÿh9õ,µ‘™çÓ B=E€Ì’yQ3‹iŠº5YÑW³Ð…Ù ´¯ÈTT™÷—ø_]ïö7h¦é ÒÅ 2—ˆÈPN•ÈdïŸú÷ß'¿¤öš> ñoXþCŒ–o)péÌ p2¿ -—œcY>…ßÄõb—©²Îe.ÊI­ËD=Nl•ŸöùwŒé¦lÿ›A pà\>£ñì'UÖÌ8?Qê`^Ï<ˆë²æOÈB&4IÎæ_û”¬Ô ·„}ÖlÉäe‚…ŒQ¤ü¸‘Ù©2¹wª ³HݽàïeÏ„ð­ŽŒVcV‡ÝŽ¾P‰,;&—ŽCF_)Þî) 6!ä¼Èà9Ì*]S^Èð2”Gõ± ´… Õý˜QjcÙËiȈQVÖÚXfR×ÛcÁŸ®þê™H ›¥|{Çdj^’Æ-ª_‚éÉÒÈ@ìEì›û HJ.µˆ ¹ÂñgL~•¦§§¨("C9õ¢(§þ>Ñ·õ´ZCìIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-dstat1.png0000664000076400007640000001432512173477702021707 0ustar npajkovsnpajkovs‰PNG  IHDR1`}‹Ø gAMA± üaÛPLTEÿÿÿÃÃÃËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßß4a’ÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}<‚‚Ãþ]ÿÿ}ÿÃÃÿA¾}ÿûÿ<<AA‚‚ÃÃÿÃÿÏÏÏZá°ÕbKGDˆH pHYs  ÒÝ~ütIMEҦΓfpIDATxœí ¶´¨…»çPa™ÿˆîíS $<,Ô½W÷©R!Fù„…ÿ?ÿBEÿüÚèfúç_‚ ƒ@ d#æ£(K¯íƒÞ$QÇüGÃáKªÿï2ï–èÝ:!Æ·M¾‰1¯×91_\(Æ9¿qÚD 1¼:áŠMô&éuŒß[Ÿ#ä1¯W1õpz“Ú‰A«ý'e/l’h•@ ôŸ0KÙb ›@ dˆlʉqÿ×ߧܛ|–wfæÎ\g;OýT1¡üæãê<‰36¦‡~*+1ç;û’¸ü;´¥tb¾m“#ßF¹ÐT9ªï š0wd qLX9Ž˜í¥Å1ǧøàÚÎ4(á8QuI+Ç1³½þˆIëY¸Ž,~É0[ìOB“È©%qÐn ĤE|!8ÓˆI:;ñˆw¡ ´™TbÔG_¯Vtb ærbŠI@Ì®:%æ[‚.lQÂ’²3-òbĉ{f[é­ÒÑVxRœ/ÍcË÷o¨°3‹ç ÐW’§çV"?f_•ãÒb ›@ dˆl1M ² Ä@6È&Ùb ›@ dˆl1M ² Ä@6È&Ùb ›~CL\ÇÀÜà‡/5–d/$²x3˳yšÛâàˆ±ŸÕ1…Eêærcs’¬0RŸ£Íac ¦ç|× O ù*c?&&.Akúˆé7ö]#òycÁ¶LR±:ÕX¸€°8‡]¹x™­6‡ý–˜ðÇå»®4ö½1Äo¥ÿ¥,“œTÛÓŒ±«È¯ÏeW~nsØØNÄù?L ÆdŒÝ:',&…“œ3ËÉ”g…|nsØØVÄt¿ dÔˆ¹'1ÉŸ Ù Y¾g­1‘çäïÛÈ®¼bsØØ>Ä°ÞãÄ¥…\ =È[¿Ì»°pEŽå+òBc¿%F_àÝ46ÑØ7 {¤\0æïœHâªÏðLcÌf¼""þ²/v†vGŒýŒ˜««œm¬–ÏlÓb ÄtÈ\®0VËg¯¤ÛÈ&Ùt1jšîès"5=ÇŠj ^HŒæÉœë}Á+p°Í ˆ¹à੕ˉ)ŽPĺ±k8F›Ž5ƒƒm^MLöáâ1þ™Ü‰7/³Òn ¶9x1Õ0ž(ý‰£Ùñ„$w­ÙlsðÚ:æ¿O|£ð{„PÆ4VÛÙõƺÎtðjbxUvI"«7ñz“)X‹18Øæà/ˆq¢1vÌÁøô˜ÜñYˬ´ƒƒm^M ŸRŽÊZhb[­¦Y—Z±uEà੃—³^ö'ëb=ÃÁ3wJy…áà“ˆ®ˆlÒˆùb;x–Üì?µ‹!WŒ±œŒÃôl1IHŸê8èêÆîí`Íõ‰&›"ß”‘ÊÁ?üQø/èµl!ŸØ’q†g:XsÝ<†×ll€˜1pœK‹Àµˆ·âeÉ" [Ïs°æzÅÁQcUb¾m“o¢BK9âïS( ï`ý ‰,WR¿+õó¬¹N¿!&ü‘[Sêñü²[Ë‚†Ú„»?·ìHò4ë¾ï@ …jeFÃSñË ¼xñR\iç$b¶u°îûÄ|[(šB o½yÄG±~DgÏÐU Û;xæüÄLm•x“+™ê$õ»¶“Û¢ƒuç«Žk%&¿Äªœ±º†ÅŽ÷æH°Ô_ Û;xêù c5bxïÈ÷•b×i¸q ÚßwöÔÕÆ´œs,Ÿ|LC¾yÄìí`Íõ‰6¥±1Tˆl1M ²I'æôîÔI€{´•À2!)Í׿‚ì~Ö\¿<ò•Ã0+ä‡o¾.í§¬øþìßÇ3¬ùpyïZ¸›+§ßʳku²@‚ù‘Ï#¬ù0Ñfj¬‰˜S|TãSG¬¯dd_xݲS¾ÿ‰Ö\§³ Ž‰jxøâc™»#s†Ï`…Ýþv°Ðã‰Ö}ÿ1ë"_Q ñ¶Åç³–“åË „•ù':X÷ý‡uÌ…GUÖᆉOk²óø2&lïà™ó?&f:;ì!£ôOS¥ÏVÊJi1›;Xw~¢Í.bÖ4NòL¾Hlù aM(í¬¹0/6r-½ëtônIûÂ>ÿjâOf1“cùH)þøºº±»;Xs}¢Ii¬TÇ@.Ùb ›@ d“FLˆ{“ŸiN=¯E˜èê± ‚²->:æÏôDϼ_e¬PÇð ‚óGŸRvßêo³!ÉÆ9|§ðïÿ:xæýŽë1ó°a‡&Èë™’–/|îØÞÁç×;%fáv¨½Ã£h¯ôåpýàòXkì@ÌÔ¦I¾2bý âç[¬‹+Óø2tŠŸë`á„«Œ•êövÖÈΚâÅþgèÇÙ.˜÷ZÕQG;X8áŽë:1“ ž TXïãÊÙÞÁòù;%†ý³a÷ÜÕ´áËp„âmǤVigKç[d¬ƒ˜¹M ²ºß`ÂÉòLl>ÚÁ‚Ë?%†VG¾4T ±$_×aìžæ'\eL'‚J1M f -È[#³…îNLuôvÎlµêËx,˜‡§3Kbƒ³‰¹:ò=ïŸ0[]ð,~ô]0둬輮sp21—÷®³¹#©)3Iºká£ëzãC»)1Eçó‹¼Y4[ûïÚ@ða¶Žõ‹?qðĈÁÞ³Õ5ß:o^€Ãˆ vwðþÄÄŠ…ƒÃf®WD¾Á!ê»^Q ¾B˜Ú¤3Ïæ:øb(#&=<É¡ÌAñaÊé«úˆÈä8ækS|˜r–|1Ó[¥Þë7}iä»ÄÁ'súª°11ò¥‘ &X˜°äæ-pðþ½kJg«y2c¶ºà[ÓêµÀâƒXÛ;8™˜™á~jL%ºZ³‰Y(³…@ ôXÈ&Ùb ›@ dˆl1M ² Ä@6È&Ùb ›@ dˆl1M ² Ä@6È&Ùb ›@ dˆl1M ² Ä@6È&Ùb ›@ dÓ ‰yÏ•.‘FLöFpùR¡ÚK©f¾O¼Þ‡½.C¾4#nñ·í²oÙ;6&súÉâÁÓ›•&XöòA/ko&)Ô1)#•ƒ­‡¬¯sœñÆ$31ÓßÒrö"Éûã_×ö÷ ÑÄŒüS€)1W#†š¶‡õ3b¦Ôôž¿*1òáìvcéø±$eòºÎ®kÈÞ,X'&´_DáõÊòÕuüåx㯵ûOñõÆùµØIŽ¥oT“ð÷ž¦å°ì…Êõ›Q#†½î9ÛÒÅͧ)‡_+~0¼yM^ü(¶bâãj"ÄvÊgiôuœ¡<ó÷“ª¯¹•7+Q³‹›Z.‡yâÏœž€Z‰!IAž.»¦ WÄj :'F#‹fbAÌ€´²&§U »ÒH’/ê²*~¾Ät¶J™§Ù›Z9Kü)ˆõç¨ÿá2¾¡†»‰!—o…·¤ŽùȈáOKúÏø¿KYÑ+ù‡ñyœq[ËbUp) ¶J2¹~¼ë •È7}ï­¬>C«D1¢v‰©ù®NiÄ(âæd­J)ƒh½’/ ÀIž95 µÃ+ ˜H)ÛëžkcÄ8Ç‹[‚ E¾)11VÉ›£qŒNŒ¨~Ä}á |ò$|Ý¢' 'h8&º®•b79ŽxÝ4ò#rrØÅeij6lÛC&…ã§~F ¿Éü^ß‘ÖNFíÒ4U#¶í]HÌ|Žò›|cbØ5Þ-“Œ&Ä)¾•ÕP’Á>:‡Qò±(e<ÆÈ֌ꔌ­³Kn2Û]LOÛ'ÜÙLd>’›N$ÃàìX÷p@Ÿøh;³ŠIf—ƒîr~¶ÄMVF³ô´?1ü¨C6i$I‚g—ìë™—ÔP!9 .ª6<,”ˆYÔ°›Ìîõ­‰!’Å/ɉùã%#†£f¾Å+3“´y%òíqb<.Ê(˜Ø,Y½jVÇP ˜ÛÃÊ]FÁ1²®à­RHS³­Óê¸$åC4,Y#›±<Á¢™$Ò‰©Ý„›CÉ_YÇ„8Æ p‹Nbý#+à¡8F'F [?² |ÂŽÿJŒ»Õ‘o¼ÉÕ§fcbJ]~y 1z_‰xö¼É.ž¨M¼—C’“Ž¹ëïw  Ìõ®ó{V»SW~IæöÄÞ-ײÑ<Ý–˜\O †XU³©D t‰@ dˆl1M ² Ä@6È&Ùb ›@ dˆl1M ² Ä@6Ȧóž+]"˜OË{šùÓù!å—„â¾>Uò-Ý‘ýn Ä ©TÇ4”òbbÄ/µÅ’'RY‰Ùñ—wwÒ1ÍÒm¡@ŒüÑr¶úäœ3¦1ùSví‡ð" [I‘fè]C|‡w†¿L'Äh«µøR–D¬¤˜²†8,‰ $«i\²ŠöHLÙÛYã*¤¸<§…Ò«U'†´µ[’Òˆ¡üHßbVKÐ91 Y4“.•ôË´ŒâËŒcNãâÃ+¶- m‰!—o9¶jÕbdT"3ô®!V"_Îð(Xi•H#FÔ.15ßµ¨•˜bCy[ÈñµOj¥!òeÄ„Õ° Z䛳öá/“N #Y58IDW‰·J!AÇbÖ“‰[Äz;q‹í×zG¼[”šF_ɨRcÓ– w•1À×bn°\øO f\“ˆ^£×óÖëîÖÖÄ„Èuçw†¿M;Gäšæ® 6lÛЙ6&†õ‡›æ® FlÛЙ6&FÌ4Í]+£,Þ„ßÂLö¨n@Lœü9‰ÌGrÓ©eê #À&ÝVÑÔ‰¡ÀÁ•ï ™n@ ‘,þl&‰m? œŽN˜ùf²ÛtbX¹Wæ®ÓÖ%ÔB²R‰©ÙV6O©º1”ü•uLˆcœÇ±è$Ö?NXBÓª‰)uad—©¡¯D<»LR=¤icbêÊKÕ\ΣG·%&ˆ¹D"ºD ² Ä ëÔRÓ_áÕj±?ˆ™ mÁD8 ¦Þ[ÕL3A¿%f:õ!)3A 1~áÅ'_G!Vc$ËÿÔìŸ$»\”1ÿÖ f¹rb"ÚŠ/u5X¶~'§M±I¨c~‹ï¡œŠc'_°U'¦ü±01Ë%—û=”àŒjÄÈ ÒXL´ær@Ìr“쌫F+uŒú!¢–ÆÅ¥V˜å*SiV8*i•BeÒÒ,¤™)ô®×*-î¸3«bµŸ:–2YÇžlÑ‚:#xÐLÈ&ÙôBbð³˜!éÄ$‘œ[5G\SC³ò"Zågœr[¦ƒú¤“>oDÌÙz¥sb̘ˆiÖ p\Ùš‘|aÉ! fL5b’áÈâlŠ‘;“-ž½™3bÞ¾Z ĈñEVÿåφ1Cöžï\RÇå/ŽÄ¯áOºj.¹|¨¦abH#†ò#q¤sÈÝ*1 Y4“³„úŤeÄ|÷ËD¾òp·—rùVº(jQ;1Z…!æHdv%‘<¾®U"˜Bj¾ jÑ1ž’О”ˆI³‹8‡‡ÑñH'22<‘içß.ˆ‰µOÞ!Ž1ª:‚z@¥>OÚò¹™Ù­Ÿr˧]Ü:ŽPlib/‰µ@¼QB_©S:1šjœþÎO·ºÊ`Œ«õˆáØF1ã2AbPíXu;bÊs×…äõmcÕ݈©Ì]—Ò›¶¡3ÝŒ˜Ú^9ƒa:Óƒˆ)¾oa&{TÏ"&ÉåÐhs˜É6ëQį4âè.¥x¨81PY$Æ7?ÇN>yÀ§ ˆäf²Ûô ý”s4$ñã[üg}%âM£ÍÈ•]à‘vØÂޮʈQ…⃼@ dS1äb ›"1'/húgn çÄ@6±VI¼X® óz‰ñÿ`5%ÿT1˜y¹xäë0¤ýÕàåõʈñÿðcügC9+ æõ*µJÙ?Q b ?•‰ Ÿ¨c ¦RïºÇšw«8#ûJòŸ¯†^,Ì@6Ȧÿ áΖ‘IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-editfilter.png0000664000076400007640000001145512173477702022643 0ustar npajkovsnpajkovs‰PNG  IHDR2a]à°¯gAMA± üa PLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}ÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿ<ÿÿš¾]Ï0008Q}¾Ó×Ûš00óûûÛç㺾ÃÏÏÏš0ÿûÿ<<¾ûÿÿÏÏAçççMMMÏÏÏß'/zbKGDˆH pHYs  ÒÝ~ütIMEÒ ¯Ý;ö˜IDATxœímr³8ßCð‡[pWqÿ“ì&if4°Øé®Ý8B_£¡×Öþûð\f”«ÌÐtÈŽÁ_Âï2_:|+Q~‰ügþ6'”¿Íž2ëíi½K¡ÌŸç€2w_æú¬ó3‘Â/!SÆn(öG÷n‰Î.³JiXž{QæÏsP™ígbøKÊpc‚/²?å•âìnL(_ð…ˆ  ˆü¯Ì @e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@e@„ÿµ:ˆ¼B™éé3üzÞ3yÔ]e¦oz§ø{Ûh2¿¥M|¹L·ÕèUä±´ÍÜ/’Åd,¨ô•I~Ëj÷ó5}…qÿ·;Ƭ¿î•’µÛèð¦)˜êg6÷eöj¯çk:0Ê+ùe~S .+3ÝWsߟî۔߭֕Ny“µ{Û¤ô]KµÉ2_g«~6%g6\Ù÷ÏF™ÏHÁT?4eÌ­z“ µÜï–º¦‰É—o2µÁÕºiîÇü|ÌC\uÍD=•Ÿ•wÞ[_ïÊL•Ðov«qIp-§n¿åÖËižü(“½Ò27§§ãÂñ±túœÄšèº4[”™eÖT†Í]{½–Q¶ö4N›ÉŸÙe– î¹Ô•yó˜àãÜg”I†j“h›LÝ&É®ü òÕqB™÷NÁC•±›e'_¡É›ø[þý×iÚÊ×ë­IWÔ~Lš‚h~¨ÚUÆmÎõqhïim2Å&µ¥½øæ0ƒý'ö¿÷–²´¯ß>“>>çl*ó ùŸ5ðûðž)èD2¯à=SpH™9ÃSf^5Ó‹ùØ…Væ»ÕýÓ”Lõ:’;VZú*SZ;®ÝÃ(gë²&—’$—–U_å—aS½§Ìrúë?þ2’ƒ‹*ËD¶Î”j¿¥¶1ñT]Úä4kJiY¼Ü¯-ý.êxP™Ô€åH1ÄûAeâìçé¿Uj®¡c%õ¥˜ŸÆqe–æv5ÿÂB}F:gÜŒ`n"Í´r]-uîYÇyÌ©?T*×Þ‡(ãW“m¤‰›{D96›hÞ™ºvè½lôx¡2Ÿ¶ËœS&ëÐ Ÿéf¥ÖåMNðJeÚÒ/CRÆgÁs@™#Æd§þl]§É NÝ`ÎõKJ¿ E™ä *5CvÓð¹Km²ÌÙ:+åÅsðJeÚÝé—!(SÏ®Àï­ ëòÓ\¹æÔ›–zÝ?óÂvù Ch¯ä“u¼_ú·#(Sv’õG)5§ýß`Úü³ï3k‡ú–c‡6-JöÎÖý[…uM.äÉ,ì@©^HZ?“Á Ñ>‘Ápö ƒtm[ 6u;y98ŠTw?t·ÔDp°ß›pQ™kS¿`’Ÿàcv§§ À.?£Ì·­ŸÈÇ.Ì°­Ìº}ÿ¬[S©ômËGlù}Ô\‹ëÁÐál]ÒäTR²õ+-«¿8Ê/#$rS™E—ú½ŒÖ#uÜò‘D{°f'v¿Í”xO7 “´¡{9UWK{Öq®z©_½¢>CwáøbCW7 ù(a³qq¬k†ÞJÄ&/TæÓv™3Ê„i†zWŠÊ¤=¯ÔÅ&ù¢ðJejét¸ÏERÆgá”2eˆä÷´ç…º¦Iº¨#œºÁœëgJ§Ã}.Š2! •‰É¨ÏF;jp­nùÝ4ÙOG‡W*S;Ÿ÷¹ÊÔ³kÎE]g{°—»aüÉMÍÔëfûÂvõøõ(¥É:R*QÂ}*Ç•)»ƒ©­/Ôµä_aê¦âDr'ÔµtÎÖÙyLçóÔ]mZª—‡ÖϤäB´O$$òÔ~m[+mëvò¢ vxØ+l­Ö”šö{;^þÓ;'k“]X„o²A„o²ÊÇ.Ìð‰ßd‡—¸³•qGJö]áü(¿ åñ×¼ öÀk¥h0ç'y|á7Ù>–Ó/¯yÈÛ¥¡yY>[ú]¸À>ð›ì$–§Â¯ï`©¹°Ž•®ÄùŽ+³4÷9±£øm¦|ÄÛ…¹—¸AÊ%¹¿œª 3¼Z™:ŸÔ¯^QŸ¡Œ»püN±¡Œ«^þMö{)ói»ÌeÂ4C½+EeÒžWêššwP¦–ô8_‚¤ŒÏÂ)eÊÉïiÏ umÍ •Iòô• Y8¨LLF}6ÊØQûƒkuÁ¢wQæJœ/AP¦¦þþ[8ÛíÁ^î†!t²}í©7½ôº9yü5Sjøõ(¥É:R*¯v§â|Ç•)»ƒ©­/±µä_aê¦âD2oàƒoé:œ­›çz j,%x=OÝÕ¦¥zyhýLJNÅùtÖ$/ðMö.[«5¥&‚ƒýÞ¾É~»°ßdƒÊ€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€Ê€HªÌtçþËR •sé±TõóÝqóÝéí2“ùaüpí&û±!Âä«Qæ½¹¢Œ;€2…}eæž2“©^o>Ëlv·¢E— w+xN(3YWf·Ë¬Û’ßWþÚŒ o„Q¦ÙŠþñ7þ–(Ó¶›–LEt‚w¢(Óªä8¤Ì}È°{”“}¬YKðŽl+ ØÝe¸1}RfÊ;eÖ“)Á;ÒU¦¼µ5å g½»ÍîÉuXZ”[–/Á’)°Ê€ÈÿÊÜPDPDPDPDPDPDPDPDPDPDPDPDPDPDPæï0>f£ÌøM{Õ‰F×ÑWµ¥|à{%”´{>ßñ@·»…„8V)¥3œ8¹¥ëzëÏ:ê’÷±­°ÊÄéOœ‰±~4u±ÔxL¤mÃ|?£LºÚý±ž¦ÌÍfc´™1ycBªŒ; ž‰nfcéÊhn…t¶ƒœžÇ ¶Õõ”͹X7¯e+»ÙRmoïgå¶fû¹ãÖ`™2^™å˜Ÿèf®ÝocaqÉ­]C¬]mšžÐ}´±llÒcǬ É•ñú_\J4÷ÂؘèÖU&f]T¦ääæ·X‡®Œ»Ñ¬5ã觵³‡qGÿÍ·|äLH=ej]RƯ«‰º]QYJ£èÛ9ø*eâÁñã?·Ë¤óÙi)qÜ1þìy~ IdOU&z;–æD¶á7¿¯$Ï2¡qrÅäÊdÝ—œ”qJ)KwæM“¨º²:_ûlá‚O†*uÇ<¹†2ñºÛ z+ÚS&^ É|ciÚz’àë”ÙÓš>ûçžæ9zý·»û§÷¶QÏðº²Ä—¸ìí¦}ƒq-“7¦eË5Ï€qÌók(ýÚuȭ玚]»”1œ‡(3ß-¬¨‹U&œÔæ„Ç“³õ_¼-€÷oÑÙeÞŠ7 ÷sàkIAAAAAAAAAAAAAá­"ÛÊLÓË•Ÿ:9F™ï|ÓÂæ†öXœ!k³5J/¾¥•iœŽ<´í|!I³×ÏuŸL9¶‰ªŒæc©#üÿ±ŽÜœµÐa{š·l*óUXÿ} yp~|Q™ïÌm´ÚS&i×Î0w•ÙèW{o•sö•Yל ?§Œ6J?'¢2ýc?¦L‹Ýdæ e¼Y';@«LÝGmD÷ƒ¶Pâ†a¹&¾>¿~½ÿk¶ìa­³q‰µmé0»´{PÆvMØ!a~ ®‰WÆ]ºû~m€åö¶¦Î—Òà}&êhõääCo)SÏÑÜ›a—T»ã¬ë›×{p&‰ƒcUÆl¬ëù(G†U«ÕÒجevEÇÐw²}çhÛjg?‚ÙL.M@aµö"Iûùª#æ<»\çÁ—1ò'7·¹¬ÃÅ;—ífèÝúöÉ”™7”)›Íÿ+{Ǽ¡Ìì” a~7 öD¬¿„ ÙÖÖ~…d»GÕbÆÂìö¶O”†!z_›Ý¨Ì¼7´¢L¦–koöCÇ’Õšë¹¼#ÕÁ\¼Yzf—Ý0Ã>íéžymçƒ=zrTPæùie$þc<á¿^ÈŠIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-filtermenu.png0000664000076400007640000001074012173477702022656 0ustar npajkovsnpajkovs‰PNG  IHDR‚’@P!gAMA± üalPLTEÿÿÿÃÃÃÃÿ‚‚‚¢¢¢YYY000ßßßÏšeÿÿÚššeeeÏÿÿ0eeÏÿÏšee ÿ¶¶¶Ã¢ammmeššMMMA0ššÿÿUšÿÿ²Ãÿÿóóó²²²²²UÿÿƺÛvbKGDˆH pHYs  ÒÝ~ütIMEÒ *ú¢êIDATxœíí’« @³?÷¦ÊêªMÞÿw2‰J7àÁnã=§îMFeàPrûåŒòÛ Fgþm~þ“(8üòz}¾Ï?dT‚ö£”—Y/ü ÄAèÄ¢‚®½vô`IÁ÷ë_›7vÌI4€”Ô® sÇ«UøœZ+h·§±¡Žð)[”¬è B0(ÁTnM·ÇË.G #ºp!„`P‚ùù¹ý „`~;âè,À¿ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0(Á  ƒ‚ B0_¨ @‘èzi/Ct½´‚‚—!º^ZAÁË]/­ àeˆ®—VPð2D×K+(x¢ë¥•ïTðôäOÁàçd  /‚‚ôEPЂ‚¾ ZPÐAA ú"(hAA_-(è‹  }´  /‚‚ôE2‡_^¯Ï÷tG¥ÊÆxóû¾*ãïLv(è‹ä­àK‰—‡YpÎoøß®ñ½UÁ½É}‘ ʼ·‚‚=¸°‚cÇü×Ö 2ö×’ô£Óû0%˜úx<~ÿÏáÓq’ÃÍ?¤ûÝAA_¤® Q ñ¥ò ‰r’‹RøñbŸW*'û‰q}‘¥V°œè3èˆSkßÏFPö)Õ7£ /Ò¢  :BÁPÐAA ú"{LÔؤ  nPpPðC.¡à|kÚT&%Í刾²ù»~¾ÌW¾æzFTºÂù½@A_„ : ú"(hAA_-(è‹  }´  /‚‚ôE*7e¶“E϶·&\;Qe»v¾Ö»:(è‹X÷ß^Q°v°½!TOS; ~b|ßgÞSe+U½ à®ó¬5¶³³ ú"E%™¥°³Év±Î§Éý…ç§ó$ç³³*¯§¼Ìq$Ù¾žÏBMA;—›lëçkÍS2gŽ§'öLÔÂܲŒÏºæ'ÐY5‰U=. ž†‚‚Ãð~›-)l'­ÊFMú´L†ŸS<å dñ³1_>,¹ ô¥  ¾RH[AeBC+X1G+hx¼%4‡-äÈdÇ4|›/ÀQÐ9½‚cC¸¦àBm#.ƒ‚¾Hå¦L2vË·óí²žM_T°0fScÁ!}dqú\ÌIôç'Úæ ú’)ø×a%c½Ù‘òó‚2˜Î>(åçÓ ×A¯xEœGW²tåp®ˆÏJ®à? ú"(hAA_-(è‹  }<ŸÖ' ‡|ZŸ(x8óWtù¾ù_þ5¦dY¼SýúŸÖ' Ï3·JÁYŵdÉ‹Ýs>­O<ž—FY ¾@ÁãùÍ­í€_b½;Ú÷û3šúÅæn{Ž—lOëÜa‡ði}¢àñÜï¦Ö­àÔÐÝÿ$Ô U2ÝŸ ý–ø´>¯¡àÁ_ö»ƒ$?IîdYÁwôy̘&M£ßK æi|ßOëó* îüä„míìV½ÌS%aF¹ÂvÐ(N@WíåH]Á°@A]'`¿‚ãð¯Ö /ïx“|ÉvàXuQœ€¢‚zˆ¨BîúŠ¸4¨ÓñTÏ{Ÿ<Œê‰QPÅ îÝAA]'@Áž `(ØlàB ÞÞ¼¿5éqsFP° DÁvPPŬàëõµÎF¼‚õ¿¶Ë¥;æ¤Éª ›Wø“fáPPŬàãõòôÏÑA©*8Ô$°Ë-ÌÁz™…Ê_௑¯ÞÐÔEqbkKcÖÔ Þ§  ê¢8³‚s«ò½ à;e0˜UûýÇÉjºƒŸ‹r>ZAA]Ï2œB»’H¢L¦R¥#NU² ]ºÖMq¹¤}kÕ¬‚º( úù·¬ ¬(hj6Ãíº‡Sl3ì¬)Ø­DA]gV°Òú4*h£Í›Û\k;(¨‹QÐ Ù¯àø“}ÿ>‡Òº‡s¤l,˜žaÌþAA]³‚¯×äbä æW¢fýBœü`Ö!´ë&éÌyLz}ÅÜÔE1+È(¨‹ÝAA](è ê¢@AwPPÅ @ÁP°'(ØÀ5|ñLõy¼C«¤ŸdbmS~j{m²ñÍ´éókN  .Š™ÇüåG¥¹Ôƒ«$ÏÏt?nc~ª;‹ –¦Cœ@A]¿N_„yíŒF»‚kÑQÐYQpú®“(XÔ/ÉÏ}²î¨Ó 7=»a'OÄì?ÔE1’(¨ªÖ«Jl~² ºüù@3‡\˜HNº\»ÔEq˜ k{‚‚  `OP°ì 6€‚=AÁP°'(ØÀçç~™gí‡ùýè*±ùIλ7?µ½¥;‹É·»P(¨‹bâéßûi-uëöøÛÔÕ‡µ”$›óSÝYT0›;>ÔE11*8ì}N¯O•dùIν/?;3‹‚^ÈF‹Õ¨àZ~†ï{nuQLÌÏj鉯 ±à¬ÔJ~JsÅfwe.xz­Ì%Å¿®`ò•¸Å÷WŸÓ;¨J²ü ÉR/KùÙ©`Öñέêl8 |ÒËþŽx)Þš‚2 VQ°ç¯VuQLü3 &.&éË©uQL\IAs=RëÕ¤#>YQðat|n°vkZ©u¡çQPÅ `‚®ì 6€‚=AÁP°'(Ø ö@Áž `Tpú;â*‡=?¸üwğ秶·t‡1¹£sؽÔE1ò˜ž¬boåv­›Ÿaý<óSÝYT0 EÁ¾Èº‚“)¸ö­[Ÿ*¸û"|$‹»Yå8*8÷´Ûó3œÿùAÔE1ò×–æˆMíU%6?ã\Üîü”æŒm¢òœðôZ™Sî ê¢y s“ççìX©k•Øü¼[°ýùÙ©`ÖñΪÏ) ö@6^ohuzVGšâñîüìUP²Ž7o%û‚‚º(Fþ]“ôåÔ]@A]#—V0SëÕ¤#îlTPæ?2E?_aö¬YQpw~f]Ïúü ê¢8LÐ5€‚=AÁP°'(Ø ö@Áž `(Øl{‚‚  `OP°ì 6€‚=AÁP°'(ØÀ+h×¼#©‚ÿ ÿ¶‚öÓxÎ’W>­OìÉYòáʧõ‰‚=9K>\ù´>Q°'gɇ+ŸÖ' öä,ùpåÓúDÁžœ%®|ZŸ(Ø“³äÕOë{r–|¸òi}¢`O¢òÑåq(Ølà‚ ®˜V8Tlâ‚ VÿTüˆõ–òá úR¨ê\Ábƒ‡‚gä¢ >]›üMPëaL‹e¨uÿòFtŸ   /…ª¶ ¾ š[-vÄã˜Ñ®õ‚‚¾\SÁw7ü—û­((ûé 㢠¾Øª`’ݹ¬‚¯Ñ žŸ«*øü_ &n)éˆÃ¸ ‚ãØN]Öç«®û7hU÷ª úR¨j&è)T5 :R¨jt¤PÕ(((èH¡ªQPPБBU£   #…ªFAAAG U‚‚‚Žª)T5 :R¨jtd,òd‰»Èö4™AAw[›³‚‚¾ ZPÐAA ú"(hAA_-(è‹  }´  /‚‚ôEPЂ‚¾ ZPÐ1 ®'xPб­`Üz‚g}‘’‚1ë žôE nYOð  /’+¸i=Á ƒ‚¾H¥\[Ië  /R >AÁoä2 ®¯'xaPЩݔYYOð  /R¹5½¶žà…AA_„ : ú"(hAA_-(è‹  }´  /‚‚ôEPЂ‚¾ ZPÐAA ú"(hAA_-(è‹œi=Á³€‚ž·8§%º^ZAÁË]/­ àeˆ®—VPð2D×K+(x¢ë¥¼ ÑõÒ ^†èzi/Ct½´ò… µ@A!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`P‚AA!„`~~nw€@~þ‹‚ÊoG<þx»/­ÜnÏä·Ûë}Cì,¨ez»•ãÁ£¼•´ØÃ+õËí±þ2”îÐFÂ%Ð nk¾êôWP7x(xAJ ¾EœÅQÌÛ»UºÝæp-CQÁÒq¦N?9^þ ˜¿´¼™ó«ã#çסǂ7ÕÎ$*ͶÌû cG­XjŽsŸÜIÇ ™Ð¦Ö­`rœ[%?ð”.Gª­T²YîlõÈ- 5Çy‡'­ZÉŸ$¦zOLÏ>ðm¬µTyMgýÞ¢‚YúL¼½ æÑðûøHÁB×Y\P0S:O¨~XQ†ðiUpy,¨ÏQR0ÙPcA•vAÁ4]*&~•± q®|%\¸‚£Ýmð;¾ê1âÝö¤iðÍÜÓãÜÔyà«HÜBSã,°CA;Ü Â{ZÁÆ~Žî–ØÙôæçç&  óÛ?>ã‹æñdá†a|ÙËPKµé`G–Ã-ÙÝBË/;Ù à3l‹ƒO‘ª2­%ÝlyfNepÓ'fm¿ ìcUÁG¡ŠË /Zrñ¹‚‚‚ßJAÁ¿$pþÿ˜l´ñ$Qpz“׋5sÜžÃ_o&|ȶ+ì3#c–Æl¾Æüê~º–¿$¼t~8†R+˜´ziX¢^ïÉS‘—'ï óžÄ³áó*ÜìƆq$˜~>tÞ&Ÿ“g©Šé{ræƸ°…eUÕ¦­_olýjêeôÔôMásc£,Ë,«ðns“f[å3iÞ çͤ<’E“¦pAÁ‘º‚ö¤Ã`µ½¨`‰1¥VPý¿tÞb+‡±¤ ©Ú~ fFuP0ÿè àw° `Z…ú2Dwp#ÙXÎŒµªñ–Æ‚æxE²Íx­$YÕɶŒ‡|, }I{%i‚“ýÅêM/¦QÔûMÕ`v¥i¶Ó+eu¥Zö ð‘0WÄ™ƒ‹WÄ2 ¹"v UpÄÔÀ‘  SPpã”0@J­ €#??ÿîsH ýž%IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-gstat1.png0000664000076400007640000000412512173477702021707 0ustar npajkovsnpajkovs‰PNG  IHDRãH‘‚‹&gAMA± üa-PLTEßßß÷÷÷ÃÃÃEEE‚A‚‚‚ÿÿÿ}}}Ãÿÿ¢¢¢Ïÿÿÿÿ‹|àžbKGDˆH pHYs  ÒÝ~ütIMEÒ öY¾žIDATxœíšQš£*Fgé÷qîÂÄ0¬áBUhÀh:éžäÿOç³ê‚vç×o4þùõï„Å°Êó|ÑÏÕR/óOÆôb\ùrµOëÞ2PþÁˆ^ÎF9í)~:¬W²('Ó¼M=v?Ù¹éå²M“Ø'w”ó†ÊŸÅ².£ l$¨Œ´r “„ƒgIŒËA—‹Aâ¶NI?ƒÜr(Ýëy_dQN†Ã•ZÁp/ikZmå6׳¤{â‚7ZJy'Y+>í'”=¥ òxÀ [å4œì³”a™o‡½bÈEÇ­„¾r®3•½QÛÏ7Bg0Ü£UÖÛ'$÷ë±Â4uB[»½—E›Ð`·¹%€þ‰–šQö›ï“•­vïå(evJÛ.ET¬¼µy[¸½Ò$¦î‘êÕäæò¹—ãm–Ÿ¨±u•G¡ö0e¿ˆVƒ™‹rwšY»MÛ*/fy/—é+„ð΂Ñ©§||`ËCÊc¯ûʹÑFY¯ß)Zå4v‚ÔÃÓW^Ç­üˆº‘O6íÜäŠÍ]ZçèDm4,œ½—[å÷äôôõþÊ÷ä†P> ¸òüè_ë÷_FÎífY¢øPù}°1+Ò(?üŠ¸»2>œÛͲD›Õ«ržÃ-û›”Ó£ãNCçv³,Qòƒ¶»z!W>ðX²Q~è/ö?ªÅqï÷X–õ±ûZ¹ù§Ô ~R9ÿÒ´8‰ïJ,¹ƒzß]yªÊúÐh¯´qo­~{套uTçíÍ4¾©â Êß=cKhfìX”mãµB¶úŸ±u‘Ú}º3cïÝéÝ;.÷Ëô”׊Ë|êuJWÉ8Z[}Q~øMª·.ëÐýä׊þÓ×G¿V>c¿*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ• 2TF€ÊP*#@e¨Œ•h”%Æ)ÞdïžëÛW,W^©»1H ¥2¹Ml[*‰Ò+p0b/±(wNÐã0¨(߆aÛPÂ:,YL%Èmâ: i²‡fžqQXJRÞÖض-;lO ëJþe6þÉCPSH%±7>®\kî*‹Ö&aed)vSñjÏ %È ñ„eä{Jª»4½Qö`Dš_=msuÏörþ S{×æÝz/ký¹¯›ÄISª ÅÖXru«5, M‹ˆ^ ¯Ç•µ:ݗ'œ­r;•Ð«rÊQD5í¦U¾¥Õ6b”åÊ‹ÇV äCŸ5f= šâÊ‹µ6­‰Q•½Ñ©éµ 5¢ª|ÛoòŠ²¬=÷•×ƒM6ô°Ýïéiê+—û¹£\îÐåòövž¨åÄŒ­í–J$4W-¬ìº‰{ʾ„•ÂÁjNKÓå¼.íô5‰O›éKï‚0[—Ka­³Î`1ÔeÂê/ÛR§ßeuvz;°}úÒÃ%N»¤naj ¾*·ÑíE~´è.a°¿Ÿ8æT ç”ÿV¾¨üñÀ*§Å:䣼º6™~¸ÉÝ,ÐÎ|ÍŸ—öX+‘PϵiGk¾ÌÛ3_ÊF9DÛñ0£¦/ʶ³*SH~UÑw:ʹ†èÇSU®Åçg(Ýc­×:QVÊ~x_yIjÈý«gVåòü¼”û^e´ªc=ÌŽ7‡é·ÿyNŸ‹n«òåz¹ÎWK¼¦Ük*ÊùQ6?v®”—³¾S9hFÑQQÿK®§æåÏ<çs˜y{m•Ó&ÚÇ•ÕÑzYJåi›ÎŸëEûæ^¶»Ì”c´C 3–\:–›zvÑK«<Ï.íd^zYkðíf`Ûé¿ò4¿·r´¹eQögUÛ×\;¬ÊÅë²x…vÅnflØÛðuÊS1tR•'›Á¼[luö©Û¦¯«ïL6ùxbšŽòô5•É*Ô÷e»¶ËŠ¯×%—O{¯7nÞ¤B¿@Y§V‡oÍ]åҫ÷&)ÿFQùÔpÅßIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-hw.png0000664000076400007640000001263512173477702021127 0ustar npajkovsnpajkovs‰PNG  IHDR3S>`6gAMA± üa-PLTEÿÿÿÃÃÃÿÿ}}}‚ÿÿÿ‚‚‚¢¢¢aaaßßßÃÿÿ0ÏtÇ*xbKGDˆH pHYs  ÒÝ~ütIMEÒ -Vú€ æIDATxœíIÚ«¸†k U¸›`Îrj ž±×û0ðÌk¨XdÉ Uõœü ÂÍÛ–ùëŸn²ýý×ÿB7ÉþßÑhÆh†d|dô³a©Õ ¯ÿæqÓ‘¡øû‘f ùU‘Îbk4±O ÃØÑhÆy@OgS¢"œ€ÿ ½ÕT­& š×›±£‘ÑÀ¿Œfîhª[¾;TkúÃ:Õ:Õ:ÕT4ÎM>¾NðÎ;'Ÿÿr{ý/ºð~õIuºèINùCÉ…Üøô• •Œê°vÉïÖžš)øͺHÙo¢ƒ+— O.>_§ÂKOü0£]è[»xú{Ê”.¾Ì~á:šôú.--¶»×ß^ìS%š…Ëëæcs÷j*/è¹ÓË…=K4ü!¾óBÇ®ÐÔ.¾Þ‰ê°J¥x7AUSm7 ™ˆgüÇOSMíBYzn‚R*¯¢à±ìY¢ñ¡8}JÍÀBSmƒê°J¥Î¶ð,и…a½&èQçKçd/¸ø¯Òe"jE…—©ðéü-¾šS&’ ~Yñ³ªÔª¨ð*•âÇh^I¹5hûñu**µöË=`á29;%•‰›§Ÿ’''…ÅW¡ÞEýÓ :è*:šÈÍeO8h¢ÉMf?WŽv*Ÿ»^®Wú¦ñh|îò“Ž&]/lA†0£„‘\b…A2NïB (1ÊöÄhâ`‘5oª]Z>1ƒh€v ê>Œ­†^†â¡¡ó6Wte{b4Z6¢I/cÑ¡hÀ\Õ;ÐéôŽ ¡>j4!5Á1s¦l/Œ5š™Œ†mf—hàô%š´ áhÆÀÒ7}H‡ ,úÎj®_êVÃCmÕjÂEÐäžÄïˆWä ÍÀcM¬ 5%¾xÏøB.ðNž—cMÙ¡’çYluËÃCäCßp¼xÀÍœv…Ê­†nùf¼åË.«)³±H ³=ï-_·Ò:Õj4ÿþ¶0粎FµÍhP(³Ó²\@M™@!P]¦òE898knÌ‘.»Ð1µœô¡—&@ 4Q+qÞ“,?——ƒJ/Ë/bÁ£˜'ë„›\ðL“‹å¤éå4Î*UÃ%b{zÚ’ ªP›·Ñ°‹òýd4b*ñË×?Œ¦‰ç/Ÿn¢Á4äï»v jÓ¥Îöi4®Fw‰š¤óÇÑ4Ô¼ùrGÙžö–¯[ij]ØU­£Qm#š­r³êBÇ\Ž R˜Ê)‡Ð.„.¶8ŽJTË™âձțÐl–›m±…×(ôÚš7ˆÃv!ÀM™øMRŒœ —ì-Í{³Ü|Í6ÍÛDã¸ai§oAó¦°KZrC‚ŒÕ&ñi®¡ÇØ:V¹¡C™ ‘L²°KI¿¦ŠNß%–TŽIÓc¶ iBWº¸Ñ9,‹”Š7Ш=*o5¦¬/ÁÙ‚fÒsHièh¨?aYÞDcdyc-Ú^‚Zª‰ÆW(B£§B×7Ñ´†á°q>ŠÆÞî:`w(5º2ý .W3/Þ¶æ½y_S 5ïÞÖ¼I(¶åfýV*ð-Ÿ}ãØÔ¼ÍÈ[Žx?ç Í[º¾û´a ¾=ÙÏË®y_Á:Õ:Õ>­y‡4Éɲ My¦—YÜÇøš÷<„"Ü;¤¹ôü"OŒß_óQÌLZïR©…«:‡›kÞ$üóþߨ,ÐpG{˜æ]¢1^Â5ïMPÐŒ9ŸGiÞ 4ØÌšh¡y¯:”ܽ¢Õï}‰î.h4á=¿ÔvÞù¡ð.Þ–(6¢Ñ ‘ÑÈ‘à¤y“ó;h¾ËgÅyé­}ì£b—·@]…Š=uoó"Î;Ÿ ®s¸¹æ=¦6ƒJ„æiš7T,x7 !ðE‹z’æ]´š¤ÚmˆØ}‚æ=–ÁÌðÑ4мh¤&øä8oêRð´‹÷ó4oR¹QúžsÔ÷ú–¯kÞ×µŽFµ.ìªÖѨöNìå7åæh¼³øÕ⼿,7‡$v›Š‚•Ãq—qÞß•›¡DȤæW†­õ5¹9ZbrE4ß“›£%4§ KmÄyOnŽvn4vj_”›£1›ÿmÑXqÞŒ¦qí¾*šÝrs(4ï9wÙý<ï¯ÊÍP2ÜÇå··|=Î[µ®yo°ŽFµŽFµoÄyçòX ÇĪy×3äðé@j ÚÕ¼—a©#»?®YËàš÷2,•1š9zœæ½VãHÚMjïc5ïÔé€KÆÕ¼×hè¹Þ8t^¨ÑÅïêhªySRlsôô‡kÞ«VSŒÃÔ¼Sœ7 ÝÕX3AëPOмSœ7]–†Üã9åªkÞ×´ŽFµ.ìªÖѨv-Í6‡óI×Ï{;Î;œ@ó›4 ³lî?ç½­T_—è‚Íeåüâšw´c…€ØØ›¢ivÙ6·Íé5ïð+4G²<ì²Í- ètE¿<š lZhYüÒš7œÞJ¿Qü>ú<ïpÍ;yÃ…pFßã¼ß¶®yo°ŽFµŽFµjÞë -µ)‡;kÞëmPÕ)‡;kÞü~Ë”Ã5ï÷Ð5šÄyS@÷ ?šDîP7×¼Ë8ohiK’4óu©kÞ×µŽFµS »ç°ŽFµëÅyoÒ õc0KvÏ8ï6:³0mïåý†¯çm&ÑØ¿Q@å{A ß×¼ï&„£9òäl<úê²;Ðœ#ÎûŒhŽdyØeš ‹|ìB8Úôý†hÚ•YˆXй>ŠæqÞîk¬B ‡u4ªu4ª}AóN]âaÜ+6I߬(¬sx„æ=ó.©–bËs¡OѼç$%€2—Ñ<]óìPcVꞬy‡¼·y–£îèÑòÛDcÛõÑÄc.4ÆÃ.‡æP‡¢'À7ÐPþÓ¼¡!ôš¤y“÷¥4oo<¬{ƒ ­ðÚþB¨y{ñ–ï÷Ö5ï+XG£ZG´§}Ôhürä³´‹¡/µ>cÜzÑ‹x¹Â0—JÑá#þõà¹PS.Ü&4.úOÕá@¹‹6ÉÇšh<ÿJyå&Œ§W1‡)edx–% 2µïS&Ë$ek¢QR¢ÊL1G±dŸFS¸D²Mð)ñW àWX|¬8Ó!ÔŽyŸ'CœÇhÍ nÎVÝGÄÊÀÏMÌýõê±ÔwRFŒ&º8Ó“oý=Ž±†T#G5ò´€oY¿N!Äi 8Íø†n%7áF„ä·“Ø¡¦ þv«qœµäcJ9ð阚âé¹b4ƒIS‡":}ÕcMÆR u^˜?}ô°œ;|Ÿ·F³¨yùµç4ÓÆ5ˆ ¾SWT˜2ZœNðáÒHásx¸Iœ<ß\C@“@q ¯2Nùm˜ä‹w¨ sté¼Íê®|…fÝjà$-ž&G½ŒFñäweÅ*4>½Ä9ãe)d4!75.jXséUqâój4«S7t¨ / e! ì™Ò.*Æ°l2Ø#6£¡V3-«/¢qÒXãËU5¨ˆ3/ÞEb¾€áŠ^LBóÌÝ+WÌç±Æ×ÃÀª~üI :‡É: &ñ E{ä¾úõú Eç–_ íjÜòQQ!±âº“? ô3»’ì™ß¹ò;wSº~â“ïÄ+TÝjö[ûŽâ¬füFêhTû š[Ú Íj6i=ü|ÂéÏ¡És¢|?—ÌÓØÚeé™lñð°añš^ž—ÎY<”þQ[¢‰ÓÎu;áp¼Â%í ¬Í’× Ñ4ë£>Mñi•°f-,ü G˜EUØÅ ìiÏmøÓñäšlÏ?{òºtÞ–—…ò†´ŒÅ±?e%€‚:í^ïˆïeÏ.´æÀã´EHK iyú U ·ù2šQä§cAg1Š=¶~ÛjB…†‚èqé£Al1zN®Í«iK4؆Š…ÆÅ·ïÝŒ‘ yn†×“ÃÏÑà2‹ oHî ÇcRÒg^'Þ@CcÍ0Ök·áv(XT;ü~¶Ðà’ž ý$Òy|M† ý9X²´@ãÓà ÔÕ 4s^–¯£™e4yu{È ­¥•êÔønØÑÃfŠßÓS†>d—@ârzÎ]¡Æ2V*"àmAaû@ã4Ýòñ ’Y`£+Òüè …ÅѤ%i…¾·ý]l#ú† —Sl@þU{¡ù§›ljÿ. A½A¸IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-hwsort.png0000664000076400007640000002305612173477702022036 0ustar npajkovsnpajkovs‰PNG  IHDR4UÏ…SgAMA± üa¤PLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}ÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿ}ºÿÿûA<ÿÿšÏ0008Q}¾Ó×Ûš00óûûÛç㺾ÃÏÏÏš0ÿûÿ<<¾ûÿÿÏÏçççMMMÏÏÏššÿÏÏÿšÿ00ÿeeÿšÏÿ00ÿ0000ÿ0e0eÿ0š0šÿ0Ï0Ïÿ0ÿ0ÿÿeeÿe0e0ÿeeeeÿÏešešÿeÏeÏÿeÿeÿÿššÿš0ÿšešeÿšššÏšÏÿšÿšÿÿÏÿÏ0Ï0ÿÏe0<ÏÏð±øbKGDˆH pHYs  ÒÝ~ütIMEÒ 0,çÝ” IDATxœí[º¤ ’…³Î |éç@99FÁ¤ûT¥ÂZÁUMóë«Ú¦ ¿€ ™ÿs¹õp¹\.—ë-\®94®a14‹!Å:æú%É–æ/ÿ H¤þ{ЩùmMAãúmµ¡Ù;©½¯rh~^]Ð<‰ yÌsO^]o"lTðO±Ïrý’Š-;“ö–mìÐü¼º¡©Ž]¿¤!h¼{rý•ýp/íêž×_ùk×°×°×°×°F¡Yÿê¿›´oœµ&¢µ­ÈV莼P›²ì‚.+lÍpAÝJ¯ JA¬sÝ.†æùÇöX“ {«ŒÙ´²r ;|G^¤¦Miº ß ‡áx=VÚ.¨Y1ÏugÞ¡ÁÍÕЬ¹AKíÚóø@'U„¦jeM™«ÌÄH^ Èž‰­ï‘ÆD¤’ (Õét» ÇJÛ5+æ¹nÌC³â>þYÅEдgCS³Â…¤ô‡òAdtóÚ pÐti¥¡4…–¦é‚š•ZiÛ.Ø¡Y¼®É4ùÍt@ÕØAÂ\²"Ø¥kæÅN(ŸZWe“TsA¥¢\ÐMÓãÐ4]°HÐù²´;j/bÚÇ¢ ÚSa›VLåö´;/M2cÙ”‘BÁ=Õ]̧0 ¹`š†/°€»/…fµÂvçEøv…å˜5ÜMÉ3д]p  3[)4ÿ.öTRé‡ hD-¬vôš L+ U¡)Zi» f¥VÚº B³ýy¦‘6O¬åæÁ‚l1ÍLôå…‚¤úO‡ÀGÄ˩ùšŠ.¨[éuAÉŠu®Ë3쓆š´ïÔë]ðéИíÀéå.øxh\¯—CãV š…fvvMïÄ@°Ü¥ºF³hx›oZÛ­ìGGò!ð¦#ä)HiqWZÍ{e;lÌJ¶³(¸þC™î–i¥ž(;Kf¢’ô™ÊµØ Ç¡Ù¢¦Ê[á`¯RùÐJ®Är„=5HÖœ$[N²»Ù“ÉvÖ:Õ‘4Ý-ÓJ=9!éöKž\JVlðäéÐìl¦üN¹JY©_ ’…ŠÇ½¢Ènf‡çQB“/Öƒ—rH« 䙉êå.P>“ñŽC“¬ªvt¨Q.X©WºrÿÄÛ´WMU]_SÐ^g=Q°RËCêP ßåLÔ‹±'køLÆ;;¯ž®Z©¹ŠúàBêyQ-”L6{³£ÐL{´ÒMÀ?–C€«b²úê *^ šnl õ|14a+é*>ØjiÂ> ÜCÎA³ró~¬¥…&(UÇæ¬z²h:»§Ý M0]5Í3ˆ M¢²¯8À˜òDÉÊ)Дó¢Ê.\ðhjÙë·*®ß*WñÁF^ HšÁðšbLy´*žV¡ƒåhD[ëÐ(Cðß¼º‡  ôwš þ¾j»®ƒfÝÇys©•4žÉ›•¬µW·²íBy;Ò.ÁJ55ç‰a+2fšÏux‚RÝ] âÍ×j”û/”å‡Æ5,‡Æ5¬ß„æðŒ¼ßžÒW‚fÉS%C§Ì‰å¥ÈU ä0¤f§Ü8°ñ`•(Èb€i‘º•ÝE—Öò`»ZÞ[Ý“¬…ZƒM.V0™ÑQ-‚¦¿¥¡îBeIòNдçdt–‡kuá64Ë2µ–{+¡¡ö  )µ4Ø^,ÂB!»É´C£k j݆&,ÒT šb-š4f‡3eÆS%*48Ò †ÍZv›ü h õlÔ¥æ㌵Ü{ UJÁs£EÜæê†#e&Ì…ä 3`^"f¶Ðƒ*/©æý°Pµ-¹Ô|0¿íKwIåÙÒ$[T«ù dpAa·£7*s Û÷ `šó"½% ò ôñÌüæk„êí ª~^? Íñ*ÿif|Y®k\kX'@#§ž*y•+ìøK ÕhdÑW «д­¡Íoôfâ|hBêNy 68¶²îðJÅK…ÍþÔs2ÝYŠ”³ò2M¿#óùΛ¢›Vàܶ¤ D¼ ùbÖöÊrCã–CãÖoBó–ÓaÞ2S¦JÐðüÉ®ò4gÍ‹†ÅDM1m“§#/"¦eUMžÔ•5;`[NG~-oehðÃË¡SÂq^v€I·A3²´¡9ââK«§ß89öå“Õßø,¢‹6Ϛݞcþ4ÏÏeÉT^?Às÷̓Ý^ Œ¦xÕè4´€¬pÎDÖ²q£ ­\Ëd)YŒxè^óœ¢ò®+à Yö® lÝy7*£K÷CˆêÔíEàÚÃ@û?ÎRýœ.ƒ <·XA$IŠ@®üÒ9m«Ù×µR­å“5Ð=|[€&09éx½†dô •ÿU á,p å©èà‰:WpGã\íº Ê8 /Ô 4Xx Fš§g ÷KÕ Ù>Z«8ÇéIã˜:¤A5žÀ´ Á³'Cƒ¾þhðœ¬uš°HS%hj#hŒÚ«Õì4¹¥QÅ2œäeДÊðvÐk(P±v·Ñ¹3Örg{àí%Ÿ_ôpbÉmÒ¾á²A]O£Ž¦±P‹È¤Š`Ι—¨ ð5£þB5îvDz`ÍÁÁ@5c_äɹ°Q—_ š7{¸˜+ª“ÏqzÂzNÑe a.L‡OQwOä”Ò9Yò8ù¡mVô™úÉ×K3WTGe ×W9‹«~^? w…öé×WàÇ0ãËr[Š¿¨†Oš†î®¿[ÔðÉyÐÐ<Í™IŽ‡¬Ð|Fš)I“};ìà”Óð»ÐðüÎÞ鞃ФÉÇ«5yÌÊ:l…'WS­;ó’“ÝuwýÝ"˜_ž½ ^ 'C³žͨMËšWćµšÕ¡ù'±rá2h’5¨øqÇq+ضˆe Þ= ÉZîr4X]sCš#VRÛFO5pw×ß-2 éÓ cCCØé–fÖ 5G y~ضÿuáÿþ–Ž@3.¨¨Ù1Í+¢f+Ç ¹ùº­lh p4»ÝcÐÌZ¡€fxLš@ èáÍ9ÐЕ> ͬ•Ü§éqp…nØÉÉþ÷SüIhr—n ‰Ïƒf¿žk«†{­Œÿº7ÆÛ঑ù¿›ø›Ðì· XÙMá_Xöêw[tvKphªŠ?%‡¦¡èÐ(94 E‡F©MšŠÙ;ƒ­c†«¸hXÍ …‰½˜AÞÓF`‚hä”ÜÅ¡1T†ÆtcÓákš¼š랎X1¡ÏËz34ÝA®±„Ezð’1ÍahYY÷Þ [™A+uh"ôRØ{n܃ñ¹X²Ûº¼‡oïÅÁχfM({¯²’â­[7s*4{­ÑŸíïïáéÜãQ ¦d|N—|ÿËÐÔÆ4;6ƒäÏ eH/…&û œ˜½Nîžn}¸'žê{DøÜFûálòà>Z6"@å« ØËwJæ98x4»ÏL^2¦ùé–æûåk¹+þ84–š†¢C£äÐ4¥4i*¦˜Y‘9±¼™ç¨[çÅ R1ÝSü2N æUÍô”¢G‡F© éƦÃ9Ö444±Ž¨Ê"! ’>â”÷Ž2PôèÐ(½4ðÙˆÎ| 1ƒtfŸ£¤ÏÑ¡Qj@Ãëí™˵¾[FS¼Jt*õ›y#¡á•]³`Í84Ë>ª0˜5O`p«õ¬Q`|Ts¦VáÀ(†¸ÒIӋΙUÚèÐ @#ýYí 44‚‚ÉŒŽª'°}I›ŠéfÇ)¡ Ñ¡9 R ÁhC³,'¬åÞ-µŽ@£š<‡æ4hðœ¬uš°HS%hªÝÓMoKc–Ö¡™„¦PÏFÕh>®XË]à#Pܱî)Ÿ[ü–{š%×HÈnL{AÜBÖªf3ʳ¥I¶2;9î(”wò†‰Êùýh\›¢C£äÐ4¥óW#|™¢C£äÐ4¥« éþÑ«¬à*K{þY=ÝýcdhþüUÑáÚ^kb¦1½#ÔéÚç£ç»ºç4g,a9d%Oq…Í@º)BФ?–jÐ4«û ¹aYîýЈõ+cÐP²ñÍ ¹\÷A“l×ç@³/#È+x‰„ŒjMC^œRˆ¾§Ñ/QÓd§u/a9 Í cšY+ëþݸKr¾¥‘Ë¡èÏn«ú(6JtHâšEÜ›4„Iç–k¹Á÷‡õnÐÐ@øñà†À€æ*F†&ÿÉknÍ%xf§uÍ‚§M4W/–c×ßcEsnKS”YëƲ¶}ÿ‘WQf¶RÇS|‘ÄK af:Ç4u#3ûBKÒh¢gAcwOÏ?¼æ»§h~І/PZaYpH¸š;™Á¨SÏip!s„F.éNc˜æAì<¢]iäÁ3•Örg?¾šá«ût+g<Ü3Örס‰â~iÛ‹p7ô<‘ïžösØg‰èDÛãqÕÊÿMÛ-7,‡x¸ç²ZšstÓ#˜.ùZîãŠ?%‡¦¡è/,•š†¢C£T‚fÉS,ƒ˜/YRs&®¸h˜&"=—s‘!Ë¡Yœ¶¬ ©½æÞ†©âÉ¿°±_;zµ>kY®8 “|Õ4s²²éäó ¦£jij7P7ÄŠæ ¡Öc¯3hìpSH¨¼éfx),ay4÷èÓ×r‡´®„àd; ‘ݙʮY°s yçÚ¦>}-wš¹ÌÄ¢Z¥G¡Éßî…¶©O_ËmB“ì Ñb‘[†‚Ä4ò-wj>tä]_h›úôµÜuh°-; jò¶4tä]_h›úôµÜ&4F^úÙ©µ4fiÏ‚æ-_h›úøµÜ¹s"٥¿{¦ãQhÞø…¶©_Ë{EÌÀqâÖ†RÁ2ˆœí1¡©‡{|ì_h›ò×ǾFx§G0]rhŽ+:4JW.aù Ea©äÐ4¥+ Ù;çXw7g…¦'âOðŒéZÂ"eÜmç½GéL£{qwÃïro œ2?xÂJžÖš7σƒFJ«þÝp^–ûþа÷/_a¹žÍœc-²íÄÛ¡y±îü‰åƒÝÓœ±Xgú)Â-ú¶ýÐðÛjõîš ÁÇ5"äÍ/»ï€*ê4“Veø+zÓ#£ŠÆý¢Ã×æ l~õÍî~Ù}ÇïrÃ¥}ša++,Á…–fpLCÉÆZK#ßr[ï®óëIÎÆëæ—Ý7ýZîqhf­`YçÇ4”lÓÈ ]ç64¹›RF¿š<„=M^=ͽážîéù‡;žÒ@ùû¡ÙÒ8:¦™´r64Æ Ë4#k¹Ó¼,Œw÷Ëî;~—;ä‡%‡¡·ÂOõÄ3¾Q+æZîê@xt-÷ó³ˆwóËnÿ]j-÷¦×Ï{è¯å>®xå»'ñHæ-äS#Ž+ú K%‡¦¡èÐ(• 1æç·dN,/Eæ9êÖy €³7Å$ÑŽéž<ý¸]œ¶|Þ÷Ÿôå£A†õYËrÅi˜¬ç‰«M_ Di­‰åÕ;îî–‘šb`‡¥Æ7…„j›ŽpiŸŸ£‚¦vÇ]«ÒŸ†×Ú3šu™B“V#8äx4œl4X2]³`h*íÌè[îñÞ9$¼?W¾–)™XtάÒFùp¯æðî×ÏÓü ø!b1ÍwV'Ë×rù0q¶Jk-ÍÁ·Ü1¿Hˆü!GW¯¡>¤@‚цfYîXË]lîð –¡MsL#ký!Û‹¼?ºÀû3¡Ás²ÖmhÂR¨/ÍD÷4ÒuÕ¡)•vâ{zþÁM¤î)š> š®úÚB¶ IW4n¶³LÍso·žÉ.Í[î^hR 2ŸÓ\ú僟)_Ë0ÁÊÙ|¸÷’o,Ïñ¸ï:IþḢù´’CÓPth”N_ðmŠþÂRÉ¡i(:4JW@sãZî}Z{ž°¹M{jÝÓ65³ýt_žîè®^֣ݼ–û4SVp*ùnDM‹î3S€¦u÷õC™B°Ú~G”ËtïZî3–åZÐìóÊÃyKX~š/ËÍuvša+ š=ú<4»âAhÞù…¶©ûÖrK×¿È .XI& )iÆ¡É㻽Ð6uëZî; Áú>Mg÷$ßr§æC½.Šð—_d"ˆ‹Ï„fNyršCVN€&tB£¤«7¿Àw“ïñBÛÔ}k¹ÃQhøž¹?^Há÷‚7éE#÷Eô᧠Iiëž&­lŒ04÷ÜÙGz…å84oüBÛÔk¹ï&·2y÷†îUÖr÷<ÜãcoüBÛ”¯å>(ÝÒ ëßMšòµÜÇKMCÑ_X*94 E‡F©1?¿%sby)2ÏQ·Î‹¤iÖgG^ÄužîÙŽ‰Ó–­»§cùdÈY}Ö²\qZÌUO“ć 1¦·cR’ñŠµÜ®ª9hDû ¢Ëµ]9±æ·cÒÄùèÐ(5 áõö̃ì|{οX`à ¢‹P´ÁÚ6e&8»fÁLhj‹¹ùmµzwMÐX¯°ßãe÷§¯åÖT²…MêÚÊ<.:gVic?4òmõCÚÃÑ«ot÷ËîO_Ë]O[ êQR…†D–é4$Ê»§×rÛxÝü²ûÓ×rW¡c¢7åªÕäuA#eAsìË¿®!®uš°êËî8º¡)gÉd¼£¥1K{»{zþÁ·‘…òÇBS«(p?tehÒ›í,S“Mn!Ó^q,fΨá[äÝS³{¶,¿ËÝ€æäo,7𺘛_˃ÜYr괻̀e9Û„ôïrW¡¹è˳î».‘¿F8®øãßXnÉ¡i(ú7–+Õ&–_U¥ø=/,ÿç©F(‡æ¸âA˺š£K¹oµ¢WGÂÏ éO-Àyêèãþ†‚†|&ÖÔ_Íðúéw²‚¢þ‘°f•¿šŽÁô(4ä³ë—åšÉ|”Z¿‡V#tz{h^½–ÛL棬t@ó'þ[” èx®TØ~|n y/[Ás±Ì¿9·† h¬χDÓÐ<½Â+Bš?1½ðþ#Îí(ÈŸ?"ä0V†› Ã3ÂÁ–&ˆ4°ù^hžíˆYÝ "CAöZÏŽá8Qx­xŽÞY½šCú^hª(XÐeÙÊŸ­1BMå鲉A¼x6¼%øŽ@óŠÅr?ÍŸŽ–F2ÝSVXܨ-ø´ïž Þ\ñá;n¹‹k¹w,¨Ahdc¤ I÷îÒŠªxËm°ÓÓÀáÇÔ-·õ5 —½{ú†‡{Öïr34°‰°Îû¡žíð9a…Eo¹wBô¤â‡¦QŒÝ=‘ Òšøäžà/,Ëj­åîzjÓÔ9VÚšzàk¹'«ïžjß!ѯs¬4õ‚–®Šßó²OÍqE‡F©MšŠ)æEVdN,/Eæ™àÖy9Gæ11´ºé-N[vh •¡1ÝØt8Çš†&ÏÔnqæº<رéeØžXþíú,hhò÷^gMmUAǦ£\ÚÅ^ÂòíúôµÜ„‘´dƒ£ÐXÙ5 æÐŒC“ÆÖŽˆš§:QŽJãÀø¨æL@C½hpd&}Ð*mth 1ê¯^'f÷Ät¾ÀKí€ µ4ÌÖ<4f!ui£Cs¤@‚цfoûU•J14¥…sSШ&Ï¡9 <'+ц&,…ú2¦· ìmil›Ñ¡™‚¦PÏF÷d¸–Ó›í¬ÑñPŸ±ˆñ0†ìØ´ IA)½èÐ @³dH ¢ª.8¸…¬UÍf”7fK³ÛÂ|{L¼¶L+g{P@Èî@ãÚ%‡¦¡èÐ(]´á{%‡¦¡èÐ(] ýæËAI©oyXáèL²ñG¡yíïrçßu»cb9þ7þLØÜÄòð³Ð¬/ý]îÉßÂ.ص‚©½cÐP²ñ'¡yùZîTm‡5ƒ@ûM·î„æŒ1Í Ðl»M·îø]îÍ-ÝÓ5Ðü–Ž@3­;Ç4š}ï4¿§Ÿ†&ßx;4#údhfÖrÃ-7Ä=´–û÷Ä.¸åžþ$ö)ÖÆSOcªÜÆÌ=ÜÛÖrÿžØª.hi¾H¿ÛÒ  ´[‚CSÕÝõw‹>qh\Ãrh\Ã*AcÌÏoÉœX^ŠÌsÔ­ób¢fšÙÙ‘9E½³A–véöc*Cƒ^žÎË{sbMnÆä$]Jol8º±æ¥“‘H˜0|î‹÷[j@Ãëh!€}£Û«„Q\õPŠ.Ba²æFÚ$h¬ìšshJªŽižBLÀ Ü„´fˆ£Kh Õœé_tê2ˆÊ ÑÉéEçÌ*í)^þ2 tOõŠ*tO|A—ÚÙ{t¥‡­õ()H³º´CÞü B³ÈŠ‚Cmhö¶?´F=Ѐ1Ñ›r %€.@£š<‡¦¬ñ–Ƽ¬) ž{‹ßåFrË-YZ‡ÆP4µŠ÷c/P„&]ѸÙÎ25Ùä2í¥ÇbæŒ>¦ÉÈ5äÒr·æÊj>ÜÛ«+9ôó~—›mCDÎö!gÆ’¿Fp Ë¡q «6±ü– ¹Þ_kX—Aó ?ÝsJ&nšø ‰Óòä^3þ»Ü³ËOÈÄ}SìSêÏcÓýWÿ]î1+õõW§~ª•½£+ì9¤CÓá$hÎi-ç¡Që1& ‘ñšR„³ 9e\v¨¥¡òôeF§×;¦ñßå>#·¶4ù%Ð’C3úùV°<üªô^±Xî \5oå‹ ‘ÝSÿ 7§Çñ.‚æKn¹wwö-·Ø ¤gÅ» šS†·Y©-džHüŒBLÁ¥õ°¶½;=ÿ]îa‚ìgËrCã–Cã–Cã £U_fV†NF„Y?EôIDAT”éýkWFÅÇQÈÅ}ãЃ 1 •né|úAÆä‰9›¶}qdTÀ³ É÷ŠA3ï84«4²ªƒcY0²ÔiÀŒ>g³A>Ò‚fÜ“64ëîÓŠÅCýÙqhZáŒéÏö¡~Q4²ðvÐSlAr4æ½ÝôüZ½5ßÒç ²ý-¤ ŸØØ*7àpzo»ŸÉKÉf^Ö5LC³Rô=×f¡U‰4ûf·Iýd²,êH™6*®Zmhô‘:.ÈG C=•‘³…ñVŒùl)Ç[SSOôœ–ÆÌ ™¾.ѪÎYÑÇlRæ!ƒùDJ*i»2AcÄ h ÅÂC|X$ùrp-®¢l²UhŠ²ÝOö, ©ÚÒUºžÈí2ØŽ®G¤ËòhÊÉŽA#²üëЬè 40^´'­p£Ö'¡YF 1“E|»â€æë¹á'Â;ÐdÀÞš«Ú„†CJ+DŒþiÁ*Ïr>¨YJ²±ðýaµå¬–lîu0š‘]‘¬ïëd½F€Ö !Bým…ƒ¸>SgBÃW°m…/r×Gêárëÿ Éüi ÷-IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-ipfltdlg.png0000664000076400007640000002124012173477702022306 0ustar npajkovsnpajkovs‰PNG  IHDRƒ“Ü2ß pHYs  ÒÝ~ütIMEÕ 1âÙ IDATxœíÝÁ™«¸šPî|Du.“Âsoé ¼ì<)L.·Ö/‚Y0MS |ÎW ÆB‚ß2tÇ£ù¯Ö€öÇðêëëÝ0ð™ô‰ ¥?–W麮ë~ÿþkxýçŸÿž,/O¿µÂÚ–DàœrûÄC ¾ˆÅæíú4÷KÚÚktz°k%w’;:]d5Ç=Ú?ÿü÷|´y>ô“,Ü@…>ñïßÇc&ñ¸ûy88Ä=¼6. À]Uè—vUçëÇíÐÖà®vÎ1š6' €Ïä÷ÄÐ’H -åFâùä©ôtªüõ‡qéß¿ÿšŒQ›±Àíýz<ï÷»sßihÁè4´$@K"1´4ú=ñ«].àSé@KÍî±Å…=þk4…ëªÞ˜Ÿ‘DžIŸô‰)4ð¯¿ûgju8µ×ÏóÞÇ‚cí¦Db€®ëvþfùڹúwúìÉè4…^]÷ ‘þà@ßséõóçú±tËaEíp¼p>Pkä‹í?¸0'ýt>ƒÛ¥}bÊ ‡tðì9j‹Í±tŒŠs¤Òv8î’λ§óh7|vÞžƒ¼4ýD>cÛ¥PŸØŽ¡[ú¦<Æ¿Sçlhß85cÆÖµÒy+JŒ Õrª¦{ªÌÜÏßí'>:mÈ‚E¯JÁ¸ËN!C0Û[ÑÐìc+l1%jËq´“Ÿ;×è4…žç8A@C†v©J$æÜbߪKts‡ö6nx‰`¼wûÔþïeôTÄ÷ßOEô qÒJç6Ï\ó©›ÝÒÅ`s§ÙO¢Q­k‡‹Ó˜çÓ§ƒ¯»ŸÇËêôó·Ë‘~Ö¼H ÇúgN@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K´ÎójnéÙh»Ú3{(mÏúÄÐÒÖ>ñ÷ã1¼þz¿'KÆË·ob’Nl9xþý•ï•×§8Ûú0–h?ý[9íêù³TÔt'+óS1}ÎfkŸxˆ‚Á±Ø¼n™ËÙÛøØ~fŒÂœm}ÚO, —&RÚtcIW¨˜>'dtš2ãÓDÎálëÃX¢Ë¸wCZ ÃÛ³áBN1ck>Ä|+½¼_òõ~ÏG­'+¯^|Ž½¿Ø]=}*Ú±Oüýx Ñ1½f?Ž=ÊŽ}<¸|üññëaÉd¥Ë™(=Â϶> žÏþÖÂÞ–D&YJ§ïÒïìØ'ÎïJC]Q^ÜnpYÿ]¡_|y;¸¸«!ªõqn]KÌ®Ún}·ä“j?:=ïÅVì1Ï× vÜcË+= œm}83íù£|úŒ­Ø´¡iŽñq‘xèì/ºÙuåàrzãi ±ŸBŽ‡æš¯{H\Îi·1«Ûs­ëÓ4ñëñx¼'DûÝ™·ûÓwöÈÚG¾à`uÎòü ØæNoÑ·‹Ò;!4\ŸKhx·ËØ3æm~%8vm8§Ý&Ò_qg¢ôÙÛr{þg·Fb>vÁÜwš;)Ä7: §"@K"1´Ôþ÷Ä\‹é™Ü‰öÌè@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@KžOL™Wë pK­ž¬=³‡Òö¬O -­ï?]×}½ßÁƒK†…óåé·ªØ;ý¶›;Øóï¯|¯¼>ÅÙÖ‡Áógÿ¥oBÏP§æõŠ.—þêôéŽþz¿‡•ÿÖÞ›¾ÁæŽÔlýQ÷|.fg[Cãþ7¡X[ÊocÒ'ÇŽ£Ó_ï÷-»ƒn|d&¾Ÿv}{½ö Ò'Ç^}âÒ±Ù`÷q²p2\8î‰Î‡ÊKs_L—Ðìì¿Å$¢ŒS\>~7¶²ô?Är{þg7Eb>vÁÜwš;)Ä×›±w"@K"1´ÔþÎ\‹y‘܉öÌè@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@KžOL™W£íîýÙ»–‹´»î÷»–ë®ô‰ ¥õ}âïÇc²äëýÞ’•ïÇcc |2í‡už?ûq¯Wà­×á}Líù£¬ï­äëýî_Ïcs¾-Ÿí‡uúXûzýÿ_7Š¾Ã[Ý,ZïM{þ4F§¦Æa¸I0æ£ì2ckò…nÜcþz¿‡wç=éa=rÅ-%ÚO°™iÏŸ©B$FÖqëé/xô1x‡åóOA¦Xû‰µÃyä¼^¯îùüÑß\~>½H¬=¦ ‘¸´5h=ÀIŒG¡û½Ð5ü=±x œŸ¨ÌÌØ€–N‰‡kÉ°‚öCãùÒ“ì#iÏâ×ãñx¿ßÝx¸¸Ÿ¼°ÔìÆíc2Ôœ˜;\ò)×gvÚ»èÍÛOÑ\ÓÓ–‹]½ÝÙC{þt?ãìúëĉv|k1¾ Àl1o?Z9Q¶áEbíù£œnt>ŠH -‰ÄÐ’çSæ®32îZ.ÒîºßïZ®»Ò'€–ô‰)Óü¹Ô±_»ݺ<ñ“¹Sýš®Uf*nwûí‘MnþÛÈêís1WéôƒOq?g’ÈaùŸX½ÇÝþº }bÊ´}.õø¼¶e»¥¿Ák¥Ufjmw×»R !øÔ„*í3acóÙ…áÞù姈»ŽÔ"sIÁ_[ž*ˆRÑ$nu¡¸Û$cUq9'£ÓTsðs©çÏŒ‹-œ¿•Y„uéo'—®‡ùòtâ±€´˜ŸÃ¶[ñ9»“bë¯ÆEûkþ‘¶ùŒÝÖ0§þƒO‹Ç¯ç(¯ OÌJã§Mw?‡ 磅±5û¤2»³Ãžs--–ŸÅôc—ŸóÓ ®<ü«ŸF#÷ËNÛíßõ¹Î¤}.f5su‘vR]fþù –+§þ3ë¶û÷fô‰YiKvõKO‚ùgXÊýF‡i)«;ÖlFÒ†«l"§\‰¯°¥I –/t"1;øȬ²¹áä’“`­9eã®û«n¹ŠŽ£¢ã…žÑiXf¨íüìš*ª´sÇK)‘˜SøÞù9¬«ÓÐÉeµêû7xùó¢vƒû%ÑÎcûqXîxYgýó‰ùL± ™Ý웇‰Yš±wWl:ggzýÉéÒ¹ ¥é¬Îgf–ÒÛO㪵ÝɧrÊ›S„tý,¶·t§&ÖÏÉ|0ŸÝRÍgæ?–TN; †Ïœö_eÿ~¢ŸqV$†ƒÄÎÚ[ºD­ºS®ž‡}qI?ã¬Ñi¸*aîÁÜi8ÂøŠfp|õ;ïþ½­†þ 9žSiûáœDb8Bì,yüϲ×q–?'ûåŒN@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´ôGë À©½"ËŸ‡æâ8ÊÛSÞ{¸Jyõ‰ ¥õ}âïÇc²äëýÞ’•ïÇcc éÄûÛ7±k>·o·bI,W¬¥¥·Òþ#ÕÛíñE¨RÞç³ëºîõš¾n¢Ïÿ¤€_ï÷¤\Á˜¼uBóý[žYò^Óú>ñPþ¯÷;vÌçÛòÙµöÖÞùܾÝkµË¾\ùGWiéÆ­tþb{»=•ál<—ݬ¼“:ÿŠv‰òΛeÙã·‚ñLy/Íè4ÍŒCÅ=§ÃÌÏhó¸Û$cMÜ© -îÇ{sðiå©?ck>Œ8Š}J¯¿by:«™ë¯Èg:¡ŠC‹·;YÿTÆyë«¢Õ°ÿåLj©ÖøçôiûñÓÊÛ«Ð'îÏ¡Ýè¬Ú…º;ã!ˆÉ:ó‡Äú¥ËÙ.Z¿4Ÿ9õ6yLdõv‡Àö!_*KMÚííå—w¸BÜü"ñ·Ü¿ãsì„ò^Z…>qۯ䫷2釼;û­O& l ™óü_¢6ü–p‰ú©¨¨¼¯×µÃpwßý{×!Ød®»–wb÷ߟ¹¾†`Ü ŸŸyÑ46Ò|”O;õM|úŒ­›MÀƒ&}öã'8]$:©;­üàŠ`¼z»ŶÛ*?œÄ¤ Tc8É°VŸ¶u„z¿Ç{r¡´¿ØÒõ¡üßhßJ¼»ÇÜéÅiÉóüÄäç3ññàOÓªó·üzq“T¢ºU­+±•ñú¥)œónyùõ³®¼ÏQñþ×ê¼n¶ø›‹.£åÄ´Ý¿¥ûq~¼Ü¬¼“ 4W/oÊÏ8»>Ã'8åí)ï=œ·¼?ãìéF§ࣈÄÐ’H -y>1¤´¿žt,å½7å='}bh©NŸxñþP™?8ÙéÇ6óì%64ÿ±PŭﺡuN’ €Uç Ýè<|\Af"gpX@:Iä;I6>ÖÖH¼ØÅt¢/úFÀ§ÙwÆV?à<NÜc2q£¥n6¼¼÷°jâ.W“íæÜÛ+}»±Åt9Lç''ÿ“|o8ÒŽ3¶bqt›ƒÚ±çïÆ^' «Ešà `çù‰-'¬™`lŽ¥“Hd¾~pábúßžg ÐÂŽ}âÉ=B×I¤PÔu ÞÉ9óSã©dóü|>ç8ÒËé[Í3 + Ðľ£ÓÛOî‹)?‚›ûª÷œãÒ§G˜õnÎïˆßB<ÈR€‰­‘x1ü¬n½Äów‡ü|o{Îñbú'Y€Ôy*bæ=ÒwØ(}þnW2–[ô©Ò9Ò9s§ƒëO®^WŸ;“~ðk„kÆ;ò|bhÉó‰àq·ê)¼»ægûv×=ãÒ?R*úYð¾¤ÁåÝ+$ç!éz8§íåºVyc¶”·;e‘¿#Í<®»È”OXØÎÒ'Þû.¥{«Õ]/ò·»®ý]÷F`¥Oà˜?V$¶üŠÆ¥N©’®‡sÚ^®k•7hcyÏ)¸g»ò'ßÜ`ÿ%s˜;5ßíÎ|ò*2?/7ÍN5w-WÌÆò^®~Ò_ >g¿¯ZLì&M+î™5i…ïuUZ®¢ü¤Óùš=*}ã­Û½ô˜óF_…ÏÂû=£ó~”ëJ/¨]·~ÒßB®[®ëûÄC Ž–Ì_'Fƒ,¥£‘¥£‰rågÑ°Ú86ÏY½Ýï®ðPü` |G“õiÕ«‡«KìßO+o£ÕQº³n¶÷}>ñ~‰¼•ÕúÛ×ω[Ž™yyO^Çã̯Ò_5žŸ}B±©1Wo'‰r]eÖR‘å½n{^S¯¾'v¿N|éÑ’=ÌG¨¥tlà–»à®M+Q®[Ž ­(ïE÷ûº¶«™±ÅµÅ¥á3]åp˜\UlÆN‰KO¬{Ÿˆ[è¯znI¡Óôoç–ýÂî¾åŠÙXÞ«TT,ŸûÅzÓSçB§çÄÞÝcît"W1ùùI||>ñj’ò<.–Î9ŸO‘ f ±ð*Šö{l—¶„sÞ-o±tÁ ç/ïŠrMÚÿµÊ³®¼ƒDÁ[•·èÚvðÐ^Œ/AçÜ¿ÿä Êó‰/}Z‡ç=’÷¡¼=彇ó–×ó‰à<ÖGâùÏd€RëOlP¶;ѳ˜à„Ú_O:–òÞ›òž“ëÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’çCÊ+²ü*Ï=mE½A>}bhIŸ˜š¾áõ×û=Y2^>kX^=Kã”ûNò°Ó¦ƒ™^·­ŸùvcYZÌ'°‘>15 gçà‹ñ9}“åu·uç©Ÿùv{±íÆò l's[ã"l¤éàBCF§iãëýþ~<†¡ãy·l¼fzyÐ8 O¶u {×ÏX¿•`]]¨ÆàºDb2ĉñ8gÒïfádüobË7fæ@«³íÞåmE®ëTaøëýîÿºmmfþÙÒôëkl{&‡ô×å³nþ·J$¦šZGZor¤U_V;I®«Ê×¾Øa8®±*‘rS.·mw`ltš:&-õûñ«Æèâò` ‰´ÅѪá³éMlÚš§Ÿ¹Ý.tHOÊ=+]ž.ÂÆõåM$’¿_rÖÞMœ:W”7]„ütbùl¥ÖwèÁ uúÄì.qÅ7¸<¸pü]{þ½;‘ød”ix=}ª2ÄK?ö:‘Ï`ycë—.©µ~ìõb½Í×f&VÏãüs²±~Jë!gý-kØVÿ·:êé§ú†üÌÛÃxá ‹éìtÁHŸ˜š×™2—7´Ó16qL‘Woe2ž±=·¥)ìtîŽ%U·¼Ç4¡ùÇ_Ô¾«Nñ‹¥,éüûb­l$6ÜwÛƒñötŠˆÄÔñ;¿üÞ[§ú 21§®^>WÇãºû%6S«¼gÞ­u%Jš®É«WÑNù7: Lm¥¿–—wãhíŠÍu«ÂÕÞù<¸J‰Ä\ÒÉ«êJË»º~‚×ÞV¤srC1וwqÍyý¶Oe2Ø0¹6¿ßF«¤?Ng1ÿ7úëñx¼'ƒìÏ®ëºîµ.A>ÔüzR7;a'ÑÌ—w?ÏqÁ?Y\r"KämK~bU1Y?§Déw3Ë•¿<–«t~æJË»˜H¢Òû. ·ÔONž3Ó™Ÿ©K×Og£z:ÝR}f&Ò…ªhËÄ‘œýX+ýœ“OQâÿøgEb¨ì„“Ñ>ÓUvÄ~ùTǤ¿ÆÏ8kÆpg<熓Ïó×CO=¸N 5 ãW7¸ÈwEã߃v'>_%ŸCŸjrJmî*»à*ùä"1•<Ë_&&r:Œ2: -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -y>1•DžC\úœN€O£O -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐ’H -y>1uDOìùÄÜŠvÎô‰ ¥­}âïÇcxýõ~oO'?‘ ~|luŽÏÿ<©q:ùû%]ó”Óž£®Á+Ö}¸…IÍäWÔ÷㑹Zÿb{ó8F¬2Ë»bãë?½¿òw_߇¶=ùÖÙÚ'ÚîƃmÅÇkmñëýÞ~¦8>ÿƒàI$¿¤ëa|šË1œ’>äÜÔ×L~ýä¯y•œ–_Þ̤6VK,?¥íüi0šª>qtºno¸­-§§Ìz(=I}5Ó«ò6¦b;Œ9¡ú3¶†cf>¼6iå9£¦±¡§à““~ìƒÃydq¬mþkY¬V ^/ ¶±ùGbëçl·›µ½Éñ¸â8Mä3Hiy+Ê9ÐVŒ©¥~Ÿx8Î'±m8'ËWž˜rÒO|pžÿ.Mæ¿–œz G_‡óKó8þŠ3~½¸ß‡ë¬éK'v<–§é|‡RÖ•7ßðñÄ%êÉòZQÿC.¾p˜f¿bZ}H¤û‰£:öÁq·`¼$½¡ãó_K~=#j¥v’!Šá ~ù(U«¥ 6 ¡V;½ô‰©æn¿'NG¸êaµº½sr•z¸®Ä匫Ëù†šŸT¥L…-¶sÁ˜Sùˆ[ë.³Ýz`£.lW廩Y$¾\ïþŠð“Ó­9,ÿiù§ÅÕaØym±ý»w»Zmœ±Áxcy«·óŠ„í~=÷äÂO?Þ’7%!1M48=düÙàÜËy:ÝìjÐâòq:ß‘ êùe§æùÏ1?‰ÌóSZ±”cúö2¿³Ç]GïrÚIð*æ$žuñv;ÿ7½#bígïå]¤ýOÞÊI'm{;5ì‚0¹³Ç]Û9{ùg·Fbè¹ïi•Îi"A;§ŽŸqö#®Ài‰ÄpgÃøídL8¶8ÞÝ~ÅŒùÅœŸHL®“ñ ´sö`tZ‰ %‘Z‰ %‘Z‰ %‘Z‰ %‘Z‰ %‘Z‰ %‘Z‰ %‘Z‰ %‘Zúcˇ_ÏçdÉóõZ\9±Î®¾¯÷»hýþÅäSýò̤b‰¤ßÊ1¯ü.¯n_Ïg«]°«Òý4®ÕI-Õ[~kï×V›ü{6-t\Ÿ¸íÉe8ƒ­ßŸnJ?;–8am<— õù|½VDˆ›Ù²Cìës\W¥õvÚPº‘ {؉Çñ`sfÎh~êùz¿Ox>ºkýfÒ=¬>ÇQÿäb`'›F§'§ŒÉ[p.ût3ôJçb“иç:Ygüñù:™ÆëGç‚ùI«Ò‡ô§ãsúóõš Î{xÁý5YžN¸P9õS´<Ö¶ïߘt½­¨Ÿy"óå9rê-q ¬«`?¿ÇûýîÆÇ[BÈþ^žˆ¬±k`¥Á¸›Pæ'šÄ:]á9:Q‚I¥ÿM/Ù9bßx‚cþVpÉü³]É.ëwÊä­Òå™Éæd/(]Àà»éúIGÜDRé|æ|Å1’Sÿ‰-e~ÆÙM}â˜Åo÷ý™«ïÉ{‡‹ÇyìSßÇö3ÅŠ™ßÇ­~"wËVK¤0‰ ‰ý•S ±‚cÉ%¬»H¿øÍ&ó¸HŒ=¹nýà ÔÄÁNUº˜t¶¯ämó³ýÊâb à ±’Öšã–ÞÊiåì‚à(E7‹Ðý[¥5ðáõ—æ÷Ä÷q×yÑ­\Ÿ&jÁǺ|$†£»¼nÁxý½ós¤Ò°Ñ_È_^K¬~J——¦¿h2Š«„íõ3ùÕÙ¸‹œ?’4¨ÕÞjÕ?°ÂÖ[ÁIC±™,Á9º éÙ:ƒÌ)<ù7%HÌØJLO ~$½þ–I[‰;{$flu¡ÉA‰¹Ó“5Óbåª2w:±|¾õœÜ¥ïì1^žóØ»ó5‹îì±X?ÁúÏ<ŽË»ä¡øg+̆c˜µ ÜÄÏ8{ùÑi¸4‘˜k˜Ì¸]~O Õ”îJŸZ‰ %‘Z‰ %‘Z‰ %‘ZŠÿžØs}`¡HìŽÓp£ÓÐ’H -‰ÄÐ’H -‰ÄÐ’H -‰ÄÐÒ?¿'ö+b8ž>1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´$@K"1´ôÏó‰ŸÏ†Ù€¥O -ý±¸ÆÿþW×uÿûçÿÿÍ×p°"…›ùýû¯?ÿü÷ÆDƵšY¥¿ÿÕuÝöM—*-ïÿþW•FÒ—·›9¶<‘ÎöJKl´t¿dægõqWT?¥•Ùm®ÏI¹z9¥«Õ®J¥Ûa°=äïßÒósâ¼QT?C:™[ÜGm¬ÏVŽë•Þ¿HŸc8,7šÔêi•–·oUIìð+:,kí¯Zç‚üü¬>ZZ®íõ9.׊Èq¼&í-hˆ‚ó&QZ?'?í v­Ï*ŽˆÄó½+7ôçŸÿ>ówÃîç÷åÏi$ì—WéUBÂÜÆý>Þ§éŽfpÃê-?Ÿÿü´<:3Ôfz€"ç° ÅF32·; M.&_”úåÁuÆoMÖOowØh0‘yâóõëš'žØn¬¼ézË,oÌx¿÷{yq¸l¼‰Øtâ#i‰üµ‡Ì­ŒIÔs0?맴¼¥ù_]Ÿ} ™œ7&ç‡yÏorn¤ÓIHä±+¡hÿ¦Ï´‰wÓõ³¢æ‰äçs¬ôüÜU­Ïƒ­ïû)8ÊÑËùî3*ÉùΞ³Ý a—ô/†½2|‡JŸK×Ö™¬?þÊ6yÝýl+{Œ¨Ì[a,Ÿ±òÆ–'^Ë[·PÁ’¸b\žH|þº´=,n%–ÉÌöSQ°~j/Õë3Gç±98 ;ÿÄ^—–·K¶·×’pË3IDATàñXºÇ'ØDw(}ŽÕOi=lÉçXÎyf^±U곉õ}âEµ† 2gÛñ>èƒÍÆðvÀõ†m%]EÙøýû¯ašCf_sݶææG{¢\‰ÜÆ0ÜPºþ·‹Õgº~JÛÿÞëw?»k«-véãkþnóöVë<¼îbüâÖKë³ÝäL{Eâ]¯³KÛñ«7T1‡‰¿¸•Ù˜¦cÃ~£ ízÆY—`é§ö^¿w@˜VHç°I`˜D¾qYªŸ‡s’ ^^Œåó„õÙÄ.3¶ŽÃì¤ÊÐ+«©ÿ|·œ‰–/vE¶èM‚êGâ¢kÙ©ÙVÒ×!Cge£ZéT7ÎXz¸(ÿ§-o¦Ãò¿GýWüŠ\k¿—.)=Eô3ó——:ìü0™áØý3ëaË0ØiÏ?¿Çûýîºîëë[)vs€Ä\‰üDÓÏ—ž,ï2N.‰¹v9sƒ ço%6[?qžÍ“)½³Gp+é)W±õ'Ëó¬Ò¹w§Ìæò´yþKÛC¯¥Ä~‰¥_TŸƒ¢F«·ò_TŸ‰;{¤Ïó9À‰¹Ó“5Ó—y{K5—ôôšDésÎÓ¡‹z_EÇuo~‚Šý;^žÚ9G¼³"qŒQè´›Í)`»\'2­Ä‹W>Ü䪭ÿ“Aé4ƒÒäø£ëºÿüç?­³êÿ°œÝßIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-ipfltlist.png0000664000076400007640000001010712173477702022513 0ustar npajkovsnpajkovs‰PNG  IHDR…–án+ pHYs  ÒÝ~ütIMEÕ_Ý æIDATxœíÝ=rë8¢PzÊ‹¸ÞËlauÜ¡B/Há'i¿-Ì6ºÊ™÷îšæ£ù"©O¶Î©®j™†Aø‰ íûðòòòööÖ9§ÿ½¾¾fÛ÷ìé_Ÿüøá*®íããÙõ1ä=ž/ò·÷÷Ÿý맧ßG[†ÛËߺ@_ÛšJàf5\÷Y8ûb)¡×;Õ¹_ý·ãzõ4¶·ª¾™†õê&£ì^Ý>=ý>]ž.†×T ßÃ6×Çïï?‡«ÊKF©Ü}¾1<»èÝ¿¶R À7¶Íõqëeë´üRÜöÓ®ŒøÆöZ¯®1Z¬öÄwËï@ž<€¼†<ž>ZU~ت¾|¿Rýþþs´jíy.îÁÃéß[<ýûNþ~5\Ÿ¿_ 7A@ž<€¼O¿|<¦š÷ëùÙõ1Üy yòòä1äÉcÈ“Ç' O@ž<€\Z¯†¯l×Ï»«Ï/áúaWÛ]Ÿì³^}èºã`‘jؾ٥¶ã¹×ÇÏå—ê)l‡{Ð4/†§KÇK“îì|œÝXS¹³û…”Ù0>®ú”¹Ûõq?‘fçdå:öRB/Õcœ{Ö:/†'ŽéIdzNév:¿f']ký…v.í"f}X=,®+ë- FòÊϳ5;êÕwŠYÍ-»lÖLGua½j+75•nª1ܬ‹'ÂÒsˆ‡º±·¼ˆ[\¯ÞdÞ6Šä®º†úYõâû™Õý4\*°Æt+˼f?åIT3ö–î"íø|õ-LK g±VªüD{éûÏW/Å¿|{…D?þ‡¡É{Ïó‘/mç0îºîáåååíííõõµëº?^Ûv\ߦú碃½~#ÛóÕÜ­Â ¿l^œ}Ôyúˆõìëîóü½¸þúýÂN¦ã³ügmFjÆçç‘üññ¼[K&yü-Ö«à‹“Ç' ¯êïe~|<ïÝøöþÿ9­ ×Ç·Á¿'ñë×o§ÿV®£0OߪŸ}%KU~jTx¶=Ö_(9­¿u¿…òæ;5†Cè⡲öúx8sFcZy¨ôë×oMé‡KaÜZIëXªjX`Ãú›ÚߺßByóJýL\ó¹mUkÓ¸—ÍÛ¥ò£³dk{ RÓp*\>î= φñÊyÑÚ³°´}øã­¾Íw®àï›TÜ MÎøg£h¥[¨ÿ²…„UÍ‚«Ø&[O"Áòå[_#Kg‰ÎZ¯’ûÿVînM%£&•ë_Ÿ‹Óz õ/ít4¯Ï¶Ó|ç:6xžë ña™+˜=}?<ü{iû´Ø¯_¿¥Ãg—jÊ—+évHÑt[ÓÎÙ O–êo}(lÃvÂe¶ÉãÖ±)_˜Ÿ{·‡»²4<.Ȇ¯e×f7õ̶ÝøE_νÜ?¾l~nµŽ5¾tïjÛ06¯¹M«òxöw †Fã>U¾p©\ÿÊòPï #ªC5ókÉÅóâ‚çœ/ûñËÒ×|çÊÖ®W÷·»ººÁš*_XB,Ô?»eÇSà¤iD a¿eXO}³•T–ý:Ðt^ÚyAýÓÂåú ¼tÏ~ZÀ|§R?~Ö<|PõïûûÕ°^!gïåþ1Ü2y yòòªžç*ü{Àz® O@ž<€·–JΦû&Ÿ_Tîh¿öÀg›®WOƒ¶)§¯£)’à*Ö­W'é[X—žþìèõaî[Ýç4=´ì¢f׳;-´çÖ>jðemt}|öFrÙaaéû8Ø2JâÙטV^hÏRyX§x}\õyØ3œ 5¯¿BmmvSy @…<¾ çö[¼­ù4p™Ö+ìÖò´¨ã÷ ï&óø¸põ¹´½µò®ñÊu“ýÀ²uy|œ¼¨ùîÒöéSZý–ãÂZqëoÂxXÿtºÜt°‡———···×××®ë~üxM·îÎÇÇóM®WÀ‘Ç' ïÓï=W÷üìún€<€»€6ÜÅÒ¢táGÊ ío•{VRèçÙölh¶Zßokû/îÏÓ7Fç‡éUàèÜÒ+×SPhÿÙq8Û MÇ·|¦-|·Ü?ôô’úvµžŸ»MûóúV]÷GkvÝã¤æsÐpñ¤æó{Í~gõæô¢?6ýç©ò9ºµ|_fT~øñmôºûÞ¶:_v“þìÞ[û³Lî+Läz;æñ®wf]çÀ\íð_¼£ [X÷g÷²²ÓµÄrBì·¢´ëyç² [jïò'W›¾@¹…‘xåßð½l~®©jö†ãR;o°?SözžëúaÌN6YŒåbú¿Þ·|N­ÞÒÚ¦ß}º¹°d—?LŸ.<_=*Yvv¾LÇ[aÖ¬œ/åÇn ï®ð\zùaé¦k°¦y}2=A-}9,?­í6×À?>žkóx‰ué²ï÷Ä›ûøxÞëþ1PoUŸ½qçFw;`ɪßw²L]f™€JÿËã¿þú+Û¸c=v]÷ǤÛwí±ëº?ÿü3Ý ¸kÿâ{-$Rù¹IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-ipfltmenu.png0000664000076400007640000001120012173477702022477 0ustar npajkovsnpajkovs‰PNG  IHDRƒ“dŽèºgAMA± üaiPLTEÿÿÿÃÃÃÃÿ‚‚‚¢¢¢YYY000ßßßÿÿÚššeeeÏÿÿ0eešee ÿ¶¶¶Ã¢ammmeššÏMMMA0ššÿÿUšÿÿ²Ãÿÿóóó²²²²²Uÿÿ—ó©bKGDˆH pHYs  ÒÝ~ütIMEÒ ´¡FÏIDATxœí’ª<@}Œ;Ãdþ}ÿ‡üVm!MÙsæÞU*Ðnz,²zûËíß –7äB0¥ƒÃ/¯ŸÇéI…S °3¾Ôz‰8ãào!ÂNÌ;ø”­±ÕëE€=˜u0ý|ŽzùجVØÇÁR¶a:ö–.lÇíòx~X®°•ÅJuˆØ„hp¢ñ®Q7—óÜ„9 ì÷ê „hp¢ÁAˆæáàÿÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„hp¢ÁAˆ!„h¾ÑA&Ñýò)8x¢ûåSpð:D÷˧ààuˆî—OÁÁëÝ/Ÿ‚ƒ×!º_>¯Ct¿|Ê—:øìÊÓÁà1çdà`g-8ØÁA vFpЂƒ´à`g-8ØÁA vFpЂƒ´à`g-8Ø©~yý|<êœ>ËëMëú<¯¿r³ÃÀÁÎH=¾œx‰X×ü–?_ÊŸ:¸v³ÃÀÁÎÈÊ ?÷àÊæcós´$²EJÇÇaÜ`Úéý~ÿý?•ûQ»›žè×»ƒƒßAã€:ëÓö Ê9ÑÅR8|1•OŽ.«×‰‘;#sã`£Xù3”+ŽXýž<†AYç`Ôá;#Ÿ8( …Žp0ìŒà ;#kTn,r°8\àà0ààF®áàtÚôMY>ŒNš9I9¿Í<çÄÓü×Lj¤Ø®Q/p°3½: vFpЂƒ´à`g-8ØÁA vFpЂƒçÚÌrªÕ«å¥¾«ÈYöêûôâvF¬ƒë¯¿qÐÛÙÚœ·¯>üÄ8˜.8¯é³7}=ãàªzÞ · ›óìŒ4u¿ÂÞ¿PËÍNoƒ”ÐÈëQõÙû+¯¤/³QËRnï•WûÅÁÓà9hïëªå2РԽ8³¿òŸYµqŸYròk]AÙT³qQd÷‹ƒç¡áà0¤yà’ƲW:h¶×ã :×+$”jý꼯> l¹ìLÃÁrº ÇÁB…ÆAGÒA«Ä=YhvÛh‘iŽúOÃq°3rzóPøÎÁ™c´]qìŒ8×fÔù[½\?µ{¨NòìöMçmÅùà SÇ7Æ´Iùª‹–Iˆƒ©|³ÔùÞ$I;Ps³ùÒÎ ÔÓס¨¯9/Öû)ö+Õvíræŧ¥vðσƒ´à`g-8ØÁA vFpðTlíO„­líO„­líO„­líO„­líO„­líO„­líÏ‹8õ•Á!õ†biœìòŽ¯økãq3î[û7ƒ‚ƒNlzƒ‚ƒNlzƒ‚ƒNlzƒ‚ƒNlzƒ‚ƒNlzƒ‚ƒNlzƒ‚ƒNlzñ¬÷–Hßët¿]”FœqÐÄ"Ô±˜0Ÿ9t…ƒOJëOÛºßì'/Þ6îv^Ü·öç5Tsp¬„å8øú§üUåeËF«ýì¤ö:¼¸oíOÜDåàËÃÌÑ=4©öƒƒÁx±PÄ:ø<ÐŽ¼Ÿ£ÙëÉ í±åyåb µŸÛ¸Ê`·Ž´Ò‹ûÖþ¼¸ƒ]ϳƒ£CCéÌmÅ8fʯ›cp9êúŽ½¸oíÏ‹;x”{E½¹&§JY¦\«B]þø×=ÕŠƒ]ðb¡vÐqGwS¾ÞA»Ú1xqßÚŸ8¸ Ô±PXíÇUîegóÚÌtžqpö|ЫçÔû«å·8¸ïœ®Q÷tðÉ㵞¯& OZŠér;VÚý75/ö\ÅÁ½yï`7¸W'8¨c êX€ƒ‚ƒ:à à ŽEä° :±é :±™n‡æ6ë­q«Ÿ¾¢\ïð‹ë‚ƒ /÷2oæ¸ü™v½5Níåwãˆrq§öí &¼XŒüš0~mfOs½5¾ƒå‡ƒ_‚‹Ìø]]Ìõã÷ —ÇÚú»¿¦áOƒã¹Ãx.áÌ;ƒƒ /åàÚïÜÚÔ'3î·J÷ÄŒƒêûˆƒÞCkÁÁ„‹LºL·ö{7÷‰®w‘ƒÓ‚ãà4âà¹ðb‘iŽGúdõ8øÖA»Z88˜ðb‘ÁÁÃÀÁ„‹Ì%Zߟ\åžõ¶^,2ÓütœTÕU çBz¹5'1ë割ºÆ>nÑ~ì&¼XЮwÎóW?^,Xíàw+ˆƒ/4ë­Ž¬ªü»ÄÁŒ‹È›tbÓ tbÓ lÅ&ß2“””r`aQoc÷ÍÚ^ß’Gˆƒ /#>NÉ[ãâc®W—õV©Ne•ƒÃ·äâ`‹ÅHvÐÞkèà s¤¤åàwäâ`‹ÅHr°é_í±__¬¤‘ë: z²O´ïcA£úÕÚÕÂÀÁ„‹< Lx± t°8ïKEõ¯óÁåÚ¹},8˜ðb‘¹Ì#l_£žæ>ã\HÏîÖÁõy„Qà`‹EÜ«tbÓ tbÓ tbÓ tbÓ tbÓ lÅfüK—Ýò y‹ù£SE©ÂºúõÓæ Zp0áÅ"S]«)o`ìÕ'ª^ëXU}y ÄYïtà`‹EænóRjŽsP ‹êÊåÖ 8ø-x±È¨Ï¿òòîs08ÞïÖ1þô8xÂ|A &¼Xdž£`ë~ñ„½§¶OŸLgƒóÇâïÉ´à`‹EæuZV;8åõÙ„”ú$ƒJyÿ|°|b¨óõ†å“³æâ`¢‹S8¨Î˼Àéô¯=/þž|BL4bq ÿ8˜hÄû€ƒ‰F,p°8˜hÄû€ƒ‰F,p°»\“¶àà&pp®è`}/lº†qDŸü!p0!ïÆA7‡j÷Ëh8¸—u°9äáàFp0! ³TÔ÷¹ÛCtñq*?oEz îÀE|)4}kóXœÏ‹û±úžïÂ>ùCà`BŽƒùö¬¸ÊPäû}è`ï¼Å(ppb‰ƒ²ÊAµãà8˜ÅsÜLÈÒk3­óÁ2Á´ÎÏÃÁ9p0!oÌçwżXçãëÉø·BÆÃ¥;„ƒ;pE;‚ƒ;€ƒ›ÀÁÀÁMàààà&pppp8¸8¸ ÜÜDTÞb8˜“:Ø1o1 Lș쓷&äÄvÊ[Œr^{å-Fƒ‰‹"¯-0Ÿn¤_Þb8˜ó\‰Ê[Œrj»ä-Fƒ 9³ƒ}ò£ÀÁ„œÔÁŽy‹Qà`BNêàrž¾?K;zƒ 9Oߟ¥½ÀÁ„œ§ïÏÒŽ^à`BÎÓ÷giG/p0!çéû³´£8˜çšHQ”{ôÉâ].K¤Ã_ÜË8“·‡ƒ;p—äíÕ'LHíࢼ½£úäƒ qÆÁwù*‡ôÉ_Ÿ´”ÿ${÷çu|Ÿ·û°w^ÆÁy{°{÷ç\š·û°w^ÁAèËÞý‰ƒ°–½ûa-{÷'ÂZöîO¼‡\;î^ìŒà ;#8hÁÁÎZp°3‚ƒìŒà ;#1oï8Ø•à1ç´D÷˧ààuˆî—OÁÁëÝ/Ÿ‚ƒ×!º_>¯Ct¿| ^‡è~ù¼Ñýò)8x¢ûåS¾ÑA¸8Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà Dƒƒ B48Ñà DƒƒÍÃÁ€@p¢ÑÞ”/ç[~^5¦a¯†Þê›öŽ/ïÝ|Þ·;RŒƒ¿=fû:trЫ¦Õ°ô³(¯Ú{Ð[¨×[òo`¬ú´ë[~ÆÁŸ…¶ÖÃÁSÓtp<ÆMÃÉí'2¯'åã´}=*©õòNŠõ‹×ûkÃ3Níý«´õ”Çö¢ÍåÛO³v“xOËÁÑ•[Ù—öõÊ)»øfýº¼qÀ-ÛQVã¿šÇb½?ó^(×T¯OÎÕí´ûkÅÞÓvpz£«Wê×k3ªP¯ÿøWõýÏO«¾éåvÇÎê‰qPµ»å n†ZÎí¶í¬ö‡ᎃczÒx½¡\U „¸ÙJÃŽv°YMÑN]Rëfïöþ8Â6ÛÉ·¿ÚA»Í·;ÈPø ­k3¾¯¼Õç?³Ç2µÓb?¥à»:¨ëÙâ j§Ý_»©ðŽæ5j=ï_ùÑÒžzçúê4Ê®oöSÏ1ŠvèÜbõÄì÷6³Ýmj±UéÚüþl<`Ü«ûaì p0l›¡+8Ñ<€@p¢ÑÞïùGÉýÁ‚} Cþ±–ÁÛjÑÎî÷ª…Kš»„O~XÉeK$|˜äÚônÓ5Å–GãŠ.zË,à³_ÖñÞÁ{£Û />iÆv¿•–ƒÏwU8ý¿:ÚõD98>Èë‡U3/Oå¯S>TËÎ0ûhHnRnæ« ··Ôo²íwÓÎQ4í¢~T5o8Ï…%¼q°è[=þéõòøç¹W£ÇÁo,Ÿ†›B³ÊÁ¶ i¬TwÑN5À5ê­d <’yÕ`8ã`ÆwÐÖ: fh)–gl‘ÛЋ'õþ[õ6ÇA8ŒYMßîç`¥ÔÖïüæÔ}XÎEÊc\¦:Ÿ3ç[îzsçƒfMª÷Mž0IÕÆ¢²%çƒC}> ûRÜ'±óIS¬^oö¯ž;ŒgRé¡èÂj¾i–õ|¹˜¯¶Eh¼'̼¸’pv^,ÓÉ!óâ4ïÕ™.8„hZ.¼= ° äÍ@4¿þ ”ÿ˜ŠÞVCÿÓIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-ipfltnamedlg.png0000664000076400007640000001046012173477702023151 0ustar npajkovsnpajkovs‰PNG  IHDR€’Då€gAMA± üalPLTEÿÿÿÃÃÃÃÿ‚‚‚¢¢¢YYY000ßßßÿÿÚššeeeÏÿÿ0eešee ÿ¶¶¶Ã¢ammmeššÏMMMA0ššÿÿUšÿÿ²Ãÿÿóóó²²²²²Uÿÿž‰ÃþQbKGDˆH pHYs  ÒÝ~ütIMEÒ *†y*,:IDATxœíÝ‹’¢8†a/c«¨TMœû¿ÇD ù†˜ð}j·m‘SËÛˆ‡¡ÿB@Ë:©0ÀîŸák9“X |,Ú] ®øo ¢Žµ_¥e¦n*X ðýõµ¿’ƒÑ€ ²Æ¥uóCn"pØÂÐ^ŸŽ 〃vè’Gf „B*ÿBtöúød„'!¨‡·â E€"@H ¤?€BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R©ëè¥Þ.…ð.ÔÛ¥Þ…z»"À»Po—BxêíRˆïB½] à]¨·K¡Kèa`;¯Å{›“!À–ZØ’#@‹[rh`KŽ-lÉ E€-9´°%G€¶äÐ"À–ZØ’Kìþ¾ö—á lo¾ülƒã8Ù×`K.ÝA &ƒSÿ†¿n/Küt²¯!À–\]\–"À îàøüÚÏun|¤vÁ#ètÙMÌ3}>ŸÿþŸ‡Oó f7ÞÞ¶ä–4Gzaz]œ »(àç`>…ÜÞ9MØ’[ÛfñtñˆÓ¶½—~è> Põ¨L€-¹’]¦Ÿo¨A€-9´°%÷I€A»ŒŽwØuxÌœ_ˆ6&ÞMAš'!ñ³ÙÑëpÿe~¶kžÅ¸hºÌò[!À–oÅYØ’#@‹[rh`KŽ-lÉ E€-9´°%·ð2Ì~ÉèÉõ½n-háúÒòJ_Ç!À–œ ðó7\šÙ§6X\ÌÒòð œ ðýªò'lcC¯øÑr¶v´;Wg¶ä²ºà ûEp=»Å§7:âög>8-'Xž}eø—™ ®»xú¥áÉ| ð–´ïÙ×ãÏ.íš‚·ÚÌüâ·ð̨™÷ÝøIÖtñªš‰£Av¾x™»îýeÜe¹Ìõ`²3@3}¸ ;§ñ¢]2~r¬—úerÜ…[Ê??÷€Q{À…nâmÏw‚f¶™52«cvz»Ÿt`KîôŽ;Á­Wšíˆë°%·ð2LpÌ–^O¿µsHììôÙ3ÇjÑ1`~$qú­˜'‰{ÒAû $À–’_UÁ1Þ\Hþó€®3möó~.ÿ9¿ðÉj-/û,8œO4_—L—γàsJüyØ’#@‹[rh`KŽ-ì©ÿVËݨ«Þë`6xVê°ö:˜ ž•:¬½fC€g¥k¯ƒÙàY©ÃÚë`6xVê°ö:˜ ž•:¬½fS5@õ}qêú—ØUsg Ps·ÜÍë~TÿdØ•"À›"Àžk!Àžk!Àžk!Àžk!Àžk!Àžk!Àžk!Àžk!Àžk±šS(Ì'Yú~sü&Àø®» ÄÕÙàìõƒÙà ¥:ó/éËvðGd.Ã=àòy ÇÄvyè÷€ÁiE¾ý÷Š ðG,ì—´ç1$@óa€v´¯!ÀA€%<Ö²?Àìy íxÕÒ$À±ð$¤‹Ï#¸tCÄA¼WÂ`-XÂ`-XÂ`-XÂ`-XÂ`-X›ƒðŽ®ì`&_Ï\_þéüf¤¥ÑÇQ¦‹G¼Ÿ"ÀÞîûÍm²9}>…í±3À7¯Žgµ<¿i>SxvÂ` Ÿ Ð7 °pª×oÈö|6g—̇÷ûn€÷Å°3|?"¿/ÇáÁøÉž,ß^ÎÓƒÍr‚›³Ë 1s·ëësóKæ<ô>üŽŸw+ÀvŸóÛërÎLã–ôÁ·ô!Ð>b‡“ÚË`úìrÂEM·ÙÂV×'8¤3«ž›O04Ú®ý¼ ^÷cÃÏùíu¹}.ŒéÉI.ˆèê´Ýæñm^GLɳ斉—çÍš.þ¼ËÞ6ûœß^× 0Þ€fûeö~ùç!i^Ñ–>`²FÑmÁ.1÷ƒ®ì3?ïŠyØ;G|½+øHÂ(Ð\—hG%À¾`´á‡c ¥ ¾`0]fú4@ÓVq€ñtñüÌ|‚oæW~ÞöpÜàßú˜Õ^× 0sìcž&>L?ŽL—NonŸ#“éláóh¹õyÏg>þL–Ï'ša°Ëó_ °áçüöºV€ÍíßÃœ¯–ðX –ðâ?xˆ;;,áÕ{Àû ÀÞXk¾*ã½|t>¸Š—Œ÷òÑùàªïè6W.áu%rüg›gµ±óe|£Ûþ¶ð4¯@¿]+À?Ûë¶àŽéwZšÑ¿áãB‡QNàyÞy#À2+þqÁ¥½upt鸪A€¯u5—ã-ÁôS€éxÙù¼ö[.nMŸækWÃûA7Íîø\ àü[®`ô(oz ‹Æ›ÿäçã\4¾n¦Œ†G!ºé^œWq¨Õ¹ãwðá=à‰>xƒ‡έøaÚ½Í#L“·›`Òé ÷°É0> pÓ ß/<Íçï`ÐÇòÐŒ8ˆ—7k–îv¯à{Eô‡„W Ð>Ñ\ ðe%@3ˆ[»`€™c´•çôÌCiæXoºaºš‰6·ÐÍÏr ˜?ÿŸÊµ|¯ä|Ì\þ™3‡—óíÑðùV7öd†‡SÃÝä<ÝŸà›pµßÁ‡^ˆ^8ÿŸÊµ¬5_•ñ^>:Ÿž ¶4ÞËGçC€«pÉx/®"À%ã½|t>¸Š¤ž–ðX –ðX –ðX –ðX –ðXËxjý{1üÓ©9NðþoˆÄà>€"À1x.ø#°„'ÀZl€êÓ²ðGLÿ* pO€µð:` O€µ` O€µ` O€µ` O€µ` O€µ` oü;ïØèÊ ç‚ž÷7]¿|¼ØV'¡æü€%¼Ýö9Ýô,t0-/YN¥›‡ŸÓ³•ð¹}»‡¹oØ_+\Ì\?˜Íw|çðwØ9½"ß—ãð`óF¹(ýËHÓ_.Ê>Žóú›Î¾iÁ,7úCH>»|ß8@Îø!Ÿ8nðèqoúöoº+ÚüÛpéj g¾›ç˜t?Ï2\V²|Ñóîäö€i€ó.ªÿÿñ˜vqóŸeóáepÃgFÍG»à`¾ÁŸ|$†Ë—x®óš5=w€Ó¥ÝFß ì´´—E¦k’<‡ËɘŒúmW9=ÛËÁl< i`ð$d9@O€E.à_à¸ñ“—hÒüÕcÀ¥g!Ár2ÎW‚!á,Ow ˜?? êãY× ÐëùñàkœøðÁ±àâåâ+Âó Ññüã%%¯óBO–›öý[ç$Ào÷€µÝæanºÊ[q/³!À"ÀþË6{Ô#ÀþÛ{ÀßA€%<ÖrêkõòF€'D€%<ÖB€%<ÖB€%<ÖB€%<ÖB€%<ÖB€%ÎyŸ]”úW Ã] @T¤þÈ À_¢®-ƒ‰º¶ ü%êÚ2ð—¨kË À_¢®-ƒ‰º¶ ü%êÚ2Î`+.ý`¤jk²’/"Àž#@칓8B#ô¾l¸NßD€=wÒ3çny_ÓŸÒ ì¹3˜ÝÙà < °/íù¿'6èÂѦÓmDçýÓŸüjöÜyúùß«¿…‡àñX1:çËû:^ÀxG¯—©^§ËîûŸÓà"mØíEçý#À‹pçyù#s ØÛ`0^‡;u€ÃQ îF€ä_†ÉeEòL€d_ˆŽžFÏ‚ÝtÒq¡ú$ä[°çNà Àž;φ?Ëz´B€=wž –õh…{î<þ,ëÑ öÜy6üYÖ£ì¹ólø³¬G+Øs /DƒÞ—-6È!Àž[z8⼬K€ÇÝ$@Íçðð¸{¸çsxßÚ ?„{. p×çð¾µA~öÜÂpëS(_Ù ¿†—Ž%þ¤Ê›ó.nuTÞœ7 pÇçðPGåÍyý÷~uTÞœ×mUÞœˆÏTÞœˆÏTÞœˆÏTÞœxßx¸¼lÉ E€-9´°%G€¶äÐ"À–ZØ’ûÅÏám!ÀvÄ{›ÓRo—BxêíRˆïB½] à]¨·K!¼ õv)D€w¡Þ.…ð.ÔÛ¥Þ…z»º^€¸„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R)„BŠ!E€"@H ¤R‡tRs€Ïçø%öìí˜S×_>Õ-MµkfÏg²†{Vw’ŸÙ°¶§À>£Å”¶&ýd°Õ¯\´‚»~_v(ûað‘­Ÿ™ œ× JVâx€Ž/* ðõß38ÿÿœZ´ã¹ Àé _l—ãõyøpa†wÉõ…l¿"ã*«9 ×7~„^Z¿`xnùøŠÌ0Øã…Âð’ñz} C%ï+æ2ÏŸ¿†›»ñFc< ;âušõœ* C /ƒ%8¶Å«F6Üó…ã{¾¥ð’‡æi·7 Ÿw4QcI€ùÞ{À4À`—­g°kË,7 ]à­ìW-h—Ùuf§]_ 0g\‡Ü0ú&n¹Ù= ¾e%@³aë˜ôT!Àô‡/a9ÀpÆO>⇶Qr gŽ±Ç[;4óËJ~iÆgH.YÇha{Ž»ôUï„Øgfpp{vã†O¦£§÷E´ý’g—æzøì8zvš¯ ó až'®> vó!Ï‚¿/óVœÙ^À ¤Òw¾õ ÔÀ§a õ?4 ÑÇ…zIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-iptm1.png0000664000076400007640000003012012173477702021530 0ustar npajkovsnpajkovs‰PNG  IHDR“`{8‡gAMA± üafPLTEÿÿÿMMMYYYA‚¢¢¢ÿÿÃ000ßßßÃà ÿ¶¶¶Ã¢ammmšššeee0eeÏÿÿšeeÿÿe0ššešššÿÿÃóóóÃÿÿeÿ0eÏÿ$ ’A¸ú6bKGDˆH pHYs  ÒÝ~ütIMEÒ:çgI IDATxœíÝ–ë*„»ç:à‹^ëÄïÿ’³;1P*Iü8NH;ª5§c>ÆlÏ×ÿB¡™úší@èÃõõ¿¯Ph¦þ÷µ†Bó†æJ¸üÓýïï±üPr‚C¡aÉ>ðÖà ÿÁÐ1ªxCÍHt¿  Ûß[—Feˆ  ›@‰ÚRF]Ib(ô°¼>Ïó¼PF…T/«œC¡#†æ* Í•³"mž§'’x §x+š« 04WA`h®‚ÀÐ\¡¹ Csex¹iû§"ÂP.)vw²œýX>˜¶æÇϵKO—燸ËÃ~ÕÎÛ8§ô£;Q@þ¯\lœË(¢ø鸼r ûû˜±ænÒ!ì!P”þ¥{_arùë ¢A·$"Õ¨‰ÜÙÁ|´4üÁRI`¥‡i¨¸2.ZæO+¬uì#%üóGð7H`'€} ´¨¯@3,—@çS•üUßœãº0™Vxîô´ýp/@4ŸHÈ£y_—¹^Õ”jûÊ‹æ Kø߯̾Kd#sÔÞ3s6ûÀp!ùkgšždVg(¾«´Ÿ}ôT®C³Ž¸®!"ùÓœÂw¶z ûc>† 1 wv¨C} þ*öÂÏ"°: ¢H`ïˆþòƒò—E„c+¾IàGa¸ëAÖ=R{v¬ÆìšÂÃpÀr\Ëp.?Äx«ZÁ.¤‹òI¤s~q: waŸë®i >yäG½Òí©»‡À'Ì%ÿYE¡Ðk†æ* ÍUš« 04WA`h®\;÷ªr•†WYp' C¶Ê"Š86—cÊëßôK¦Ë{µjûqÀ ßrn|5ÆIi¬ é?ˆ§²åuíÏZ†.ê^Î+Ëò=FkCéU.2«tp½¶"Ý^ÏsDï'†W¤À:*‚G ½›ûp{¼:¤´¶4_%*g—Õ~§áH¸ó­œ0'¢=kXFg<ßd]½½ GJç(¬NtP£ïDp‹ t£V —@µrXµç2½tr Ýh¿l¤\ÇÌû9ÌË[:¥ÒCŒ¿ÞÒo>m z4QNpŸnêCð!Ó/—Àr]XÌíZ@zÝþÀœ°‡@ï4lk°Ü5 §_Þ(l\—jÏã¬è«A`ÿ(Ì9E`ùþê%óÀôëæô§GcEZÚÓ+Ÿõ,2„ÞÐâ® ×Òr¸R£Tͽp HÈ©报ýNÄ‚Rgtz!(bï °‘ßÖÌùù ø0þVNý<€@Ãaãs48ˆÊß{Dê‚F­Ñw"í,†èý/_96¿H…‘öË˺ÏÑ@ð®ú­•ÐG/çêþôXâÁt™ñýÀtÑ𜜄’@°#>lpÙÑ‹–ïĬ´ÛA"Íû_º?ð°¯·uè ÷ Q±£&âªQ¸c³ÍPˆ¿ ý£ð³ÔóÀÅx~þ ˆsµ]ÏÂðûO˜ÓóüMäbÖ"Ðœpž];ž…Ñs4}úýTùDòÁzÖ÷½édO<3‘åOÐøžpßß@ò2´V¶«{ „öNí[ž=íñÕŽÐ\¡¹ Cs†æ* ÍUš«Ú÷ZЉ´!‰Í!˜ªD”õ¹Õ×.eÊ%W½lY:´¢6¦§)_g2ÄÇc¿Dta×íCÅÊó°º{AqÄù[Õ€èê~!K¤eC`¯e®—@UŸ¥ýÄ­[%ð¶?PµP©zÙç-$ ´ã©òÈþR…û¯Ä`ëNaÃ9?¸YÊdàÁþãêCÐì;Ò‹X…Àò‚19(•Ó;zRõYÚu„À4¬øõÅM$›€tûü’óHÝ‘s*ž¬ÈÏ!Ј0·4C*éÒ4’B0mǨ>Ôâ/5ÖÜõñä)ª, ¤ø>ºOw"<¨‡æªŠ¤§ É °X]Œùžn‚Y‰×¶›qÔÚå~PË1pT}Y3]9 !^9”@¬Oø“wÈÏŠÉ>µæs~öâ¥Órü*§_)æ éèÉ(Euãñ³®²û%‡i³\Òñ‡ÔßÊG…2kõ€4߻˜¢½ŠÁ^¹>sûQõvx„®BçÓk CžžOàk¡êE£p(ä¨M`(ô"¡¹ª}?pÝ~`üÛÏ:_ìxßû×–*£ÔµücÍŽ]i%Ç¥©í4ͶQÁdÕ¾h¤ä7ŠÿÚ#ÿâ\Ø3ÿEú'8þï…E²¾OÇPrã[YÖ¿`·5Ú<â_gý‹uýí,¶khþ‹fû[%}•à£D>ܶDŽ$ŽÎ›Dûù ø`h¨z0ãâ C†Køç5þÝJ4 à#Ž~3a)³¬üùŠQsŸdÌï:¿g¤FÛÚ<0÷y9ý§8D˜¶ÉyÀÂ61¢o1ÜR/bŠuxÓÿañki—î”Ú3S'cùiÅ€A`jïè©\‡þk”ÀœpÀÖ(¬SÓ¸6âŽ}?Ð4¢>¨¥Âm õø gX³ ¬Ïû x&=ûû¦‘?M`N¯oä“„÷ìXä~Oÿ~ ™¾Ð+á&Õ»æ8Á_Ü'Mÿ –ð$ñ²^‘–áæ öb]ÿ¬y೿è¥_éAljÖz ”í™ÿ¬À+¾\š« 04WA`h®‚ÀÐ\¡¹ CsUûsÈ¿d°^Z^«/%>¿ÕÁ2t Ô~¾ÎŘ²jC«.êý²m÷ º,×èÆWcpq{¡`ZÄp^7âøÊ Åù‡, ï+€ãÀŠ4®D§ÜDÚÚëyŽè5ÃðŠ´Ð$Ð÷ÞÎ¥ø çǸçŸôš€÷Æûå:Ìíw•„t+·ý0 t­œø%È"‡Ã«’dþÜ,îÚ(N$PnÒrÒb[¼Á-2ÐZ)üïHÛûöò.ÚÁè­1¶½ö<Ί¾ö‡h˜g€ë'8¾Åï@åîÀ?B ê”sF|£Cö Äãé |Õþ@I ^yV;.«1éß ó¾½2¡[ð…®§`LIÓ˜k@~«Šw:=¸?°wEZì„ýr…ûêÚÜÓ ‚lßé÷øjÇ©ñ ‚ÀÐ\½)'ƒCEoJ`èc†æ* ÍÕQßÔ«'b•F¿ÍYä*Žwº VKpUeÈØá}ƒÿús´9¨‡Wcœ”¼.Ä‹É“'¥´ÒiœŸÁ=ûå‚Þp†ô~XøѶ9Ú#Ð{Œái°‡@‘§“¹[°Úç ‘$ïqMkhîú²4Ü#x/È”ú~ ŠHoñjò 8z{wVí{/ŒoÕvä·—ÀÑw"¸E¦Ñž}?аo¼3ÍðõìøÉ ~3œÈ×iÃÙY/ã:6:ô(¦^÷€}?Ј¦Á¬¤3ÎOOàŽwÃù‰aÇ\Pï@v„5ÞÈGOå:4ÿ(9á^,^tîù‰µw ímJíØxéñW!°æ»4Œ›O"Òyç'ÖîýK x²X-’ŒøÞuWñlªO¤½øC Þgx ؘðŸ“ü ï.V<œ78+Ù|ç ˆÿäÜßÏWOéÔ>Ãc„vNíYž5íñÕŽÐ\¡¹ Cs†æ* ÍUš«ö÷åS´³ª¢ÂýÕiq¬UžÐ&Ú××±ŸO[;+,¿tî7m Ùªã«1NJ^2VœE:÷‰ó6ŽÓV;÷ê•ä~ rñ6$tÙí°×+ÒD2¥“¹[°Úù™ÀÝû«Œc_Ú;u¦p¡ÀÁæî|+§~Ö 4Gᕺ¸úíßYµwcÂ>16¾éÜo8úN·ÈÀk+Eãû*Ïç¼xêý°‘ ^óùÀ}1þØ—^Î{÷ö¨¦P÷W³·ÿuøâý+Ï# O¨Áyýر»Pü*¯…yezrôŽžð½þ°î p] "D6ò' ³"–ìøtºíDå:‘÷èŒÂkß^›¡>ûGá]ÆÍùž¯z‘?˜@~B$yñ½ëî]?¯Ø^º#C0ñ<±Qá?'yëûøÈÂ!³o±â-íýö±=ßøó~Œ(ú0@ûóus¿aw€O”Kþ“N-ÅW;Bs†æ* ÍUš« 04WA`h®|Åj‹ZM/þVµzâ®Â°]µh]–4éøñÂ}|½ûù;:½ ¯h´R3§ÓáÕx»g®i‹Õ?u]/KËtøGxÆëÞg]–ßœ%–{÷âöÜ[ˆËÑbÏ¡«ÑÕYê_ö­Hƒ1E’|ÿ,2¥Œýt©Ä$ŸBàŽjU¯ cg«X×îÙñêä'àÃÐ[¹•X0,ì#P¿uS–w,x¾ ß]ïåf8úN·È8ü$µ äy9Å8R›?:óÀuáb}0‚Ö>¾om¤mÇܧŠpO½r÷’ÚsÞ¸Š¦êËDŒátê†9/#ûøF´IDJÓ“¤wôT®Ëv"°+;H2ÌUÏ­=2}¹˜£­1:{êñW!°63}åì3ܵ½êC \ÚûÿÀü`º x<{–cöh®Æ«4žvͱݖ՘dJŽûüä Â%k™ÔÓé•lˆY‚Víïk×z îã$p¥•gÜ(®Ûê%P´÷‚í9°"ýž:~!Pš«?BàÉÆàPÑ!0tZ¡¹ Csõ¢ïêë‹\¾áxg[}yTêÿ}a×+8zû]¶†XRÛ±ã¤äu!cåY¤s¯ãâ¹³}êçßA~ô»‹ÁïWêõ@{eÚÕh‡ Vw¬H#€=ÊD”N¿õBgø1îX’½ØøTËJô ämöš¯Y|‚ü|° ¼èû®3X²"pß{aøñÐ(X",Ý)4š‚A‘NU‹é§Qž‡5úf8ÏãÆ„y ~7P½Ý³í•vîªU¯KêV†¿HÙòû]ì³VOnpüUr¢Šã(¢CŸWò•5éKWgˆ t%rW¨ì¡Çw·t$‘Ÿ¼4G]Ã^.o‰ÛÓ”ª×rÇ~?Ðëð·×;sb¨  Oà üBßÊŠF¨ªˆFT‡@#Âl1‰sÔž=5 Ô¥ªM9J ­î=%аB ¼öD…kÖw0ÍǶŔ®½÷ Ð Š©°¼p ”vó_— ÄcHS%ò‘ùçh©7<–ÀÇö ĺ«£ôbµ†µ‡@n‡“Mþ¿TÚRÁ·Ì±Á–ßß]GL!ò1ë­·ø5sEÈÿvËh÷š½|‰`SÅÏì"\O碶˜i4äáé8åãh†èOþÍç–§å7çï1…¬ço3^gñ+b <‹@ï¶ÄتK#Sßµ&ÒFøäûÛ,b?F‹·ëË£‰“|WF ì¢ïøo™¸vç·ähÒ'sÈÃD:R?$®ëA#WS*¸Î…©”¬I "Ë:Aßeb²ÿ­Ê]Öåãzú¦»AûM-ŠÕæ—dʃýµòw ,é‹ÿ¹á´¿ªœvî"Ðô‰C/¬T³µ–å¦b¹aM”S Õõnß ÅoÝ銆øL<×OÊNÖ“Ì ù þçž«<Ág‘¿E •ó§’åHwi¹S„¿?ú\ä[ ÜT#¡åê…l¶xšÀ’kÀ­òŒÛHÊQ¿m_Ù¨}Ë!®«:ñ-óâŒÒ-£Zš õ@çà‡è;ɵJTËß'óK‰K½‰à)… hT;ºÝ•™òÕ1í»ÅúíŠ-øCš@._…@éŸÙ2LŽn1I4ûÁQTù»G.§á’å²ÈwH¯!ЄíP³Aà+ ¤œÙ#³ãZ†¬ÆñjT—d€@ÛžU‚&5údÝTtÒªbZå勞âBݬ] •'g/ŸTʤŸ`Ô“Ì7¤7ž =´°˜…àui¯AΓຬdY?‰h?¾9¬Pù¸žô@Õ“QYªo>7ê]!h–Ÿ›Ç9ŠvüÖçžÿº; Ü#nÙÓéô|½‚À½|3t(zx;‘ŒÁ;t€boLh®‚ÀÐ\¡¹zÆþ@7ÚhzûiC0¾³Š¢Vc´²¬SwÖ-–W€º:WA8'(‡å·‘®Ñ`N.6¥Àïï´*ç–9×ñŠž²?Љ¥Ö§©™¶\ü³ÖÙÒ¹h-f yxúÎ…þr ½#¦åü6ãË€]ùÿü¨ü1Lks2N§ž²?Ð/rï~¹û:°Àɵ¦Ê`zZEë'ÐhñÎrvPˆ) n¤ßÆ×òÛ£‰“|“ÇhÒ'K*ÖØ¿±£®Ô„Nç¼s´R7w@E–uòm½Áú1ÿ~ç£íV_9{„w ‚@ô;Å3êIùí䯈ÆèÞyI¦ìHBÇí„f´ LÉ)Ï+à”–çÙ„ðS]‡ŒmRJrT´˧j¼«œ¯Ù—§ÅÎòçªÌPg¢üÖ‚ù–·?°I WSñV¸Ì­òÔ…³ß¸+£öõä¿qǨ>‚ë¥âVO9û Ä|Sââ·¸÷¨ˆ¦öÔí[:w$’A{„@Jiˆ…!ðGxü(ö]bývÅü¡@M`‰ð­,—³ëÈùHÈEË{õn¨òéÙc•&l‡è˜ g(ãM Uñ¢j­ÊñZT;4@ mj¦¯œ½ôU péQÅ´Ê_¡O´i@'í±ƒ •+{FO*xþ­p:£f8½0+ÎSDL—MÊy \—µ“,ë'íÇ7‡ƒ•Ñrþ@„Úñ[XÒçïÏ9#U~ÏÙåóÎS:>×õ8Hà° ëfØ_ÔYÊñ†z.gi¸³”ãuÖ(}††;K9ÞU±7&4WšÀPèÅ Cså¸üS9Þ~ÿû³,)ÜVõbC[Ùš2ì:©ˆ£.%7†¨fÆäÚ«/(W¢¦7G¿L&òÖŒbÁÝž/â¹n€ÕçÁÍña?(Ç=A^ TIDATƒjf¬štÈÕ§—k˺‘F– ·æØú¾g Ÿ;Ú]?#yåæð^w&¨•±ƒÞ™@€ÈS«O`5ËQ¦k –ñèæ õeÑG.:_sô»"gŸ¯—CúoÉîЬ€ìÁ?ŸÖuU.n Õ§°=Y*®·ÿ¼úõPò9’ÀuÉ%1jK*ÎÁC ×]i¾iì®V•H‹ùYäêüUA4©ò£¦Hé¹<ìçÓº®Ç®Z/úÎâþHµƒ—OÍv„Ûòi ÃýXPK¬«¬® (‘G`…²›Á‚›-Ñ¥W5SlÃl_æÁwšY_œOëz…ÀÅ#Bºfð¼@Ï¡ëÁ¬»ªÿf}`"Ÿ§(U)~À•’ûBOVÆU¥#²ºÜKÍŸgÈ®ô˜ã<@úåq Õý$²ª\•ÇµœŸN á‹‘ñÒÇFù‚À#T–,ùz‹@n]*\7vMÚ÷ÈrgVþÆQÌ/+׋y“Œ2úRQlºŒüvùW%3“þxÚ±"­¢-ås&žè/V|iJ„kùzr̲gøgäoµ0þâr€3òNë –[çSªÓ¾®õƒd‘=釕ߒã©öa°[þÑ|R…çª+‰ëÎ|+×ríø„ª÷®¯?Hà{WèûéÍëkzîLôÞú^úõ{cBs†æ* ÍÕ´ý~L^ ‡~½beŸk¶…¡ô̾ZúÖ:æ –Ìä/Ò¼ý^L¹ÞÆ®`õÙo/ªôÖzeꑼö0—?ßGb•±Výóö:1¡båZ²“ÊÏzÛÝŠŒÿæ”ϳ$ 4VÞ“^¼?0W ™ò×Ýé²H·èüÍÑìÒš¿ñrÎÊw](ÌÒAF¶_V½i?ìt¥þJ>9_Y¿ÉÎJùÀ?ÿÞ뜟̧Ôó?®ˆ-Í—e‰¤1´g‘Ëþå1ÊSÍ×#·üöÞ[›õÆ~èJ¢z·”¼d>w»\®Vþ½×¹¢T£–zð†áïì%Ðme?ƒZ¢3JÏ5“έ—æ ^Ñ·p>¦ožÅ¥»*›îÌv5ê¡}ÝÌ+@ÔÃÓ”Ç*F ¶\­Ë&P”¥8ÃC…@NßK`ŽóLeE·(ëëxé—ÇCÑ‹÷>Ÿ@Ã'®Hz¥_-©lïO ²`È×"P‡7 ´[Ú¾Wš–Ñ—¢Út­Ê•*¾K`­Ûí“M[~Tòïò¯J W†¬/Ö¬ý+¦3©ÆN~ÉöÃ0_F;V S¾%(—"½ÌÃÒU l¹à=÷fâf—ñKŸjæR p®Ü¬Õü/iˆ6AÐ0 v#M¿!A w7Ñ7„$p<ý>Õ ,ÃìV(ÕÉü4 ´îi“ÀíºµLGÇnö»Çì[0"0wQùhå_®#Œ¢ì/æ/~ÊzåÛM ×ŽØÌöü)Ý`rÉnb5aIé‘£ôFËpË)Ë­¡ï"áη’,‚È_\"¬z=Ž@èüd}½¢åÉóQ¥N0ˆQMR ›>K¶/ÎðPi< ? ›@vžÂÜz‘ùS•É£]Ž®£ÊGhÔ—‘þY: »'!Pƒ@tY{™ÃZäº[Ú5Mvû¬Ñ‡e÷®Yõc–ƒüVù˜§åK÷kÃ#ЪJÿ,u¬Hã4j4]f« Q£9ª r6K: Ãôl©Ì—ÑŽEÆ‚G˜Œ..‡s¾Ê§ì7ç_æ“¢˜?Œ~uU=ò `%½À¿öVî%uz¥þàùôwÔƒZè ú;†Î© 04WA`h®b ±zÁ‹>=FDHùMù‹Ÿ²ÞDùvèµ#63¤}J7˜\²›Ø¼×—Eí·«Xâ,\CT#ál§M¢edÉOÃ_qŽ>š-Måô«K:šó¡ú¿T‘ÑßÖQän8Æõ õõ’a8ö-§,·†¾‹„P?Lz/ìg‰*ëõ8¡ó“õõŠ–¯ÞÔN0ˆQMR ›>K¶/ÎðPi< ? ›@v¾^Nƒ@«ÊäÑ.G×Qå£4êËHÿ,À†Ý“(ŽA º¬½ÌáN-r ݈-íš&»}Öèò{׬úq ´Z¶Ô("æiùÒ}ÄÚð´*€Ò?K±?0™ËG˜Œ..‡s¾ÊŸe奌Œ'·’Ï"ʃùã|MøÛ<ªzä;@$ÀJz€í­ÜKê$ôJý-Àóé隷Ð)ôw SšÀPèÅ Csåx¹IƤãÁn¤ 9ÛZyžÃ÷z`ëz+¯ü=#&åñ ~¤6Hbœísð_*.nv)|¦Þ‰Àõû¢›Ù_äÏ'9tS‹ÀmºÐÂi _;%ç»ý-ó+£¢/¾‚_e ßS>9 ]5áqÌD©X‘ÃéæDÉÂDA0ÙݯÞQôv@¼róÀ' ¼È&-îÈ-7&ÌOõ@[Êɪx÷«÷ñ \×GÊêP"P“¹ƒÀÝ*6xøƒ½è#p {ºc~™Þ†@9“?$u;Œyàûª—@Äî^| 4tsHÿ^ZsláCè™2Ltž¥a° ‡—#[è"2Ür¹g ý¸ÐuabÍéÞKŸ{ ̀ϖվ‹¢ù?AA`h®Þ˜À?BoL`è#ôÀç,5† }Ee+¯T¨~Ýt;æ Qk­ëÜò<]nDóóQ ½h=±\Ýö˜o?jç9ÜÉ8Uø%×;û¿w ÒEÏÊî:þ_D9sØÏ…BÓ/Jmû }འž† ÞŒ¯jØ¾Ü ÐËç_ø ÜZçößv0Ïs¸—o¹åºåôwoñ2C?¢\!•­„ÊcþÅüÚÎÎ$PÅ÷ìÌçæ|Ë´°ŸD Ì$®‹Àb 2›ÀË!ö¥ÿÞÌ$Ð ×^œ€‹Ñ-zÞn?$dÅàà±E5oiJÏ£Lt‰º{’QEWr-yá[çÓLŸâ™öÎÙz8_ \RWåÛU”ÃT§di-“ZÝ*Jù²_"Ÿ%›£ŸtÏÙ/ËY «>¼Y‡_Ù¾Ù~Ú¿j=Y} ôQ*L†_Õ¥Žx–=,v.ÁÖBP ׫´w/zÅg-j’¯Ãˆ„•ìV­öGû¡'˜²µsú’ßg3 «Y¿FâV}Tíç<öÂ…Œò× ç$ñØ^"Eù‹¥é#PØKC ÖÌvãs•ê{^ŠZÚ&ÃðçJþ¨rqW+Ã\Q.÷:1ëꣃ@·„×u…òA'+Rî'Ð@ŒÃ­$x^£Šö€ÀbÍ ÐNüT¥‘b‡ÁPP¶{ tëW¤ÙI Âè÷A&ó†ák…@'žO ]1¯%ÐlÍò¼TòÙªy(¡‹À:ÝÏ%0[¿^Å5 _WŸ@/Ûãb›ÄM ´ [ò8WE äQ%+cY(^žE èկʠ]Uû`®üzÂw"é–MOœÉ‚p+•ã±=(=«åÀC"»kı‡—£¶¡þŒ§úðCø…×)¼d$ÝYE=x”8Ϫª>Œ êõ‘‹g¶ÞA²¦¬·rÔs÷H$©¤ßaúÔªü:€@5sÒÓ¾Ve€û$¿X núÝïƒOªÆ þ!Š½1¡¹ú?ü” = ,IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-iptmsort.png0000664000076400007640000002667112173477702022377 0ustar npajkovsnpajkovs‰PNG  IHDR‚’@P!gAMA± üafPLTEÿÿÿMMMYYYA‚¢¢¢ÿÿÃ000ßßßÃà ÿ¶¶¶Ã¢ammmšššeee0eeÏÿÿšeeÿÿe0ššešššÿÿÃóóóÃÿÿeÿ0eÏÿ$ ’A¸ú6bKGDˆH pHYs  ÒÝ~ütIMEÒÅjvÀ IDATxœíÛ–ë*ESç™ðCÆèâÿ²wŤ%‰‹ïI´FŸrl@â2 ³Ýÿ\®Kõp¹®Vt¹.ÔŽ ëZ1§šÿþË!ã²Ë5.Þ ÎdÍVüwÑtí¤*‚/Ö”Ds Ëµ‡j._}^˜I4—kérÖ¦2ðr]®í²zA<ÏsCÁåÚª^£Ÿ]®]äº.–#èºXÆÒ´zžKüqĵ£üëb9‚®‹åº.–#èºXŽ ëb9‚®‹¥!^Z~SaÈKŠÝ,»óCÓÖò±Ä3íbépYùP.®Êb¿j'Ðöö”~ô§ª!ˆÿ•ðÁÖ £ŠVP`§Ã†°Ê1œßm²ò!®­ÌŽ°ß°Sâ:ÌŽ¤T|ÙH¹EÈ×Gs6ÿ@‹ƒª§0xGãFøÐ炼Uc(_Ì“c$ý8ÈËA¯•„Ç5?"óf>AQŽbïTI5‘2ÈüNPráb*dµþæ(§dùbõª{¢,š®AÙÄ4’à#²#ö>˜NöZ„=?ß KUH?$»õ|°rQd1ÞI2äiý°srç e Ë v„=åÄf6üsd¡@pÐO A‚€,‰žNõ ‹€Í“JL³/ŠÜ(ˆÈ`ØYJ…Ènºãò/½ö•[1GÃúJ/ØÆkT”Gfk>K*¦Ö#ˆÉÆ`xˆ¬ê° ¤î„:3ÚN–ÃÊù‘"ùÐÄÜ`}uØW,Æ'¿doaúgõŒåQõ!(ï’t}?Ñ©¢]•ÎNoŒ ?_›¯&‚`¯‰ éoeEÒÄ"sªÔøè¿ A%½–NËGAÙJÇICP­Ÿ´òvÙ¯ØöVüÛVÚYE0 Ùi,— .æ‚‘GþúUM§xˆÒNHUW¬‚¬7#¼”)œXÉùÕêyo±Ü‘|Y?jy{ì—t©!b¥þÒ¯w+¾HI½ÔÓÙº>VgPÁïÓ–†fs•}ä~—ÇoÝÀ^™I£#èºRŽ ëb9‚®‹e#Hþ'\fØwµxÿØÓüŒ¡ ôû;ÿýt§úÍ cíÈE¾í7Ú:ÐúfóšIÓg¶ðܺÞû/Þ1ýÇkˆžð7%°‘ãÿû¥Å#*·áh`³?Gi!H ìA'*µ'×ß¡• þ®C0¹Léz $Ÿ³lŽ`¥‹i" k  ‚ì;…9W |´Ööƒ«\:ÁUvR¹]óv¤Z Aã[–øá_+^„¬XE¢ýW¸¡œÿN }3‚sr< •®¢ ÁæïýþïOÄŠL¨ö‚Š}íî1ì+âGiƒ%ÕàóÈò÷W È8?Œ©ë˜(IÓLSý¹±„“Ži‚‘QÕ‡ fÞ¬jS/8j ?÷F=s`oÏå´èQAp` ^… j».Á?mš ŽZ`s¾·EŸØŒñ­ë‚½EümX•YaeE6>¶±”…`,C:ÿ¸4ýð ‰7iñ&r,yä×­xŸ®õ}`y~N6sÆ–¶ñbÚÓ@ôñtÊÒ©&Á£„ù*î\ŠA×Å:An¿løuIÞ º\\Ž ëb9‚®‹e#‹/I­E¤à—ÅbŽ«¥Uë‚š™¼“_WŒ6OZ›K§Ã‹2FR\R– #$” äHWÓ¿ Áûé-þñ­‰­3÷ –·#‹ç™;–vÒÀeËÏçkÛ~ÁáµiÃ;³Q3h#d'ÀÊtÌ91Ĉ¬‡” ª¦¾HÛÞ“=[œ÷"8úv„n˜!/H´6‚Æ>@ܬcă׃¢4¥T†Ÿ/Ж2ù=ïj߸O°Þ«®zG<_¸j¿`e™¶¿õqdÃ~ÁòÎwƒëÊÖil¿J{2•pÒ± #˜S!¨˜ïy"&¿¾Á­û7ÄÝ»÷{Aú« 80£Ë.5ëÀš:$¿¾ ÁÍû¿Aòð Q&e_ Lh?Ž|%‚çîTôì\´j.FòÊ¿#&KΑ2(çù Å‘ØcGæç;´u¿àöU™®ý‚I½ÆÒŒ©y˃§žÂ?èáºXŽ ëb9‚®‹åº.–#èºXŽ ëb5eâÄ_X úc4Ü<_¶VÓ¡²SfUâyõEü£Î¶½ÑV ­W,ÊÐodi‡Å˜ÈÑpóüu¯G½›¶î\¹SFì$êöF{ùBbtiš&ÓP +ø:¤#ߊ ŸGpã~ÁöÓ¯¿¿IK6Bv<Œ½ KÉ*(d€Ä¼ŽpGpÛ;â³};B7Ìè£dVÁl!ÒiJ® Ëí 7æ‚ÂßÏ7î\5Ó=^t¿`Ë^/‚¬?™/¬Ý/H;±Z/(ö‡u†[sAô÷Á½àÆý‚ë$~YoŠöR»YGK¢½Ëü~ôû‚8†›q4ïjxÁoˆ7ïšÞa(?f§ ýUˆÙ¿éEP±^ ÷¹à5sA°p{IrD&jˆ „›çàïsܸ_pË¢Œ‚`ËÞª¹`jHŠ¡TýŸ/-³¹˜./±Ì pŽ0Îòþ]KÓ›÷ ®Ü-H¶âyÍ^wW@9™òŸ˜ÛUÊ?èáºXŽ ëb9‚®‹åº.–#èºXŽ ëb5ÿOä¢L}öŽâ¡UÌôhÂ!}ëÑ×hÛ÷<†ÿç?V:¥'®X”©,Ms“$Ü~ËèŠ ’7hç´‰ŸoG¢|+Ò¶7zã³Uä5KÓ,™†l>P—.ѽ’í䟴¯ûD72¸Ád¤ÁáºçV–¶k6^”5¤aVz%) ÐJ>>CÇÑ­â!ôà¦XE³*f 1ÛÔr•\ŠÍ8%9‡sE,Úh—¹Ü&±¼ðÛéƒlö4_8~¿`Œº Ñ™µ{A5œL“o­ær»øWzÁôØg-•pÒ|ÃÆœ42ÄZâ\ñw/‚Ú\âCÜBÐÑ¢†zAú« 803SkTiéCP#~ ‚·˜ ¦ã]$É«ˆP74ùaAb§·*î¯kŸˆiúe»à~ÒÆ"ÿÉmÉšp¾P¼Äò—°s`î0ñpžžÚaàé§(㽫¶÷`û-MwØë¾õ)'Sþ (ÿ ‡ëb9‚®‹åº.–#èºXŽ ëb9‚®‹Õû}AùbFyËÓ¯4ïþŽx¾°×~AÌ€`•@‚ ò²W‡øc\;—Û8'dÈý¾Å÷ÕQWC°N`ÄÜiq¾d ¾ˆÀcb6«Jœ`qõ~_°Á‚"×_‚àE¾‚4yI_FTeä¥SP¡’Îìhó<‘:ž>m^ÑöE™¸jQfÕ\05$´;¨ûû‚ˆ`¾ž±æ É Ø‹|NO!l‰š¥û ­~ÁÿëšUâèÒt÷(D_)LùO¬´ŸÐÃu±A×År]Ët],GÐu±A×ÅÚþ}Aºê2nžk‹2›ŠøiâûýúSýòemüÿ!¾Ó~Á±ï ò¥Ÿîpóü}à[‘Y^ñ¦¥åaw”½_ùU­ûìú¾ [a·ÞžXÇÏÓ†µéµ©ùÎCSÃo§8‚•vÜú}Aå…[W¸#¸y³Õê„k};B7Ìè£dÖöï Š.·/ܘ <ܶåtøý}œ7gáÑR/‚¬?™/ÿ}AØÖnÍÑß÷‚[w* ¦'¯„ôîµ_0æ¤1ÖPàSÁ «2q%‚y0/ʬš ¦†¤Jmþ¾àü‹ÎÂÑa”þ>õqd}Øõyr=YžÆÑ¥ér2å?1·«”ÐÃu±A×År]Ët],Gp—ª®ª‹Žàºº©ïª®ª‹UÅâ ‚sÝ{HWâmZt!‰'8žª«›ú®¢Û¤V.ÊÐõeñrÄx[¢ÛÈñE¼Më~l|³µÕºº©ï*Ú,ƒKÓIø¢Ž‡ôµv!O¿Ú¼£è{ºÁti•»Žà·òVƒ]‡÷v¦›´t<%>$’ßåpÝÎÁºº©ï*|áªV]¬¾#¦MÊLÐ÷iÆ»^ön°¼g#¢|'Lãù ùáùàå#€žÈàÕM}W¥öüЪ‹ê~AÖÔª ÑÔ¥³ÒðÂÂ1x¡(â­·Øežæëm–x‚QŽ¹Ö@L®ñ(Ãr³àå=¼¸Ç¹™Áø]äº#x7í‚ M:M´qÅ!RV ıaöº¤GGðj1 ?²êbýŸ²ã>¾Òô98]fñ‹ëòÈÊãÉpú!vñn"í| üä}†ÁD½êcÝ~ÁÏø Ç™üEGPQï3š#¸‚#ˆúvφAEߎàÙ Ž Êéòö Ž ª,MÿiÅÒ4M¦%Ÿ%è¤XÇï?(­˜˜¥wßI ÁJ2ô}A.Ù›a îš¿þ˜ðÅ_t?CÁÆ(Öû}Aܦ‡áè€NåÔ¹ ë!e‰Pìû\ðÍ”<þû‚æÿ_±5džØ‚Jƒ¸}ïßKö ΂1¼‚ =×$×”yfDõˆ÷QpQ6k½„£åÞò'æÒü í‚ I® VFjŽCÓJG³®lLgo¡à¢6ì|©²4L'q>A¸n¢ñy—8!±àÿ– Ž jÃ~A× Gµák…‚#ˆrÏUpQŽà¹ Ž ÊÎ’]ÏÔ®aä“ 5’‰ öžŒ5fÚ0Äxá"80oDPüž„>Ù÷B ¨ˆ€$ƒ‰u|Žà‚ÜU¾Ä®›jº*‚ôøN¶æ‚ §*‚Ï‚júkÌͧU]¬þSv²Û¯<¹æ ähì$èMÅ°ü…'âÈКhü©\"~n¡ ŸˆÙ“éüC»OÄ„A%^ {Vx± ‚ëö –^ðκYþ‚6ünmxAç®PpQ[¼×0'u·üGµ¹t )8‚(Gð\Gåž«à¢öGPÿÇ”•)Ù9³5¹Íay'}îªMpQö ê’aóUˆLr¸´Uë³|SGµa¿ Š öŽLüÖÒ§bÞ¼£6ìL_YµßZÀH<á‘]ÈÑ"·G°ë<§v8{SèÞNö ²wÄòÝ-L± ÙéK8$ušŒ×¼ì:ŸÃµÂsÁÚåx–‚#ˆÚk¿ Êù¸NºGÒ› #OOîÙ±*Ym…ÛÆ"ÏÀÁ Ž jÃ~ÁYA{.ˆ½ZìA 7 HGeGðNÚ°YkÖÑRtâ*Õ^T&:GÁDíŠ `ÖDÆ%—¨½ÊQ"6Þ*ò! Ž jÃ~ÁYbÿŸ¾4Mã-®ø9 óœÑz"N‘#÷§=™GÛŽÈçÁ Ž jÃ~ÁYg¶ß(8‚¨ /èf9‚C Ž j+‚çcï¯à¢6÷‚®!Gåž«à¢ÁsAÔ#õÅòÀb,‚ÔÃÍóI]Œ¹» ø|iUÓÁ?Yû‡–JüÑ©¹×¿ìÜ°_pIëKÒŤº^× 7ÏÁßÙKÌk°üãoƒú7fÖ&ßÁÀZmØ/XT{Û;§‰‚ÞŽKÐwy˱VÁDmØ/˜Õè2@ôîð¯Gpä;‚ þA’žÛKÿõ~¿0Tý¯×†ý‚I™öâM†3лù ð÷¦sÁИ *ߎQ¿#˜âˆ òAü ¯|‰¸’ŸPÚ½\½_tbµ^0¿£•ö«áÖ\ý½u/Èšºú,ö™!e Öè½qÄü)†p&‚q ‚a 7â(qê ¯ ø9qU}ßl!(>’%À» ‚qú·#/õ"¨X¯†Å\°!ÙüiA~þæ’äˆLÔ7ÏÁߧ"¨ÌKˆZAölNt¿*‚ûP¸a¿`þ¬QÙø—.ÄùW>Ï¿Hü‘p’‘\š®6ÐàwƒœKæë|NÈçˆu{,}B|×'âuûýƒ+°žöX3÷‚½1izÑä¹sÊ$¹û¢ç<½ή£ xŒ“ACùèDPí…Šš²´žc6à:µK:AÅܵ £¦TËñ1¸_¯?À^ÅO¨úÛOAm”ëC0´ØPçrÓ”{«ÉB´LÞ´ô€ „9"ó‡ñ¯V¾__Oo×x¼®wÂÇ(!8-N#þ팚½ â‚‚ÇŸK0}yÞàóuæÞH¡Ñ –h” ¹½@ˆÛ8‚ÜOúy!‚*u_Â1¼As”¬Ä›(Öãœâ^®˜ >8=d—DD½ãµ Ä/áoA•Æ ‚±8ŸóË›(¬x‘8¤«2Ò·"H’ãXø b¬¬¥¯„K•ã]Tæ‚%¤ŠšuýñÐâuÍ¡!ˆÝF‚dMøñù¹—ŒÅïñ ýÎæŒÉI—Ãñü& €`si:¥ZŽËÙbÅ{Ô®3{–ŸW,6÷û©,MSŽõÌ]C Ø !‹•ÃÆÒMÚð‚Î\¡p‚ïE #x²ÂÁ&'½×o Gð\…3â÷ÒV]c Ž jÖU× GµÁd&fk}³=›©§Çзº%‚D°w›Ì+^ksáÚ͇m=zç’£SÎÝÄÿúƒÆÍfêéEà›#Ø Í­û0{¨‡Ÿz¶#øw–‹ ÁºÝÙ9'u‡Õœ¼­"ø™>jA{.ÈQêEPI§"˜sI[¯œ“Þ4tä—*‚/bf Ÿù]Åhy{’ߢ$dóuèF“‘Þ¿1,¯áà-ɃlÖQÓ=JºG‰ß«W}¼vþýýY¾×¦V]ìE°B tžœÀ<™BÔÓŸö@~­,Cæ‰#SÎs/ødñžÐ.§€«Ùþô]1}',ÞM‚Ê»k}c[ ÁŒ¢Vu± XË^°·5"E‡˜%6H6ÁÈ$ñx“ßM€ é®úL]KÇ »hïÝ}ã,äñ±,ö.y+‚¼„˜ ‚6JdI‚ä‡;¾pã>p—^ϱ‡+ã5¤×E7i銨ù”íÿ¢;xÆ${ÁŠšFµ5âÞz>AÖ1‡ LcDki/ù|\¯µF”T!Oê\PñósA-ž‚ ï ªŽÍKÈ…s¥,øUæ‚/©ÎVÒ1õ´EN0Ø9‰áy…úÉáüxS…‚ba9MOÆðÄËùÂpaEžlÙœN<Ó®x"6ö1¶µTÊ2´Ÿˆ_Ò{A×€AU{¯íímo_ MßÁÍ ~ŽàÉ ×bæ{È]«AÔ«>Zõæî¦à¢v@ðçõç¥rÜ LÝ°—ƒy4™åt¹l…çëÒm6Pñ«d–]Ž *!Xmç*‚¹Åø«…‰ÿ×ìå°@M•|æ,*áùt‹fkÙ‡ ÁD-ÖÛ¹†`Jy$‚¢cTbÿ4üáˆYá)±†¨fý:‚Ã*VÚ¹‚ Š©õWkþ<Ë÷3·/é‰X¸ÈIÓÿ{²½à“¡c…—L«…Å øáå Ž Š õH®ô!ÈQ#¦h“ª´²&W²~8wÙŸDAGð‡åW0VPo XFb°BËÅ8ý÷'8‚¨ÁÆ(VEvO’ g›ãIKzhjv.z[™U1½à‘WìW#¨ÝR©œÁWU¥‚ì‡4t‚òeµ\B´ÎLEPÏj/‚GÄ‚sðÅ=Îmu -’ÁoÐYþtΕ¦@³‚×p®ÆéÍÚybŽ4ÉùÕM}Wí€ y\S¹¡Ô'cq½ŒÈÜyb~¢ƒœž U"’ôÉ1ø£áÄ öªÜÏح䇔ïꦾ«TpÈ… ‚k$GÌ•RЫ›ú®jU¥#¸JZ9¯n껪U—û"(ÆÒO”\vœuuSßU­úܹüf]ÝÔwU«ÞA×År]«Ž \ÓØ6Õ“k!U{°øB.ëëzbQ†Çgå0 2U$«qô¿ÕRj¤f,Dÿàe ¹4ÍâãQzúáA˜Æ*†] zOýUüZëš¼åp#ßJeízäª!H›ë(ÏØ/H©ýH!ð£höúTHoן嗴EÁâJYîÊwÊçQG®Ñt¼JØ÷:ã=‘2*UÃùmŠµ/ò¥]2äi‚é ‚àïGÔƒJúr†õöƒð[ꇘPü‘êÍ5ûdסÔ2¿zmí}äêCPÏ*AŽ¢ÇheM(¸àAÐYy7ë6ö  Ë-±ä_0‘ \²¢ÍÕzãF¿Äî¸BTÑ­Ž$”ÛºÅ;‚ªÒîI {Ž'¤·¯RX,®r×ˤÕØ/Ø P»ÎÝ”rkÉò¨Cz´/Ìõ ¦ëÄ//<ɘ]îv}í}äú†ý‚-mm{*‚XÞ ‚<¿ˆ ô¯¸R‹…ÿd—¾A‹¤s”p4‚V¥Ÿƒ bê+ü¹ï~A5jI Š‚AŽ¥”KAVmò‚hKäÇ*—ÈW‚?Ê-v?Ë|› 3 ñd¶”cÄãÌI¯99˜NûeU0?Ä–m5_?x]©rLíh0¿˜Ì'Xø´–„Õ—l—#Ž ߬µM_WàýånÒ·•÷ù~ÁÕÚk•|§Œëb)º\'Ët],ÁéŸÊñõûߟiJ×uUZ|dÔ”b×p$"Žf)ec(ÑŽj:†¬ eõ„r%jz=VzÁD`B/fë ®Ìy¦¼xž0´Ë‘h¡Á<•r_¢¦cѦCY=¼\‹Ò4\¶\ÚcéýŽD´|îkvmG<ä•áµÙ¹@-Çrº3‚"K}FÁ4p–£PcºÌãÁíÊ`ÖKNÒ¯:€»,ºÏáåþ›rv`böÈÛO+\” Cô*hWIG*B¯·žüYõÁë¡øÙÁ8å¢(UC‹ÊÎIéuÙ™æÛFïlE‘8²ÔŸ†®ô/ 2Q“´EJåÁü ŸV¸ dºj½È[ {$Ñ–ŸZþ1#Ø.ÄOk$@Páš"F^ X¤H‚DÀn&‹ÜþÔœAzQ5ÅF1Œö¹¼ÕÔúB?­ð ‚“…ÏšôDºYjÝUó¯ÖuÀü ?V„ø5#$·$•yÒWäáEåžjù9 AÌJ/‚9ÎaÂ/‹©þÇ‘(ÜŠ,×\Ž ’Åñ‚<-•ò9‚» (Libx Al^(]7‚zUê7É rgšåÈ昕ðb^E£ ÀP/Å_Á®üUDg7Å®K9Hv+0§×sÕ•Äu/}A×ÊÛþ ¿T÷®¯wDðÞ5z?ݼ¾.DPŽÄ‰î]£÷ÒÔ—ï”q],GÐu±Aןn¿ %àÙ_D¯XY—5ÝÂPúf`-}K׉¬œñ_  ÷ Z1ùºæ]!«Ï~{T¤×Ö-ûSøZc@]½Øjc­ú/Ü/hÄ$5Ë•T¶C\ñmw,<þÍÜÉÏFS"ƒ ½IDATQâ*KðIgïLÇÈ)Y§+ðÌÒMÒ¿:€»°ú¯¼§ÓüÆ Òq$q¤çK«7™=]©¿â'ûåõ›ìDðC~Øþ{ÃÑ÷Sêa÷Ù/H®"H›ƒy‘¸1jOCó—›D)OÕ¯…nùm½ÃVë ó!+ ê‘ÝSüà~f»X®–ÿÞp¬(Ѩ¥¬‘øìý‚½šM#ìg²H÷D-Á¤ÇªIçZ•só 0ë]К7+YP¤•Žv j»*õÐWýÑ `õp‚üXEP©Â‚Q V$•.Ù=TÄô½æ8G"È#ð(²}A^_û#¿,ŠÎÞ/x<‚Jž°JHÒ@ç«… ”í &41|‚òzA½©õ›¥‰`€!ªŽWYi!(â›Öê±Ý>Ù´–Šÿ®üUÄÊàõ…ºl¿`¤éT¬i Ã_2$󡘃©­‰ÁoñBÊ%P/s±4—äõ€d‹zYÆtPz}“ØŒ>)ùÒËS­§‰Ø–×sÖJbÀó_Ði±2·ÆÖ•º[~ÞCw@Ð üj Žºrî·s§¿[~ÞH¾SÆu±ü—®+åº.VÁiJ,ýM~æ¿m>—óuiÉN'­ŠzÄ[€% •to÷‚î”Jq©7CÐ ü<½‚r\s}‚ÞA×gÊt],GÐu±|¿àSYÄÀµŸ#,/O¹ÜHɬE•µ‹2Eà©._”)ëC¦ QXYË_u]LZåMo…ÚŒ€ÎµÕÉXBŸ”eä†üËX˜«úÇuÔÉ^ZÆüUÝ‚ÖN¿N¾_PŬή@ôV? AëvÂoˆ!Žàxúuòý‚J“‘[ ÁŽšÿ®öB"ßàŸýäõÆÊ·A«i3“´·@ðY:”'½Õ»}šÄþ»*‚%΄UUb ŽvéÔ‰5 wò©ä—Ó<ªM å´«‹g4ûú$ùE¦ùm™w%cX¯¤¾N‰}¿ ÖtÁroÈÛˆåƒÔ¢Þ‹ æ³Dåõº‚¤ûãõuYÓWokã2AFUQ!nú,Ð>;£‡JÓÐ#Ëñ¯#ˆ™¯—SAP«2~ÔËÑu~‚J})éÒG Ø°û!²£#Èò,³™¯Õˆ)d+¶Ô«ìö!XÃ–Ý ÓêÇDPkÚR?¬ˆÔ§–—î#­ A­ ýQòý‚Ù\>’ éDÒåëèWäã9M¬¼àHy|+~&VêŸÎÙX~›GQx °´’N ðí^ÐR)®3õf:Ÿ§7BPŒ_®Ð!èúL)º\'Ët], Áð Çó‘¢ÛZ~ž¯¯ÍzÞ×:™½àß@Édd6Ýí@fX¹<à‹»Ü><«[!wA°/ºê>ðŸC×aj"¸ŒŽäú>-ôg‡d)f7‘ùËÇ!''×#ÉW™P8‚÷TÁ;BÖ¼ÊnsFD7›Ýâ H¯ñ’ds¾zzÝ$^:Çë®ÝÅ ¼ x/`!ˆM7&êOô‚·äƒ¢UG0!Ôw‹ô"8Z>W‡2‚’Í®V±ÁÈ£?0}¸‡;Ðâótù\ŒÿàØ­@°šKRDVdGðõ"H¹;Á`#¨dA"w TÏeÁ5Çf>]‡JA0Òé˜FÂ2"†ÉFæpñ2;àùÎLÄœžàú²‡Ñ°Ø®#¥õ‚w‘ðr]ëÆö£®÷Öt}‡þ!xÔª£KÈ+[‘#x¦¼²/½ŽùÒ µVü¶?OÁh¶‘ЊÖ«CÏçü÷ùú‘ŽœÎtÇ©ÂC®wÌÿrÞY,’n,º%È}>çו«éOnˆö‚s=Š.y3¾¨b=¸ åçßõSL¨ÍòIn’†ßrÏ+u¿DO åk·â`—•\gÇZ (ºAßB°ÓÏ+ó­,P ÛÚêÉï{lž6‚/Æe:‚aW•³Ü_ü¯ÛÖ”—,_7 'xÍÐñc‰ªÞÔš2îzêx„~Bñ—í3{˜ÿ‡p´µ»Ø†àrÎîx ùAê—Æcõdý(~û ׋àü’Ÿb‚J<’œ#HÚš–\™·!Ô 9}d[™ZÈrU¥ÄŠŸåÚ#Ekÿ"ßÛUªœTõŽjÉ9É´¼Õ1”#ÅãåÒÛmEកàsAð‰ÂíÇÙÞ *?•ÌØC&Ù¦û h™¡~Vj` ®#Hž™ùù,AQ¥Äoˆ ¸¶K+¥_Û•°`\UΑ¹ ¬èÝÚZd ÈÊËnU$ÄëZü L#øxˆÄ*‚u.hùU©YAÑT­ru#¬† ^ÞáÒ᤹r(ý"h=¦ésAò Y²þXhÈ×Rî2r“ëô*‹ÏLÑëö“3àOÄÄO2_â q+y‹ØsG°P\Q®åÀà Ê ©ýZ»­)`úÁΕ¥iö¤«=“å˜ÊñZíÔ¢_ ¯)EŽà™òšR´‚[»û/’W”"ß)s¦¼²ù–U×År]‹ øû›þpýþIIú Õô¿p¾*³Ó4±#úÑý÷˜-·|Jcè©ÊÊOWâ%j+¼¡¿¢±´­úXÌÇV}§dÕlv øwÍ`ů¥ÀêjùÜüÆUp§:Æÿ¤ßrÚ‘YÝ6#V#ôß’¢x­ú赟»ŒZ¤&‚¿!ãzwzÕ^—Z®ë__@%ªì*çÙ¸‚ëü·üôÖGwW2Œ ëL~ BÖõ¥ûi¦OñT{sNKÿ?-} 9ƒN©³²í±:Ê×D•§di -óZå Jùr¾˜Ÿ)›g Ï=Ç|iàÅÐêÚxØõ‘í«í'óW¯'­$½”¸Æ¯ÿŠ Žxš=Zî\„¥‰H}4Œ¿ÜÞ\öŠ=tͪÃÉ DkÙ¬Z™™9ÉäM(3'ƒì^ ‰jý*‰[õQµŸ}lˆ å¯u“tÄC{ ‘aZœ>™½4šÐªYn}¬Sy×sASëh(ùù…üˆrag˯™N¬>Lç:Që—ÔG‚f c$å#Ý,K¹A…1¼®%iijzA2°È X¬)ê‰E)vF¸]‹ Y¿,ÍJa ¦ùÞ Ád¯Ñ뱂 ÏFP¯™sT›s%‚87å…<A1Å"t!XÇû`³ùß_F¯Çh#hÅC{Xn™½äxSî‡`UieLÄˉ!­úÚõQµOÌ•C¥žèÛ‘tӦǸœÑ"×µtZzí‘2À[.yT¤Çî*1ìQÇå(­“ç¡ñ¤‡½ÉË ‡ëÅÏNdõ`ab<±ŠúPÔë#Om?z ñrèÒ^ÐAçÝ#–¤’~…éV}ˆú퀠˜Òé•©ßW«2Æ}•‡_1@3ýêwêÆ8þ-ò2®‹õßÿ³ö}Ü#;IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-logprompt.png0000664000076400007640000001265512173477702022536 0ustar npajkovsnpajkovs‰PNG  IHDR’«'ë"gAMA± üaiPLTEÿÿÿMMMYYYA‚¢¢¢ÿÿÃ000ßßßÃà ÿ¶¶¶Ã¢ammmšššeee0eeÏÿÿšee²²²ÿÿe0ššešššÿÿÃóóóÃÿÿeÿ0eÏÿ$ ’r,Ò3bKGDˆH pHYs  ÒÝ~ütIMEÒ\àºIDATxœíœÙrãºU÷YDÁg4p¹ÓÀ~¸Ïz]—|J^Œ×Elâú/·¼7]~éµSu¾Ùc`5Žï¡Šic¨û¿÷é$nIƒìÎßuÿÉ5U¿Ô¼ú-É‹[oÈÀz…e¡JE]íÞcëÕ{–PO”Ï/„u&êvDwûýPã’ÆÚr2P/çGÝ‹ήŽÙqš8U<çh—¹Ñ¾6ÖŒ§Uïb ó*°ÞØfz êøõÜêØÕI–ݯF¼1ª? çƒq&t6ÝM/¸ü?ŒøÎ+1³ó?;{à¶}vF«ñÔݺޭ:‘n7ÐVÛ0p™-,jæì ÔíèFdc¥«ÇÑêù™ˆ~øÚÞØùˆïX ̶¼ø®Þ,ší«y¶ãq* X¿FRúqÚ&Ä b`5çêö‰ Ô÷·ökÓ@oÓÀfûXOIcDžvÄZ*·¼mÈ@§¾WÏëG×Àz‘ÎÃ3ПyöÆ;¿§Š·a`§ý¶uö LÇu:Çk×hs£‹:ÿò]·žÓÂRÇ™ÓÌ•¨¦;m~èQ¦|%÷×›æ£Q½ýžëùqÇ;¿ÔK ±tæ/Ýéyo•¯jÊVúõšÂÛrçJ, ~÷,´zP9 ü(vÞ~€£:“".` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±œdà oÍ¡ª,{9T•åziU‘í{éÕw­8ŽCUY²nëÐ/qí_¯V•‹çq¨*Ë“¸5ä¿/t¿ Û@¹"ˆ«*ËC?‘¦r§Áèe—¿g ^Á¶½ø=m9·ÝêéB×÷ ÜŠ£úã—ßWÓÀQ_Ô@wE¦”q½˜‘¦ôT§~ÜI´É¶\ig_ü¼0¹»¢¿6Ž×?ßÔ7VÄÉ/„Ò±všã²ã˜D¼yˆ5ž—9…á)ù ç@xNœÇŸ 0bÁ@ˆ! „X0bÁ@ˆ! „X0bÁ@ˆ! „X0bÁ@ˆ! „X0bÁ@ˆWöþçr8ˆ—5Ðü–á8òå÷ywΠøµÇ5E{Êù›Íšßž(oªüÒ|YõoZï¡oàî ¿¹¶úmù[­æ~ЖÃÀ5lÇÀÛ–;¥e ¼qÂ÷÷Cµw¦C·°×°=M¢øÝ~÷O ¨¿5 çOGérÕßЇ\nß4'ú§þæÂTâ¹K]å{Ó@ôsžl ê!A—·ófËa`Û0Ðùãbµješ«hÓè*®:ÝŠ(ÕšUákgsLmû×Dœ.6ÆëeãTãÁÀ*ì¾=°µ"JºÕ:LåïçÙÅëîžbUé:?µï Ù7°Üuœ)ýM- l† 2p¢óF të~í5Ð/°ßÀ*n„2P—}€þ&Œãª,/o ÕK”³ñm?n2P÷£6Ðißò~U?ícÚ°O¤½?gw]ÿ½á”—©¼u¨"Øx«í‡}NsÚ7ýJÝmhòÇ@¿_:[wÐ-7«üêz/k`‡3¦lOÌ^ÙÍ8÷wþìMë`ÞÐÀSV`GÐnÑ“õ¨·ô§çÍ ¬?°=†Ñ°[íŸ~¦ÞÀá¼™ðr` Ä‚Ë‹¸ý´³Y¸óùi =sk 7ãE ðeïç÷.üN[Å'÷o °i#œ—Ó1ð¦ÿgø²¼®âg29ŸbõGûÞÏ2d@]ßËÏ$l9ù³ ïg19¡Ô+?º™K¿D°âu ,Ÿ¾íO·d9ù“8÷Xt>ÒµíXÃt²é›Éw‚M6î‡)ø®Hµ z{R±ášÐÍ3P™%ö8kzË@-¢§³ŒËx¿*Ëc 4ã1f”.Ùº˜ªédè`õ¾«¿© tÎêjCu·îOeÍ:ñ•¥¬o ÉÇÀŠw0°s +EùQåfc©ü†U(Û™¶Ÿ¢âëØþÿpSúæzQÏYÞ{ÕY•×ÚÈü¹ÔË­ÔõÕµ™¿Tw*oVe ý©Ü­›Û•'êß“€§àœò%$ofàÓ|œÖèÈÓôïyx3áåÀ@ˆ! „X0bÁ@ˆ! „X0bÁ@ˆ! „X0bÁ@ˆ! „X0byQ¿>œ4/Qíc`ÔÌ? i^¢ÚASkKntW»·¸¹L6¿UÜjÅݪ_®CýñûŸæ¥ÑÖéœhàYútÿc3n4Ðþ;ÝÀæJ7ò;bè¬FÁ­ú9N³¾}E|–?Æ´ŸÃ ü»Ÿ×Deà‡¾[ Ð[éVýÞÖ”²zínÕ—qÜbŸmàžiÕFÅÛ4p½Ï‰G(¶•´r—¤,Ê"¿¦e/Ë ¥Þ²–Ëq–N¬¶S¯dmÕ/WÕ/â˹7ýOó²×œ£8ËÀ‹o_~~~òåçšóãäßeà¼ãv \W:¯™5L'ec ÅSl±qµØ¶Þ—Íõë—8ª_u}oûÿîjÝ´œ:¿k v¬Þwà¨W0­G1Â]i!ŒÑÓYÆ-b4ê}éìf}GìˆUCU¹0𺹹ZêMÐD¼èºyœb¹¤Y•(-³ºÚP›B;õ¾Tòh}Ç¡7p1Ï‚=°Ã–ê}ðmÏ戭 ,‹ãhò‡ lÖÓÉø¬:ŸÄÜd \Dz*_Ž(­Ôù*€9ª¥Aíz"¹S¿µ7ëõõ# Ôºå¯×7"Kë9°ià<'“Lâµ Ìs±¤Îï/·2ù*Ïcëµ™¿Tw"¡SOu¨U_exõ—¥”ìõYê–ÈÙŠ÷ºå½ð¹íìƒîxÖÀ{fÏ]·[3@‚w6ð(ž×ÀêД·üzœï~ ÅóXNÁ¡ä[ÃÇÚ`š—‡¶-ÀÀ¨™Ò¼Dµð6` Ä‚ B,±` Ä‚ËyžÒSx;Î0…ßX‡q^ô÷…ámÀ@ˆ! „X0bÁ@ˆ! „X0byQÿ]‘#Q7w0ùɹ¹UººK_v7;نׄFÆãøa‡­×Ñj»yQ/«\¯ý4f:·WµsUÃY€;ãìÍ/Å.%Óõ4_ÙÀùq^£oøwwcOLÃéöpw„™Äõ4_ØÀÕ‡×íi=%×kJš^ÉÓúÒV×Ë+}Zo™N±þÕñKV.`ÚMíÌ¥ª §Ò¿Y÷s¶õŠ×ëZ1ïi¶ªå¯~` 10­¸:úò·ÿêÍ(­buÀÈ%îîâ»_X‰_Bʶªö7ö@ѽIö×érIÒEõ±.êks^1Ùôè`^×ÀÙ7°lRÿ¦²‰Lr¶ËÕl2ã*éÕ&,âŠå›ÄêÖíXÿ›ëŠwÈX…õžgTß”Ùó 4öX÷¤:…e;¾UQ§¦Ó=µ)Ö1pyÔ;‘‡(Þ‰´ œk _—GøϘV¿ú¤Æ¬Â´ñèMµiÇ1°Üˆk‚2pê= alý¹Žcë`àI¾ªöyoN`9¹R0¿'L‡—{uŽµÒbúFÆ×-UŸÖïIg·sý\õgJ& dÕ`o|úy´ªoÞ»ëOáE <œÓ&8çÄwóƒÀÀ+oj s »ù`àÿsè7 }Èëü80bÁ@ˆ! „X0bÁ@ˆ! „X^É@xO^Å@xcUeÁ@ØË¡ª,{9T•a/‡ª²` ìåPU „½ªÊ‚°—CUY0ör¨*Ë ‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,±` Ä‚ B,Ò@€’a` Ä‚ B,±` Ä‚ B,Óý¡äÁd;0)„Év(“2]¸\sÒÞ`›M6ÁËÞ(Ön§ªØ*6Rê~þýûÓðK!&媟HÚ;aÛåM‰–i¶Úù/ý™üÏ?£ :DX•o8ØÎ¥ó[]N5âbŸV^¶“ë©<§k)WÒçTTžâ2„¬oâ¬yÕžçµ3—ör|ÏöªÂÀ'@(–ºä¥4UC.aÞ7Kù´â9VVÅoÛáŸÂN;szpMjŠ j,²Ngðwcà6V­Y¬¤¿\b™'i—+JÞK§’n#M¶ÁQͦkâÉáL¦q | œ'5sR“M½ò&’Hß¿:ß()U°©®r"œÂc¸Ú5VS÷ºVi§cøʇ'iS.&OU§|e { ›ê{ œ¦ª²kàä>¶Ú9>BQéùJfÊáþI±g&4a¢˜”Âd;ð?T! „XŠ¿¿é‹æ÷§æ¯ÉèÖÿ5÷7õõûû[]m;~û#a¯¯—|+KøéÒêÏPåµèV~·ÀøDÛÑnÍÇ~ÙšïT­ÛÍmÿÒ ªò½ú‹QõfõÕ4ó»Üävšbû¯n·ÜXÔœa7 v Œ¿"«ámÍÇhü¼cô mø[ÔH®ïÆbËÀÛv׋OIªöŒën<…·µ¿ÕÎè| ï${ T[Éo1¨•¾n>›õS97Þµ£eóÿ^wq¿ì4ð;mUíxjŠrZ5ã©Z:@ËÃ@on+Êør¿T;ß9¼:ýtçä½í—×= o>ZOíùÈñÝõ«ûן'g{T•¦Ó«¬r^<9ì<‚u…Ätl¸üêxסwâÙ¦ÕLÚ|q"ÉInÎlÝŸºõ¦^ÁºsuV{϶‚,îü:•·æ£?·qû)\Ì(_[é¶Ê@9/™RõWŽfÌ@/%rfÖ¾Òú5¯1+í›áôç×ô§—ÝjuZÓÀo5M¯sâί˜›#ü]1>±Éªš·è(fÓ½*åZ{ 8Uêþï0°Ds ô+Ÿj RâXq”¦Ù[ lίªs£æ–ý>ÈÀÞ¦Éô¥c`£\Û@bk »š7hŸKõ Ï6°zµC2°o÷¹æè¿¿*O¦/KÛÀV9ÏÛ5æhu½’ǸTŠ6ºÊÉøþ6åòSÄ.[ó[5°=Ýø"\¹tæIüL$½dÓ;“œÍé^=¯¾,gã‰!˜÷jyâM¢¼ÏH#žl¸\ëèâ­‡,°ñÏ_2ߤ—†tw5-KïU«ùpèÏGž»~ò¤ÇáãüTÎìÜ#¨*ú7„~kúçÓgp¿Õã\£¾óØ÷Ñt¸¢6p÷L…fý›ü¦lâŸÿ7bù?õ}ÁFV ǽIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-mmenu.png0000664000076400007640000000752512173477702021634 0ustar npajkovsnpajkovs‰PNG  IHDR3a²"Û‘gAMA± üaêPLTEÿÿÿÃÃÃËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßß4a’ÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿ<ÿ}‚‚Ãþ]ÿÿ}ÿÃÃÿ¾}ÿûÿA<<¾ûÿAA‚‚ÃÃÿÃÿÏçççMMMÏÏÏÏÏvv­bKGDˆH pHYs  ÒÝ~ütIMEÒ" 2ÀÀ áIDATxœí ’£¼ùîÀAæ¯J{ÿë¼I‚±$ÄÆI0Iwí Á`CpÇ2f¼€$ÿäÀÈòëŒ$ÀÈbœ9¢4ø&\;sóáîÄüÂó›ˆ4ßÍ_œïf×™¡J Â™¯çˆ3a¤öwÎ9Uè„Ðݤè_« ¾‰µv¦¬ÌkãÔùÅ™¯ç¨3Ûcø&2ΛàF8¦7¯Š‰M87xvYp²Üœù@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g Î@œ,8Yp²à dÁÈ‚3g KßÎœýíã§pöEßgºã싾 ÎtÇÙ}œéŽ³/ú.8Óg_ô]p¦;ξè»àLwœ}ÑwéÞ™ŸïgZ¹9sò§þ½àL3‚3‚3]3ÍÎtÎtÎ4#8Ó!—pfx0>>œy8Ó#×r¦,­:±FÓ.óâhÍe÷8ó –íÌïïG}î9ó›8ÖÎ<‘OvfuÛpfë;3Eª°JܲΔ4ÓîwæıæWØ»ºQ8ó íŒÝ6úÚ~ ó=ž ª ƒŽbÕ;½ gn\Ó™ \…ˆÚ™êÌŒwfØpfÀÅ5±×Z;r7æμœyygæºÇ™—ñ!ΌڑÍØ´ÚŸ¼3#ÎÄ\Ë»œytwç×KgÜ=ÕÛMÓí§ô–‡»3ªÓ<šmogžÏzgúgžð·‚3]3͈s曎]}·£Y‹ËH­…G8Zdgšë̽Újv½&3ßáÌþ¦ãÕ»ac¾0 Î4#3RBÔ8EªhÍW[Ý´–OJ.]Š…‰Ž«ÙÇÅ™™ÄCgš‰ñ¬ygdÚZ^¥Lµ-¦L]Î}bìí—=†C[‰‡IœiféŒþ¯ÔoX=ËõûšFÌÈ9WèQWŠo²ÜyáÌ_pæ),©m¬=ÖÛûÂ䫱I”3‹àä÷ôJŒ60êdÜ·gšYsfmÍÇmgt¾ ñ‰Z†»4ë±É–ã9ÐÔàL33›±Iõ[vœñùÌÖýþÌÜ šÖÂ#ØDú3ïA¢1½©S3WŠZs»Œ6ŸiIÄ嫱¥AL!Rþƒ•}tks† ц3/Â;óñàL3‚3‚3]3ÍÎtÈ¥œ™ÿ›Â ×¥4#$ñ^f[Ü#=0ŠeGî2Ãywp¦qíÌM˜=g”sf<õñ6Î4#)gVRW+lÍ™ƒÄÎü±° œiFbgìŒ')¥·éqX7j2úÂô0_ÔB¶²‹]Lâö0 Î4;³v5önìÕÔ½59•Mãöãíèèj{Ý'ÎÛpæ5qfQ­[ãõ¦®­3A™¶áÒeØ¥×#Øå`ßgšYsfnJ-™wÚufTzØ2çƒgö\hbv±Î؆gžÍš3º~×cÓ¢…Xmg¢Ð£ñUë¼p&hoŒt8ó26œ™ªA÷Y÷g|vñíÌÜTÕmaf4Žöq"ý™ãœ)czs¨P=×haz%RãP­ùÙelò¥ˆ)Åݯm%ÚÂpæÙ8g>œiFp¦Cp¦+p¦Á™¹–3ÑËÊhÙÖšî„þlHéï¸^Î4#+soœiá“œ‘ÝÄ`#Τ¹ž3uÐÅ ÈÔ½ÕD=lRk)š…­mü ÜnÁ™÷#ËþL•gÑêøA^ŸhsUg¦gXj—º0ÚÌÛÎìëâÌûñ觵I8£2,bÓO¤ÕbÌØ$Yž³p¦™¥3ZÝTM\ø±;,çrkgf%ÄÅ· gÌMÎœlõÃ0dvsάÄ&ëŒÞs4Ï WœyjSƒ3Íl83÷@§5oS8gû3N–Ú^ôg´3UÀ:œ9YÓ«]ÖR‘îæ&NÔk¥Nçû&sÛ›Y–"³,Z¦ÅgÞw¦ghgú@.äÌSÀ™fg:gºgšÿ·Ó Õ ]ôlŠ¿?Œåy8ÓŒÄÎOuÿÔYÿê.óÑÍ[™‹ß4,YM¥îÃD³P¹Õ¶Á,\aGÛŸÝ)ÓAå³—ÂÜtlZ¼iX²ÑŸÑ­K]¿çvF¥Û¯•—,r&ê«_ºÕ¼(,z;µ¬ÍOT˜ÿ0€e«<ø‹>¥éº÷ ƒ½ìZ4íÚj;ãÒj}f§gŠ5‹2qæ(Û÷Mƒ½èæš.nw71ÛÒÎø|Ïpf36Ùw†?ôg¦.ÅâÒZŸBYt9>ΘR6cSXؾ3ƒ>œ9H4¦§ºškl¢ª¸è¾Iû¤ƒ‹¾ßú÷Ïç–U4gøWkJ5ç6˜=MæA•ù/zÓêÔÁ±ûì ¼r\ÓoæoÎø1ø&nÎ@‚g~~Þv&p´3wA¬%?›eŒcùu˜1Ú}·2FçN ÛÎÜVÊÏ:7B 6óK3øÓÀ™SÀÈ8SÀ,ÑïÏ#Q¯Ì6>ò[¦íÑ´6'NñL%Žáša:äO9—ÇIØ5s¼5]Ñõœç ûÄÎè6§T‹”Å£‚~—%ßX+@J=¸NŽÚV·øD½uœUÕü™³–ðxáÂïiô ‘ gæææ·‚–²¬9#¦u‘¥3~kX•s;#‘3Á)Õê@8ÓÈ–35@­83áªY5ù68éDµ¶îŒgÅ™àÞNG ¥³§/tƪ|àç<ºU9’uFoÓEÍÇ´ ÚÈ°ÑŸQ•‘r&jóögl óΘžVe¯?3úãµ\ÃoÃŒûû‘9íG¹T?à%›»;™û..4©›”)ØDHâZÔa¨¨RÏÚìªJYH÷Á¸oÊ<;{€Î@–ÿþ¨i?¿’A/IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-othipfltdefine.png0000664000076400007640000001201612173477702023506 0ustar npajkovsnpajkovs‰PNG  IHDR2bÛtÂgAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}ÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿ<ÿÿš¾]Ï0008Q}¾Ó×Ûš00óûûÛç㺾ÃÏÏÏš0ÿûÿ<<¾ûÿÿÏÏAçççMMMÏÏÏÏÏVˆ­íbKGDˆH pHYs  ÒÝ~ütIMEÒ,ޑ܆vIDATxœík–«*F3ˆü©QœžLÖ’ùOät'UEV|€É·×=Vy³*Wûv†bÀ”N¸2wƒ"‚µ|r”ùÓá©DúEó»Î|7o(¾›%eâôg)(óõ¬PæåË”Ïuú” ‚¥ Pøêl¾‰Ê(7ÒÖ}>ï…2_ÏJeÚçÄà›p(ƒ‰ üaÝÊK›“˜˜  ø À ”N~•yàÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ ­Lï?"Þ…Þ¾”Þ¾”Þ¾”Þ¾”Þ¾”Þ¾”Þ¾ÈèÊü|Pf#ÊtþΟ ”ÙÊeÊŒ”ÙÊeÊŒ”ÙÊeÊŒ”ÙÊeäRÊÜ|¯Õúsô±¶×¼áwÊle*F™¿®|v'ëS³{wÎauð Ì¬LõØ  LË+3OSq¶Š“–T&îcZ\ґѧœÈ½8vÞ\0À(ó­PÀ”qAÊ@ LK™Û¶íiÜÅÀ7k£ëV?x“qÍ€sô[¹á€”i*cuÌZvWæÖ8ºB™› e.¨Œ7tsZNãfmB™c”¹…çôg©×Ǽ3Õ[á–vÚñ^ûdÒ!þ4rH3Jyìf%­Š”*ÃF™fZʹL}qeb‹Æ&ùGÚ‚8’»#…”"!™´ÌFåûÕ8wˤƒ=ïb•4Mè÷_~1ç}ùŜߦŒòA4°è‘W§ÈLAÊ®*S´”Q9´r¿Õ~•i(cD* À•™ LX£Ìë «;äÆš;}mõ0%úd³2º¤Ú9Í4”1kdCá©Œ\ 8›Ë)#{@w™Ý¯7#ÞáʨQШT£F(ÄQæŒÿc³Âµ”¹Ù–ƾ%»¾ˆ'ÆŸ›Ìæ en"@99Õ”©Ô¨51=ÙséâÊ°{Âç½å™‚Ù›WL,í¯RR›Yô¹™;›o*#zÒªQC™C—©¯­Ìñ¬ê¦‘ `Ý—Á(s¢ÌÉŒ«ÌÆÄÞe~ÃØiùA™­e Œ³õ„2sßÍ?ÿBÐCôgµ{ç}ñà ¢±+(Óíú:I"·Þ­û£ =˜+Ïž¥¸{Æì[J1up‹ôŽ×oPfOU¦z,2ïqefi*Ê<ç«Gžn¤2ó>îAŒõ 6w¥`ƒ+sÆsן¯Ì+œ<ÝÉ=ÏÆ*+Æ{\Kñm‡í )ó(N\…Øã*ŠLEÆ’‘¯ªÌeÚʨ8bôˆWV_¢L§í‹(Ck”‘ÿ–2t%ež]e¶*Óœ˜Šs™ÂŸ)WQ¦üóÜP&<øyìÚ‰‰ÊQF¤òÈ!sšüéʘÏ]C™°11?×9—é ”É›™NËÊll=j7Ù·CÊ@  ”qAÊ@  ”qAÊ@ØJv/ Ì• ðR¦Ï“µL¹eÆ…B~ô­PæJPÈØvÊ\ Pʸ  ”9ù1I(sA(peÎ~Ê\ êoKP0(àV”qAÊ@ LK™OØö¶æ¶Þ 3ø§öªL}9/¿‹õm(àiɦ2ª½öW&ùðÏد‚lËi'(@™‘•I?½C™ÎÊü ÏÙ#ÎR¯ygê$ãµxò­ÝùeÍF:ͺ2æ Áe¶‡+ƒg²ëÊDG æÿÄØPù&{kwm”É©ÊL²P9‚™tñ ÏsF<“m(Ã> e^éuÐüœòå¯Å»}ËdÒ1·tjü/È·ƒ‘ßMågç´ðL¶_™WWªÓ‹ÛM÷]ùØuÊ°ýÆÄ”ß[¾±—éÛêõMPÀ3Ù~eıãë®›§¿ë•1_?}Ó¡€žÉv*“f¤R™Å¿b¼ŽÙHšå¬f«˜Ñœt-¿pŽ2Æ3Ùg­8¬ ›ƒØùé|u#h¾O\¼A\’îò4ÅD5þ䤙$e¶GIC¡þLöiëÚ+³—{t Œ2;ñ=ÊœÅÇ+óQP€2PÆ(e\P€2PÆ(e\P€2PÆ(e\P€2…2 Éoýteõä ñ¿Têý'˜P¦ÙÛùôƒ?Þí(sZš}2ÍÆØÎg*³O¯@™ÓÒìËw*SYR>bÕÊÔ¹–2ª,eÌ PÊèÆXe¾[¹¤|̪3”©s-eÌ%å#V¡Lk)3×^.ö±ê¼ëÊø|µ2jIùóVbŸ^¹¢2û2ƒ®:Å>½rAeÚç2f‹­:Å>½r-eÊ%åA®·ê|ûôÊ•”©ðyW7G±O¯@™/bŸ^2+8MÊý®„ʬÊp Ì   ʬÊp Ì   ʬÊp Ì   gxe–×g_>)—Ÿ—›dte¾Þ¾”Þ¾”Þ¾”Þ¾”Þ¾”Þ¾ÈÐÊ€2À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N  pe€(œ@àÊ'P82À ”N Ì÷@û$Ô¡'9m"oF$"ÊCå–ð«©(ft;¿õ]žªºδҖ™Ã›¢ÆnÌ?sªs»SyÌWFgÿFOPþ(Žé­ZÂd0êüú(cÖv9­Ã”yðÖ Þ2¬Hó`*#vx{¢Ú²zke|léÝîæÙ'±VÔÊë‹8xÍCÙƒoåð|>KÓ'"P+1K™J©Ì¼Ofô`;côÕ+¦ ¹mytbemÍæQщ—¥µ³hžfn[©Ïʤ²É¾g?ÈÊ+ãõÖ’[£L¥àÕQFF(&dCµWhYøVÅ (gk·„U[³yÌÞÓGŒf¿–Ý!eQVæ¡~3Z–e)ªÀ›¼ˆP–ÌJS4OÙ"¿kK(#ÓhB§Y(£sdßt•éOá'™AŒ}ºdTQT)c~£„ï^Ö*óJ> ú“D%í"Wù}5ô¨|­êù™ñœÊʘ›§‰X>=3!µê¢OT¥6c®S¦Ü™•©TzÏ(S–K0¾dk”ÑEZRÆÌÏŒwˆ2VÅd*ebTþЃé ³­eàEe´Úç)C£MDašåræ(Õ ×”¹7'&V²etÅŠo´V¦ˆÀŽ®8—aç$ÈVb;S/M$ò³ÏeXÅÄ‘½•Ñç•â:!aEœK/MSçûꪈ5Ny}a =2w;?X $ÎQ›{¨R²3†f„9\㊉EW‰‘„ÊÄtÉ„Nå“î1^RuðÉ›Íx›J¶gµ ŒàC2 'P8YV¦5¦çé+ÒpŒ‘¤o‚,ÇXØ^(ÂuPò/âRiEä}çLó¢„gWß±M™ò<}9 _Õ×5j5ña•¡t±ÛE™t¡m$ eܹ­8¶Y™¹Zµ¥­¥ü7#îO,eTW&®ØŠõb’wŠ»-jöde&KV¤=ýÇ2‚2i(“g§Š23R™‰÷rfâ;ÙV]ME㪎O;:£RYÌL.ŽSFç$N’YÍÊðc<©”§ÌÈe€‡ú¹ ë —2Ö€¿ö\Fžph eÄYVfé\æ®óÛЂ_¿û«¯DÒ¾¦RþzÇh|xÉPÌKìò$Ék¶UQ&ÏAÑ”\j”ŸeéŒØìˆ+¦7( Ì‘€”Nn8ù°fþ û]ÒIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-othipfltdlg.png0000664000076400007640000001772412173477702023035 0ustar npajkovsnpajkovs‰PNG  IHDR2`.obKGDÿÿÿ ½§“ pHYs  ÒÝ~ütIMEÒ . ,ÕaIDATxœíÝ_nå*¶ÀaêªQ5•žBGÄQ”AE[gGÕSè©TžïC?ߟKXàÅ_/¶ŸJ¥Ä±cÌ2ØÛÛ9Ìøæœûñã×ÕÅÀ}~¾üÏÕe࿾þöû÷Ÿá¯?þ‘.IW ÿTåH§aCÀÓ(…%uÂPþ|üÉ/‰Ö¬â·íI°;s“xÄ$¸³Òh©Ç1èñó{áˆÊ¯CDf…%÷u:ÎG©tÐ*î-ªÃ’~¸“þU\Ÿ[J¯:,µq€ÈÄI¼T:‰·2w€}æžÄÜ™êã´£FH? @ˆwâ¬àx[¾;çW—ç^^yä` a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `ÈwçÜÛÕ…àÀh `aé6ÞƒÀCš\n[kibœïWK¼;÷‘ÿ˜Ä73šÔ-˜ïcôXdF#pÚÀhé–ÂkØh¡8®zÿÚ­6Ï-Mb´tÉ™¯YX~¨WŸ&n+}h­¶Ù¤“{…§éB…Ö«I“–|oιýúû7,,„žÏ×&ñ†–†–†–†–†–†–†–†–†–†–†–†–†–†–†ð5€·ð¸º°ãmUF´:xU­ŽÑÀêÑÒçëKøë¿~¥Kz ôùú’¦ .D­·ÿÿèÇG¼üqö­ÄoÁHŸ®,¦y¤.¬MSLÆ¥ÇÝæš°£:,á!ŠáÏ„›rz”۞Ɔ4M¿Iúƒ2MeQaJîp[[¦0‰w …˜4ütÇI~Éã£1ºÐ³lGܯ]Ö¬~ä!œñóƒ*¿0u¥«…s†éæm ïlFG¯Lóè)¸˜Y–¢ù=fÒ°!.L—G›7,¼‡¶åî-µ%ÒÏ_Ãj¦ïˆ[ÀMŒ KÊQÈiH ˆ*I„ŽÄ…÷öìµ½|82p>„Ñ€Ô˜°¤ïâÓ¨ÓŸ©˜¦fÑ£é›èì÷§Þ‚ 'ôÊkxzOâ I6c  Þp¯Çå!Ÿ]^SÙzO TUÑëX9šT,,DNn¦.÷¤‚pÞOT¢4ùŽÏ ì£|Ü£C¼xMXöÍ…£wçΞøqÚæI$>Õ"âekb½“V„žÏ×—ê°„5¼LÖ|ø £y'ÞŒF³1‹°„/Í„g$,áVªÂo¿…e=àÑêÐÆÖ#€›#, !, !, !, !, !, !, !, !, !, !, !, á â·ÀW Àã‹-°^U«c´0¤z´~syô-æé—š_Ržûzòªo[o(Þ.)¯‘~CyôíæÇrq!i¢™þk˯]vÌÄûñׯ#2áZÑ—Iû_ÅÓµí ªo•&”|mŸ~ùµk”‘“x[&Œq0jdMX3l´Tž¯‹V‹Ö GTá a´ð˜FKSÓ,2šŠÔ䥳W Î]*¦³[¹…¤ `aaI3_'ñUî®Uzg+`ÊåŒþWæ.þºè*2]..$Mk\ö$^®g?–—ÿZ›fí&Qˆ}¦˜šqsåÎi¢q´´ w>úŒ*€˜‘L¹ÉÆMÍÜ9MÃýÜÒöü¿K2:–Dæ­Ÿ-LŸI×!Mº,,å:÷žNTÀˆBQ”즑iÈX!ê¸o•&j…Ï¿¥‡ zºdñš°ì› ç©ÞS¼Óg üã ……a §Ï¹äñ¹¨<§ë„%~>-|ú´Eú«u™ŠV=æ—>‘ú¬i>“Å/?Ð#·vM¬wÒê‚ÐóùúÒ–°Qo'Ûå–WÇFÞ‰§?F3ÖÄb„%Äxi&<#a ·R–xƒø-,ë‰V‡6FŸÄÜa `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `a `È÷« ´xH ßV—b$öÈ>öh FKCêFKŸ¯/á¯?þúÕåçëKÛ†å4›Ëãæ©9£e…™Dl$áB¿$ÜÍãתööîÂÏÃ-Û£eÒ‹ Owúµjž¡\žòšú"vß—mȾ;©> ¹ý€zºò_3Á‚ê°$^ÝÏnµéG±añÉÓœÝU¾Pº§úqªs×_â¥tç](Ö—GóU{qù1En—ctÐ~¯ó(ÒõÈCÛ kT]ý ·õεŒ´%ñÁ'q]Dãõ½ ¯¸½vS,|4­²×Ežù‘‡cêl}„ð³v~î!b¶A”Ýí~;3teXÒWbmuGØy53zšVu+µMm}àÄÂ?Mdšõò¡¨‚¢Ñe8½&®©_è¤‡Ü ¹—K[ΨœBšÚŒŒìë?Ö”÷h»¾ êäÚÚÖnëÂwúæÂ&ø»^@Íwyõ`ìcf BÏçëË3ß[l‡7ˆcK[_¢ŠØ#ûØ£5ºFKO<¹ ¸D{X _Iý;Ý°9ÓÓ ‰ÊwAý%€M5Nâ=ÓG·vðÈC5b0ÌÓ2ZÒ¼<Ô¿´ôø5z[Æé{·ÄÍsrïHÍ,J³êRé ÄBê?¢Ï½\¤ÓŒ` ÃÞ ~ü{=¶‘·h§iŠ¹J}Š-J°¼Gåò´iF-À…ÆLâ‰ïëì"«6W•”i¶}â}TH¨z©qÀ“1ñ¹¥Ó'ʦv¾å·KµeÝù>±p[&ÂÒµ—ü¹ÜÅ)ÇÎ45k¦óuµ¹À¾Z&ñF½%pý@Aù™ª¶çV›ñþrb€g5ø‘‡ƒæÁ9¿ÚÊW§O÷ |Uy¸_Ê=Òä^XžOûÄyî 0À¨7ˆ?÷~.Ñ5‰Çh W±ò=1FãåCÛ`l à.x@|ÆM)ýgŒ–ÝÓ¿¢I™ ò#Ã6‰ï— W:FäÀý˜øÜR¿›ÜèÚ42åÞœtºÀ 1‰0¤n´”{/¸ø¶ï¼ÍéÄ«ê ¯Ï½B4déÜÍp¹òmx;˜B[ÀlÕ“xâ+«•oæÖ¿A¼öÅÞUï//$¦s7]¦>ïŒïén®:,‰ÅìÄlÕ\°{¾<gû?ݳB¤Æ?òp·nåZŒE£ž—áxVOò$ÞUxÛw¿'¸[` ê'ñö¼×¾0{Yi~Qzní{ðò·[@˽%ÍMé¯5oï|±·¦üÍï/÷exFþ+6¶Bñ=ë9Uo£ð|êÞ þ½ä.ÒÚ¦þ=Þ‰†$ XÁ”ýXÏ×Õ¦¯Y­\¤Îl?ËæèÖ%„žÏ×FK*Lº@ŽÒ?M¶0¦I‡Í…!&]’ £¥ûz\]€-¼½ œ&@·òŸ¿Ž–xä`“x÷•Žü àøSyLPØüøkÛ"L6J0]X›r´­¸›ýèAXº5±çõÝ÷ihÉýUœøÒˆrÔ—D“r.¯0ñþŒtb_„ýòã£%À ïهĤtH”î&1 °€ÑÒ­åfÌz6ïéÙ1j„& `„¥[ë¼4äfRšæµ·|¸·\‹°t_UÝn4›÷ø˜ÕkŸÞò™:ÕÆ}&àr„%¨¬é Ó[>ǯËÂq¸<ÜWóórC6a _„OßÅz{ÉšÓœ·›:ñò¡ûzœ}võ´³7OïB…ë÷§YxÔ[“fš¬ø¡]¿œ—ýª^>Ľ¥[Ëu¯ÊnW\­³Ë^–¦¸œx\ŽI<,2c®Œù7àù0Zº¯“aõprœ‘f’EjuÕwÂh `a `a `a `a `a `a `a `a `a `a `a `a `oÇ–ÒB^ì½)Ž&BÏ6Zú|}¹ºíô…/¯¹u%¸¹êÑRÔåý÷ ×+S¨Úðóõ¥výh‰Íræ¶UVrn7üõ«§$»(|;û%¢:?=šcdù8¦eë)møŽ|»ãÍU‡¥£Ùõ´¿£ÓlÛ¶,,UÿÉ<¯œ©¨>Ë•¬ÙÍ;D¦£ç2Õ…ù:gÀ 4{¶I<k<÷E.4à‘‡ã Ñ_Š3Q…œ›úH,§Y;g"^Ø.(çiÊ£V¾Ã€É"„gDÚ¢?ž2bK‰¥çfÕ [.RºšrR¿¾¦†¿¸Ä˜'ñ¢û"i‡ØpsHlñú4õgòµåì¤ÜM\El â$máº':¹ôå6Wž°…FSÜU{” K§­­§9¶ÝãIs O³Ü²¾œ8Ï­‰ŽHÏ-ØÎ ›· ¸g76†J8lö¹¥\¿¯¼ çX—,)Ϥd‰CÛÙúñ‡ÎSfë}ÇU6 Kòéhi‚éDÖ……iÓsÊp" Á¢'ñ”g£¸Za„äдþÂÌøšræ(gÿzî{Á²ž¦85ñèHS÷O¯ýã´å¡½xGTÜ÷¨äåˆÄ>4­º´J ¿*k>æ{:éhöÌšæˆâjZ].YÍ]¨Î ©Ú¸›a)w‹Ë£¾û8ñ”§_xê6œ´3:Ç´xµ[‰µÔy™¯¬yM=ˆë”7¼¶3ÕW]nšmº¤|åT@øBã'ñÊjŸ—K7_óTÒ.w˜OkÞ÷¶buî¦ñZ*‡¨ò4\ÞÙhõŒ×'°Æ”I¼þ4]¾=è)änPϸ*5ªMá’Z2û0¦õ X3ñI¼ÏãgxxÚçfÌf\o*Ó\y©+Ö팠õ•ݺ«M³Ó}^Õå3IŒœp[cî-å>fÛüLTu4³óÍ“{飹ÜËk¶Ý[ŠªîtÞ)¼Õ|g%‹ ý]åÂh¹ø\Ií1*ì¦ò …Âm¤¶—¦B:7/´º†ùæ†þîÜÇ•¥Áîx~ @µ ô|¾¾Ü÷ã´ƒK‰¡€N„%€!„%€!„%€!„%€!„%€!„%€!É[Þ¯(ι8,ñŠÀ¥˜ÄBXBXBXBXòÝ9gñ ¨÷óÂh vôö¼Ÿ1Í~izºÏ/}|ýÓ±~ºðqég¡r¥JêTn­Ù_Ñy|KªŠÔ\û‡^lŸËÊ£ÌkÒáX£ùD¨M¡sóõ It"ÛêOm±ŸI¬JórÙ°ä*Ëö’—ó,wGÍo'=k\&®8Å0 |ÐÅôWv='ñÌîH,í^»`Š¦>¯­Þ[å¾iKî,ö¦{½žÁéÒh)G3uà+"ZY®†WXó4¯Ó5õ›†Õ§»_X³g7{ˆEê¯ùrv⎟¦é·®(£Ís…OsïoŠUÒ\Ò4'IÙ’s •iV^\³°dàæ¹…z Uÿ)¼fú׸RXÊÕµ&üŠÓ ¹_Ó!­þÆLyj5ê…Å…âæéBý„InÍžÝìÔY$}}úìÂR»›¾åZÊÍ„<2“õmM±Vzv¤iöŸþ×òêŠô'Bí)£i!›wž\mÕiÇa÷–zäš]ØÑè·u™UW4Y4˜QŸ×ƒbÍçV»C}L3wŒÄÃ1¶$§áŒŒ”©õ§™[_sE5D穽,ÍZ&ñz(‡Y.8À§Õ×Ù®½ÀéÌ}`ÛâŠ/²þ¼ÕŸm›7¬¹ì4Ôg´,ÍkOåvHšÖ¬KUõ¢¹OÇÚS‹4œµ†Ò_ŸhÖÓªœÁÓP™Ñ²4¯:æÍäodÑÇiŃZ8ÒÑ`se›èY¨O³sÍN[/Éýí}b±;ؼŒ4§áæ=#£BšóŽæì¶Ý_·P=ZÊÝnMºdýîE‹š×¬%fTÈ]?- YS¿›®øˆRC‘¤å¬ÚÍt!µÔÜÅ2Ôæ^N³­HšÖ6oÍæšÂ‹‰¤³ÄšÒ¼¹&Íý‰®ÙpúŒ=îi-m“œsßœs¿þúuu1ëv¼êDÎŽGsÇ27xy}áxÀ¹›ô7ÁÑ4ŽÑÀ FK[憥IO&»ì)¦ùÖ:ê'ýwm‘¦®?#…IU¥i¡-E”Ò¥Šž‚Sn8Jš…ÁºD<÷{:„† 6Yý¹¥~+ŸßQø(ŸÅµÞ¤wö` ±ò·8"Lâá ™=ßnåí뻢»—¡1ˆ5`¹ZJ_=Ÿ[è¤W-å>ÀQ~Äþta•æŸæ.DrŸ Ï _Ù"M¢ÜwqéUçΚM®TbF…&'æuš‘{º¶$Ö|y.éÅü¡6¹üþç¿þëøÙÿ.D䨙M«È{ÓòÿüùÇ‚rÒ‰°¸ðw–kçmôß?ÿu‡‹õ+yà0 ôóçWáoÑ%È3âI•üdµdPÛ Ë…XaÛ˜Z$;}HNÝhé¨ __Qeiª/ªútCŸE!£ÈqÍx\<ú/$Ã…éÏâšb.áõi´­/CnÍ!Â\ åö=Z¨ß£Q%Ï)ÌEYo¹r*æiÊb‘ܪZ*ç~ºùi9{jI<7Ã>Ô}=µý†á€£êÔŽÊ™k!¹}ì»Î‚éw3ýStꞶÑÖ2:—¹›þ4ñ6Éš{'§ªêS¯|ˆì»Ëœ†À¨SÛN-‰ôµ”k¦”µ6Zk!GcØ#kæd;ëWNÍnÙmì9–g¢Fe] Ò±Ü}œë³?Måšúª›±f§Ó{i¾ ]ÛlÆ>Ô*'RÎ:\®¯¥v™ÁOâíhÇÃv*½Pºp7Óy†«JÒì Ïcôe{ÑÙ§?7<€š‹UûŽ–ªŸÄ/ôw‰.—Þh •{ÌÓþÔB‡M‹E²vYÝYÈÚ•« ¬Oý‰K°óÀõ׳R®—èI3-稒{¦´­ãò°eóc®ÇnF×£ÖÎ÷SÙÑRTb•YºZ9MÿõN8ç¾^2ˆ·õr[éŸJú™y¾®g¼Ü0­\ÎKÜ£ªÝt£gNo…Ù¥ õå¬ÚM±>Ó……4•µ¤<_N+$̨§œUµuˆ§“Qa3ÎïJ§-9ü9wvŒmÉ…=R>¡P8ßÛº¾þ6ïF×R¿oι?~)×Æ©ÁÐ<;Ž…´¹I·fÐççKõ$ó|ûÏÿþçê2ð·ÿgW4hR´IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-othipfltselect.png0000664000076400007640000001066412173477702023542 0ustar npajkovsnpajkovs‰PNG  IHDR1a¶× ¬gAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}ÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿ<ÿÿš¾]Ï0008Q}¾Ó×Ûš00óûûÛç㺾ÃÏÏÏš0ÿûÿ<<¾ûÿÿÏÏAçççMMMÏÏÏÏÏVˆ­íbKGDˆH pHYs  ÒÝ~ütIMEÒ6Þv?IDATxœíar«¸F½þ° 6ã*fÿ™›¤îV#ø’àøœz76 µ¤ÖAÂv½šÛ à;™04Œ1CBS>;ï„[c>lø4¢¼‰ü;‰2ïn ¼7;Ƭ{ÓºEaÌÛ³oÌC—¹>çüNGá"$ÆØåÄþÙܪàÈטõ  Ë#/Ƽ=ÇŒé?Ã;qÜv%ø ù¯ÎnWÂø€_ @c@ãv»` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` h` hð_HŸ3fú©†^“+¥§Û—Mc¦È­´5&ó.-r¥L-LùاðzôZ½péô˜QOƒ¼í-c6FØi0¯0™7Óò//p!¦¹7”o1æ é1ƒè4‹1 }c¶j솼zzN0f^7§e¼Ÿ«U9é7®5%îZ]Û“0Mm‘ùzÖ,}ʇ2­CÙºVöjé™êËƬƒüY_&wdZ™×/^³Ëõ’’ózÂÌù0ÝP¦Îµ¥žËü+¤Ç³ýûiÌT±ìâҼą6䦢t£–+±k¸Ùwäp©“†’óRé1©ãI‹=Œ™szª”Û&OÉl–[Ÿªâºøn´þ{¬wü2>?7»qã8jÌ%Ócº´ÑhϘÝÅ%Öjó½Í‹üä²{³ÆÔ]+dc®˜ž³™âvÔK‰MåúbƒM.ßWÁÓ ¥±bê\{­ôDó›»RY‘ËâXï:Í7¯™mÞ©%{JÿS3v;”iªó9×÷õZ:°ë§g2 n}ƒ×5æÔÎ|süçJéé÷c®Á•Ò#sèò[Æ ÃOµôÃüÙ­ì3|ðx]LJŸžå¨-¹™såhpøfϽ¦ã+;ZFÿT”Ëb¹cÌbKýŸ½‰Ö35lyÙTé¶ZìµØì©×tüøŽ-ƒ—ë]ÚÍcƘ'Œ?LK™æ^Ì?¾ƒGÍ}uüèÒ6f)íSbƒøE¦¼${…½ùâ~5„ ßvMá™™/wË[ãn¿¤vŒ¹e™‰wXj\ò¾ãšÆ¾Ý˜ÐJ ãטðgþôkcPŒñIøŠ1>§IÉ$Ø©×4ž˜ù$OïgLHÂAcÒÌDclÔíàç]ÁÃqcêäºýdk{2K]˜AW¼™]“ÆÓ®=%o÷(MÖ¡£Ësؘò%˜f­Ÿ¤ë‘ÿ€2Ô"ë5óbCûk7ä´kϧis´éÑÚ˜Zïò &“OþJàÚv{m'IZ°Ãa¿Bo´æ¨éÁÁz¯Å/ü®ô²¹ÚãÏÌØå|c†á¬H¯Ç; ½oÌà¦ÿØÑÇ›gê]§Æþd½Kóùà[»Æü+hÊ;z£×»ï<öˆëfϘa°¥³£¤äš‡n½üèJdãÛ=*c×£\šo5f¹ÍÞÒ˜:v=Ê¥Á˜`Œc€1†ï4Æ«s0ÊÓöÄÌ›±ëQ. Æc ‡ù(9”õöÈÑZ®wAÞyì‘ãÆÌÃ:Àeˆ{GkhµÞyç±;”oðL¥CGMÖ»4ï<öŒSWzåD|•·;¿]ƒÆ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€Æ€FjÌäÿä?Xþºs¦Þri/Hh.MnÌ´Îvo §9j5ÍáÝž15F Weǘ½ª[Ƹó—ØØ•>6œ¹,4­#ì =c&³ÆL®úçFÖÄX®m4W¢oŒµ¢Ù¥c&«Jy±E“_U&úÈü.ÕscOÉŸ|Ë O¾ñ]bL[n]ÇÌ…t‚«±]p²„Ç0ÛÇŒy´¢”]Ɇ[àªìó˜ÕXM4&11Ø•^ŒcvŸc|=û®3¹(1FyÈžÜ\•Mc–mkÙ¼–—µL²É¸‡óã>+¹ 5ôìJ²Æ\šÆ€.·Û?ÌíÁO7 '1 Q§îVþ˜ãäýv¤O–¿Z™óÚcn~ÅQy”*ª|‹>ÚÁ˜WækÆÜš#ŒùëØ]é1Åusù4`ÙdìÑúò_˜øbL †1Ƙ2Éu¶KF½f¯¸XÿaÌß'{ò]’rü_Tecºomž|ÿ­1ëG̘ºW¥±Ú i‹óÊ4Æ$»R&ÀÍüµç|Œù{¤Æ¬»R|ri¤ÚxòŘ?L¶+­n?+•kö³’ÿž}ƒ—¶ˆ1¯ ¿€Æ€ÆívÀ˜·a<'L5fü¤†GµÑUô—Ú£<ð£¥+iõ¼½ã=^~Ü<ˆc•£´…'æ¶T]§±þ­Q—¼í5cLlý‰‰ëKs-m“iÙÐÞï“Žv?Ö·s·ÙmfLžÆxM!3ÆP'b3±ñè c´öºôl9=çëUýycF3ëʵ¬cw{TËÛͬìi¶ž«0ö‚eÆlTðÆ,ç|Cwsr­~·—ÔÚ1Ä`íhÓô„ê£íKïd“³&$7ÆÛs¾1¥k~êÍŸ1kª\³ÃŽŠgkÌF¿7×_¡ÙŒÓ¥}ç{kk³y&²Ñ¦éI'/^IN¦ÓÚN‡SÔTù^cîá]’XÓ¢ÍxS¡íXÓ]LŸ|ÍŸ¦½»I‰©åŒñ1úˆ1cb‹æ>ÁÆøêôÓ"ɹسqÃÐ`LzC9ÝUóˆ^pÓ9º1æ\£þnMìظ©¶ÛKë‰Æ$$Ƥ[öˆµq[jJF!ÂÇ=7”­íò˜1íÉjÌÆ wÖ˜¶[¾@r‹1&öhϘ´½´Þ·“ ÌGiƒíŸ¸„Œñ ͵/¼kL4ûÇŒïIJ\_º»ÒX»Y«lŽwË×zwW2=Û1&¬¹Ÿ£1MsõÀsŒyæýŸ%s²Lr“"×^þc殜lL|¤tŸjÓÃ¥ó^´ð¤>™Ü´Ÿ,²…Ç·ž·ƒ­…Üãiw`÷ÐKó´Ð­°”ë|V2ÕC°1)2¶ÁbÏœMíg¥8c¶/cƒ¿8žÌâð¥ž9,Œ±üQa0~Œ]cz Zó„~ †°@ŽñËý;Ç;]ø†1„ õût ò¹fúyÄ6·}âKÆ´Oèû1´‘ËéfðË3–O¹¿bLù„„ŵµ×¾lÌ2¬­Ÿ³öÚÿ2½†6Y£u¿þ[æ[7©n¾0_F¸“?ÛÞ¦¿rï5d:¿ÖˆßÃ$_àœ2†1F9fLý¦ÆVwßÑÄkíÙ= ל1>t3ÓcF;Š¸¶|©éºT¯/5áöÚxY‹˜œ…÷ºÇ¸m¯Ç8ŠsÆàu׸õšHW﹟ÚÛöv®NŽ8©qÂãý¾óm­hŒÉr¿]=|=éŠØmÔk¯Œ¦g¾o.n6my~¿<†qL¢Ø¦Ë#½[¤ŸÁŽ·‡Ž‡ntºo“.SRr÷ë«ë†nŒÛeÖ+ã蛵­‡¸£íÿÝ—Ç„²Éý’“U_RR┣,Û™6MžêÀj{ís…ë|ªÚŒùäJÃc¨n;±5¢=câý‘´w°/MYoSÒùÚdòYiÍžý–§y‚^_Æ~uÿà>gÔ ^–(ãò–}®i?»¸’Ég¥e½51æóc(õÚ 5df×e óeÚ»‡môÅ&µ™ð89ÿ/ÁO£uà×»û^äkÌKñbÝý;ðK$h` h` h` h` h` h` h` h` h` h` h` h` h` hð_H®1Óôcý•ßšœjÌg|7¦…ÓZ†ö\l!+Ó‹²Õ¿¥”)œFÚrþ I‹¹UÏUŸÌqÚÛ¦W%šïKðïeÜÌZ¨Ðoæ@Æ-=c>Öç÷ÍÇùL\§Ôž1I¹¶…yÓ˜N½Z»wœ³oÌ:îd‚ÞÍ-ÊvJDc¶Ïýš1y_ì3wŒñblì1uµzœ´¥Ã0,wÄÇëÇÛÇ?³^ë5ûGXË– ³{I«cl…P4Ä ùòcpE¼16t©îëµ,{Ûš:”vÞg¢F«““‡îSçhÞja—̻ެÛחGßLÛÕ³ª®ÓQÎ «U!©¥°Êì^Š¡îdëÎQ¶9\}³™Tš…ÑÚ{$­ç[¨Š˜iv¹Î;_bäOmniYÃÅmËV-lí{û$ÆÌcÊRóo qå˜;ÆÌΘÐËxÃ`ça}nc{µfð£K¶z4-&,´nw¯õ|bÌ0 iè}clv£1ó^hŘ8gU$ßBÈìiÆØÕ/5¦dÜcïðž1> ö(LÁàÇGØîJÍÚä"÷Y—¤þ' ŽÖ^õƒ‹Æ$ŸBcÔl>íÓKfŒi2Ù•L?ý go3Æçb~Ò³Ò„%ËõÚ7ôc².nm¡»yåΓ <éåŽ11æÜ5¦¼žºÆL¶Ù˜l^­]=nLòâ‡!åh.eÕÆ$Ÿ̆kfßÅsÙ‰ÕÃËìêùsI…¦…¤ƒ®g±žkÁn@ö µÜz³»”ŒÖÜÎåÓQ æú›¥gvÙ -ìÓüJ.˜_D[ö`S'Gc^_6@áû-°˜,:óIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-pktsize.png0000664000076400007640000001632312173477702022200 0ustar npajkovsnpajkovs‰PNG  IHDR1a¶× ¬gAMA± üaâPLTEÿÿÿÃÃÃËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßß4a’ÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}‚‚ÃÃÿÿ}ÿÃÃÿAAA‚‚ÃÃÿÃÿ<¾]¾}ÿûÿ<<¾ûÿAÏÏÏÏššÿÏÏÿšÿ00ÿeeÿšÏÿ00ÿ0000ÿ0e0eÿ0š0šÿ0Ï0Ïÿ0ÿ0ÿÿeeÿe0e0ÿeeeeÿešešÿeÏeÏÿeÿeÿÿššÿš0š0ÿšešeÿšššÏšÏÿšÿšÿÿÏÿÏ0Ï0ÿÏeÏeÿÏš0<0}0¾e<e}e¾š<š}š¾Ï<Ï}ÿ<ÿ¾0<0}0¾00<00}00¾0e<0e}0e¾0š<0š}0š¾0Ï<0Ï}0Ͼ0ÿ<0ÿ}0ÿ¾e àŠ> Å?èTúÿœ ŽZ’óc-—¢¸Z±¹À¶¸R1é>XûœÄ°F1‡üóIÅ4MrÉb¹›ªbξÿõEq~’W>I:ÉAG*©7òÐÁó”£R’šÐ½ÊÁíÎWt<ËøU ¿@ÙDö8b#ðVk+FNN «ŽbxöAJš9 s渂¤Õþ±U²bòÈqt#šó°½¯Yž¨¸’–bxc¥~¿œKÄ­îE'šRÌ¡’TL×YðzŠ9Ät†ÏŽŠt•(OK#GC11ÕÁ²2†;ÈfQé8‹5lêúù‚&ŽTgRžDÌ,(.„’J;ÝÇÅ47•pæ©‹b*fCÐìÂSƒd£° P ðÅP ðÅP ðÅP ðÅP ðÅP ðÅP ðÅP ða*Æ|ž¦>`?x¨ú8¢ÖsŠF³®g!NùÍ˼ØC—ð€%AE1ÔoÆÕŠi>ª¼¯˜ñ'«sá™\’O+¦Ê'óNQNsý¸Hi*F<,<>/~W~pzp2g)²Ý@Öjh|½7KçÅ*sùhbY¬*A¤‚b$-Å/åóÄ¥å£E´uKu³.ÌY Opåæ\ÂÌœ¿h¤ôI:3_v1óðéSq× GDT´R7kÕPÒR¯ ®¨®(Ö¨`§ Pïcèu¡•Íj\âç5I¢±kÙƒYQDѤNDY~Y,OÀK‡bj´#›'¨gÌë8òŽÁt‘ÙHÖºq)ÆÈʨ„vŠéÐSLHQ;Û‚·‹äd¯;ý «“µn,—bä\E˜ËbíQ)Ÿ X]+z£RìÆs{ò9³HŠÈÃïós^ÃY s6¬”È (†"%3W‹@åCº( l&®Ü%> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ> àŠ>Ö*f¨¿¦Ý?æ´©˜ã+eõs2hz~trikbU×Ûcœþˆ·óØŠ±Ên}>äŸFY#ÁóºÝ.xX1Vâ þŒ·ó|Z1½²þ¤bzÙ~bÎþïõ]??‰¾1½Kél®rM™½Þ³»yÓõüÉšŒzvsy€ÓŸñvž–bŠ—#Ÿ+†tnJyôf©Ž”ðP¹È‚tÞC>”µNíÉåNÆÛylÅdÝG®¢tNÕM^(2.ùX'‘ç!’º|(²®Õ³žËCœþŒ·óÔûz$ï8¯—Ø›ZY á¡úÈFðrG-+0îC‘µ_1ñus§wV ¯MºÌKBw­f/«ƒ—›@GxF1Æx2¥˜íþŒ·óôsˆJ$ê&Ù Xìù¸]ï8ìzvsy€ÓŸñvž–b¢‡bVÎæöü*Éóþ£¶l8=Ê”‹Z6x}.¼%èËî1NÄÛyLÅ\Y{W+rEUÖñל^ª½úÆÁcb7Èsz­bîâß‹»«ñ'øÅ°¿à=f#~?¦ûc2âtýò Ÿ¦þŒÅðßÓa¿1–ζ óô¬s–¡wƒ.)ƒÜŠ ^Åù#Z’÷Ý^KÏÃ¥˜Ÿ?ê—ÄäÙ®Ým¿âeï2~¸ ò*&L(FüˆÖåÑäËÏ×;§bÔ/‡©³u;K1Kµs^"×–AoJAôÅ- ö+kWñ-ÅüP•šÞr™­ôV³¹bÊ_‡¬Œ¤û §N^/3ŠÉÕŸÄ)vN™¥~©f¾€-wð¦SZ^ÅGóz#>¥¶br“»š€bÜdµ,UŒÑ«@1‘½G¥ƒßç9–Jé J‚Q‰Êò®ðŸ¾<ˆl?Æ»º¦žbB[1lº|ËÌwCÅèÍ©µRZ5¬ºêÞØÁ#Y]íXk­Ä·îVz+ØP1Ow >Ç—(w"?Æw(|(øWLà“:~¸i#íÞ®®ùϔ㨩밷̀h¹·'[Ý»ŽËã´öd‡«&,mX{GW~ßp.·Ìà´¹A2{Ý»æqSLàŠYw_éÅg3îmÍn©nöRÌÅ•Ó¹wG¥µ;x¶ï;L¨þ«CÓÛŠbÖß»ÞJ1LâXõjb›½w\ué¾’ËJÞƒõÖ˜û¬ïc¦zUo äWLÙO·s¾¹'|ç«Ç(ð{ÐoCšâßämd?ÅÐSS<{aéËÛÆüg%WÌmýtþü”bÌ ·G%Ì|5ÅÔ/)ng¿ KóŠyUrÜÛèj«ëµ3ß-S,êk¥´J[[‹®º¸JšÜÁ ªòìlÃÛ”bµ·‘­vðøŠ> àŠ>Æ“¦{å2¡1³{êÙ|)Ó÷®í©k×Û ˜©ñ[ì2ó•;ŸzñP·"½C±žÙ;‘|y¬Ï¶ì6ðvÅ¡˜b¹Y7#3†ë÷´<¨-¸o¿_û¥;xyTŠŸÒ >òT,Sº[ö´œýtkÓ¶å-KØ̺›CÖÆw{?<Ïž²oÎáñö´£f°®g“y ŸÃФbd>kñÏ|ýŠ!iEV’5 àÃqïÚžÌ5fvl¦œ'ΫñÌ|Ù =WwÀÛrª|—·´ÉZ‰ô‚QŸmÙÝ°ÈdxV×A{šæ$U»¨4ºÑ["ÚaÏWmJËÍ;ÞÛîi«É¼E¡˜ÅÚÙå.Au“íE´:ìÀî`.¾ãS GMë9à­­™ùêîfÅœC3Yß­ýpôVºKq„Pw£Þ*ÅÔƒu9žëc¶z«é*Až¹eæ;ÕǤÏsŠ¯ bÞÆu_é3Š¹ÙÛ 3ÓO—gnê§g3?*©$‹½ÝbÃsCkオŠY;t+†{j*Æð¶ì’nòö‡ CrOïMÕ×Jr¹a->0~Õ±•¥êx{& œ»¼¥=@Š> àŠ>Æg¾iç[O[Ù+»ÏÔÙƒk½)×<Ö6¿í‚6 ºÁÛø{RüצڡHKev¶nú¤o"ó¶öx« ÎËׄ´Ëž/SŒØ¨`g«–9p7îà9V×Ä<•y1MÍN,÷öÕ“îòí“Òæ‚Œ©ÊаÑì{Zbï–ʪּÕL1ë¼ÝJ1|7ªÜÒ¢ÚÕ$vOoêcȳ¥¥ ·zà½ÅÛ­CrÛ»ì§[Š9ßÞ"–_ÞTÌ€·-Å,ccÅРbx°Ÿ¨˜qoKƒïVŒŒ’G1iaýÄQɬpK1üÜwJ]Å4.)6åU]ö:æ£URÞòá®o™o´º&y¶\(«‡|2Ÿ ¼A2´¨cŒx+ ¢›‹½;•[ìàÀ€b€(ø€b€AÅvšÔT°nÃ'Ù|馵s­Ôœ¨Û0;1 ¾a?f‹ÿ §Wô’ÿzñP7Ê/Ë—Ôi±éX=ä ^¹ ’tìnòöts“ý˜3jû6Ÿ«[ån´&šy{³º.¶à¼-ìøåµru½Í÷•’bĶL>SÛá3ë¦W]€i3˽ƒWÝ´­yËìο˽Ínî ÑG“ºlêûárë´žî*bçâWŒ×[fGzg|Ùøäöv¶UL|;¬˜|Z…t oô1ï+F^ÃFŠI× Í*掦™ïÜ}¥ÅÈ—¯VŒZX{G%•díÌׯ˜Vu[ŠáWÕ—JÔ駭m–VµÃ¢¹à´brO¡™tÔVŒèZV{K;*†øBA„ËX=Ä3!oÝYK­+É7s]ß»Nýi^ët¼Uv”íˆÖzë»>fK"Ü% àŠ> àc|uMyfgí^Õ,)Î!)¬Z5DΙ ó{×r¾>ämÅîÝúO°Ç½k¾1<ß»>Sf›Õ[Zλ¹­‹=Þvtƒ·¿lrïZ*FoFÔã" –ïi¹¿‰tË‹M¨˜fÀŽ¸£Ku³bø¥##ÀûnšŠÒ–ïiÇPlÂýDÍ[f—FpZímbň¡1²Wö|yðn¸êÒU¼ŠÉ{ocÞ¦yÚß2ßâ¿~àŠ)ûéšbÌQiÓ}ŒPÌ€·ªoºÇÛÈVŠaãuyÂP =S1ìeÌÛ³Ã]C,o)fé¨ä´èiÆs»·/.Œó™ádÆ°rI1»3¤<œ ˜SŒè0Ƽ-sƒ·¿\/˜‰''– cõÀìÎéeÕUwÞ;w[¼ã­Œ‹rzm³Ï·Oˆ@1À|@1ÀÇø7Ü*“¹Ö̎ϘóŒr-ïÞ»ñV®Ç¥ùZ6™ùæµ±N>Ù´»c‘™yëÞu:È’ÔìÎ×çx;]á÷®O‚¥˜oc’`*fWoçË ïÿǨ-¹ aØoY/¿üœ¸wG•o™b´ùÆÞ¾‘ýØ;T6¾ëûá2èõtã¾wí÷–mô{w‡·[܉L—¹cm¼ßÀäÿǼ¡™ÝR¶P M*¦8ó‡“.›½ÝèÞõ›Š¹©Ÿ^ö{×iꢒ,ƒ//ð{׉!ÅÞòaˆ…h½·{Ý»>'&lB›Î–«a—[¡Üå¸ïZ®‡¼3ü sYޣ@Š> àŠ>Æï]³å£µN°­2qâ|SßW²·ùmÔêúœñ®ñ6?iÈû-óÙiôÞ5ßØ+…– xk× Ï# Ó«ÇÛÀe›%Þ²ßኽ_1¬å¿cÂÎVí‚Ü:¿gOË÷{×±G%~™ä45;é¦Ü†ª~‚Ô³°—kJJ%Òè½ëó­tTöå—·9è–=­É;‘$ßåÏ–·l㦢˜k–ÀÛA1|7ªÜÒ´ioõr<¿œÈ‡"âr/R”{¾ÒÍe}Ìi8:¿g~]I¿ùÓè½kJŠ)ûé–bb7 H?¼­˜oK7ÓËŠuCÅP =I1®_‰þñ•ÞQÌóW?ÙÐtaqtµbî•\wZò¨*Žm8*I±luﺪ˜z Դp!“û1éH×[ÃÍ W•×9¾F0®{׹Ń<[Lç˜AÞîøPÝGñÝ»&6åuüÞµv³Xf½ë…Í!~è÷®Á~@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À|@1À‡­˜ Ÿ©c™ö»$žh?ØÉ´aÏ+žÝ£Üò7xYç!m½`}LÑú &j}Œz0“azOÅ>ÜÔ}Ü 2áMÅŸf=Z1ô}ŠiÓQŒmdußtƒbzIÞWLõÈãÃð–žþ¦FqN> ®÷ÔJû¡z¬X²#ÏÕK—ºòìd>Çódn•KQ«t~²’„…P8¦#hYg½ŽŽb(ûÀ[˜–X³Z­Û•ZkyŠƒ²f*³ª+¬(H:-#QËÀî C¥žÊ^— ¯ª²‚<ë¢N—ÓVŒ~cÅž©¼ŒZ/\e§7Å•ˆ¬ÀÕjÍ «(T*&³]¨Ô³° Y,€ª¤y‚JxVàQL½ÞÄžñ¦q‘Œæ b”‘jž–b‚®YYÒ™½©R-d„ Ul-Òi팮¬çâîå—QÅ蚊³ÍÖm…«y0˜«ë\³fç¥(2TMgÉ/«°H©ª¤‚Ôðw|)eY¹F/V­  ùRZ;xâŠÕ”ñŽM§<É rd*íìƒ!ê<+ŽÜÊ3s“/¦Ó¹yT¥€4]Q™™Iš×œ¨ ŒÒ.ŠÙBåÙõÅ~ ÏTŒº õ¹[ŠýªpP ða*¦6^OõÈÚÈΤ•µu®>¥³Ôr*ÕËëÌVÄôÖ<_¬{eº¡¬í<«F ÇÊŠb‚Yɇ(fäèuŠ¡ óFu?ŽK1SŒ)f*×­S=òG£—üç~Û¼`é¤Ú爩Õ³ ¹÷¡W$l7D¤Ê“•·“Kç †³Ö[!V’Xó(V’µÌÓ(V„ljZŠIÕ$ybÉ¢3È/¢ý¤Ä:ÊTú Ô?×QŒ®‰6ogÍ5^ëÅBà‰Y:Qâ—(yN—¯ ®£3óÞò ³¥n—"§%§Kbo,q”Ê*ꜪŠ±ø³&Ù¦üj·\‘׿q!Zú©+F–oËö:šŠÉýƒ¸lºŠy%Њ1.™µ`qÑŠC…8óY¿bÜYç¸ÄŠ•ÕPLŒäÀéù­îAWÃ_ÒE¬{Y˜T Y)jýŽŽï„bœY·JÈïe·Àá1cV†@¤Ä»)&°iÅD²àv§³<Ì•¬ÉFµn<&Ã\æi*&¨A›÷²N=e`).Q)†Pj$ˆ—B¨ef<ˆ¼º´€Þ¨xCÈÞËOÑŽ¹®—ZI[< ;•©<øʥȚW>é/´+èÈZÙ±K¤(B„Ζt£.ªí­xæRyuðÑ»kªüÛWpœ…‘@1OE÷Œ«ÀHàŠ>{¾*¥>`w‰ïu”Òš­|†ñØHå"©žK5]½v£±H%ê1=-Š¿ÔF¥ÊŸ Å|=uŤWô1€Q[]×ç1ÍwSÝ1žÓ­ ¾Ü%> àãßxøÄ­^°dúÐIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-tcpflt-dlg2.png0000664000076400007640000001511012173477702022622 0ustar npajkovsnpajkovs‰PNG  IHDR2`.obKGDÿÿÿ ½§“ pHYs  ÒÝ~ütIMEÒ$•šÈ9ÕIDATxœíÝmŽœ<ºPr•E$[™-L+‹E½¨¨5‹x•ÙÂl%YÆýQ3 ±1˜‡ªsEÝ4cŒl\Å0û4 ×/?¯Î ¿¿ýßÕy€ÿù\ùÛ¯_ÿœþúõë?ò%ùjÓ?­òHgÆ_në}~Ìÿ äJ¨4Ó[Ž÷cï¾ÈANàŒAo‰Lï‹“…Å~ÕûŸMUeó¹…ÜTã)~ÿóOI²®XK]jOsnóâŽØ•°ÄV?f®äö‘½÷RË2ÀÓ$¸öS\¼§yÈû^u©=͹Z—ý–<ñ£hîÚ›Þn¸>7Y›¦ |•ÎÖ9‰"»Ô¥ƒFc²ªâZ“‚ÍzK‚?kUî@×&2§ñ"W{o¡x6‹ï#vtUq•?Ï”A<¶:sÃEþL;ß»œî|Ž›0s­jŠ+k_îh.ؼOþ˜›³wÄyW—BÒ[b«YkÒ²°>Q¸=Mn!Ÿ´¶öçƒ{•ÙtS•šÖ’¦ZwOÃ0|ùëç~3±€“MBÏïooñDX a €@„%–DX a €@„%–DX a €@„%–DX a €@¼>®Î@î{éµo^!v¼ï¥…kW)Ö9¯Û[úýííê,Z×[úýíí¯²Í~Ý–Èå’øô察ù’Îôó¢ÂfJKäÚ5¹ÊØ…MNÓ÷÷å7íþ6Ö‡|/ɶýir´Ä›F…ÇIœè¾¯`¼b/Ýk×ä*s§¦8ÜZ߶¥>Ì¥0WU6¤É ^wïé=J9½¤?~Ô.àk×ä*•˜´ûmD±ŸÔYCÜî\eŸÞÒ´;ùÂqÉã‡JäÑAׯ¤9MmÚ­)®9M|ÅáUÕ=éuå«­=Ì–…ãrý<:¢­oLóŸ;ÙbÒUV‡¥ü¼øÀ©¸°8\VÙQÞ|Ï­]\s_‹Ç>ÄÅXÒx˜í ?ç…KÌ=[Ú–H¿±ç$ꄵ:,oÿ‹«åÏo6ïhs"›U:[S‹YÊ'P$ ªXžõB“¸Ü´G²vLl:ò¶ã8­G’ñ8åal|1Û¶fc¢=Ï;>Â)v§¦ÍËóˆB†½t¶û‡>‚šèʱ3ñVÚ-ÊǬw}´UYj7—ùʤÁ¼ âqkbÆË:j&^2Vl¯Oû@kñÏÉ»^\XO¡Xž•BÎWØÝt\eîó"W­ÉMÍÔÕ+Cцb>gŸ†é½ùû0TOÞÜ3öU“ÄÆ?-ÎÄ«ïh(u³Tüdk’æªè5—¥<µ|áÜŽúgâ ÇÇàÇWËŸŸrŸ°¦/ºÊÜ—?»šœ¦|yeÉâšÅå-§mO“ ¾|hz~{[–nÍ Ö¾êßxÖÞƒÙqMaé*{}'ÞÕ戽³Öª°äã´¢ýò>bMnêÚÊ ‚ñB_>¤«´¯U_ |’âw œž ”<Ûè-ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",È }ƒ8ûÚð6žÕ^ï[âY­ú:y½%YÝ[*¾¡¼øë°ôrô#^{Ü+h½Ü¶¨ø‚ó€kr‰ü åù„?~”Jóe;ˆ÷察ÈÄS_2Ýò:ó ×äÉy-ž¬mïJ©4_Çžƒx¯Ü™xÁè;½ðŠ7}AÖîe·ÞR}¼.Y-YsÚ¦OG“…a´<…bšõL&C‘-{OÒÉóo”¦æ:ùèÖÜBi¾¦ÝÂRËx]1PÍ=µÊŸl͘z>“ÿ÷^üuÈâHz·ùòâBi¾¦ËfâÍ5âåõ¿®Msí&Iˆ­Ç¤Í»†tÄÕWNó)mì-Ð9Xìúì•âŽÆÈ47Ø4:¢ðÊi>½ Ÿ[z„½ñß%;z,IºMsc•"åsÒŠëH“Ñeai®ïiß÷Š I(J’Í—ŒSvÙû]Lç¿å·„ÉSÜ“×$ˆ]NMÒp¿Tš¯éÓ0§z††r\œk0NO¨,œ¦°8n¨N+(¦YÉyòóbæóÙ‹¿¾‚ÇWË?Ð:^Ÿù­â kr¾òWËÌ|PtÕl´ä¼Ï}øô)Ó|& _>4 =¿¿½m K0,}ãYû­âkr²C¿ï.|ÔÏ a‰3ø"NF¾ª•ºUaÉ7ˆ³Ñª¯æ©!lt&¯IX a €@„%–DX a €@„%–DX a €@„%–Ä7ˆ³Ñi¯-ðEÔ7¥†°Þ¬ë-ß/¾Ö ¾_ü‰ym9ùëÀçÞ&£ÕƒxÓˆ"À¼¸ñ-Ñ^M.©㯪 uñ’®ÁM…»`€ ö™ò0(þÓ£#5.N×O:^ƒî<‘¹^Q>²S;„¥$–Œ¿N—?~Η1LL‚§”ô­‹ËáauXÊ;FsÖÆ1 žž Ä¢®)Go<]"V1å8P>ê® KÓ84Ny¸.;¬3}çv˜"ƒ v˜ò0q74Œ×ëO×4åáŽÆȤé!÷¨ɼ»ä³j¹OÃ4<¼ƒZBßxFB«Ièùýí-г%ð âlä•:5„mô–DX a €@„%–DX a €@„%–DX a €@„%–Ä7ˆ³Qñm:¾4èôl½¥[¿v½=óõ5o]À‹[Ý[Jš¼ ¯9Ïߘ޲ÉÚõ“%1ó9·mc!Ïæio Ÿ¾ýzðl`«ÃÒ£±ëiõæ¶m릹êo”Ëg.)Ïz!·æ9‘釾¿ HÀnžm:ã{@p;LyxÜ•í]q$ªrÛžÜÔ¿æ ÖÓ\ì,îèœ|.¦¼×Êy‡é‘«sÆ÷¶Ùg&^ò\¤Ø n~H36ñ«Ò,F‹úŽ.Ég§ÆÃד€àö K‹-]OS¸íO¾Çi£<×:ŸŸÏNk3,&ÁÝìsKsí~c'`ŒG·Î'ÌéxJ7 Kòboi/aƒ‡ÀwÒL¼ÆÞCqµJiü¡¥©MæU¯Ú×.ùœÓ8ú×óÜkš“ñ€È¶œ¶>–4µÅyåÉ,¾qy}ae×ÉŽê+_žÏzæ‡W}ºy÷)ãÇi?øôÐïÓ0mËÞ‡án-ËÓŒJ-N,<íû&ùN<`“ÐóûÛ›ÓF±ãD¾§ ÕÀ º}o €{Ó[ ,a €@„%–DX a €@„%–DX a €@„%–DX ›½48¼o 8‚ÞgóÖv^–Êßb]XJÊt±ˆ[ÎótSãÓ‹¿ÎiyEáïoo·¨‡Vþ+.9h×Ivî«Ç¾ùÙñmŸOluoi,S…ËZ¯ÍõjÝ£}ùëç£ÇÆŸÿŽ¾º5!ÙQqáóyúìgo¯YÏ{Hä âwñ’…×æòí¬žò0†úiÌŸ6ʳ˜üi<µùšÉòJ%xÜLåkӜޘ?ó¹*ÍJæ»/+/Ÿ¹ò¬o»x6ó­VíhøoÝ®œ÷þê]¯`-)ßu±&ï®xì«®£ »+æbšígs®èæÎïây¯ŸŽ$K$v˜‰Wl êÍDòk±ÑYÜ×xâ+»XÌg{š•½l%ûø1|>~lÙ¶ýÄun¾vGãÙ¬œ÷Îê½XÁZ:ßùXPûuÔ£xìŽÏæøë°æ‡ì08›ÅÌ÷~P³FbKXÚ«‹==÷Ûv½‹<ͤú¶ìôeëÜæÈ´¡ÄÖž”qÍmn[?ßpC yÈYµÇm:{6Åëhnµ¤™ž uvºÍ9 öùÜÒ†K¨_ýÖ²x´˜Ïü.inô€Ñ#2mÐYží›Ïæ;º6ÍN;6£«º}¯@ˆZåA¼þ4W9¨³•ßÁ5Ž.Ò¢³Ú,nž,Ù|?~Põ~…ÚryËÀM4¯X#¾ ­?ò©ì=O¤¾ÎïÿNyØáçÐ2ˆ·m`j•Ç.ÿŠ7ì塳z/ÆÔÈ®ÍêM÷î.¶n‡ÞRåROOŠÏ÷Ý{%ÍÎ5+›¿ì”‡‹ñ>¯9ÓržÛ|îIae…z"GTïÅ ¶>+sZtn>dÇ^_g³<ŸûžÍúæs¥tB³öâ> Ór|†M³ªxAÛ¾ïÐø½všœOµ,˜„žßßÞ|U+§:´g龕àĤÂmþ²ðC/K×<‘©Ÿ-|ùK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",Ⱥ÷-}¼^²óýGá=¥ïߋ˲êåZÅ—=7¦PQôqïøÊK¾^¼'—ÿ¾zŠqZPÓh/G «Š7Nio~ :ı.,×^œëp­±ÉÛÖö%ï?=ÓM üL»D‹ï?>Š·_·paý„½¼î ^“Ü`R—ôÃÆ_ï{‹1íóÒôÊÈI¾0ñ赌·xcx˜Þôû7Ɇ=Ãù¶ùÞëÛnÞuGƒ˜ò´¹þìàŽŽkæ›Ï)HÏÂâyßålŽ*²êØ;õHûæð4vKs#'Óåõ;Êi¼/Î<·m‘«4yÉÐGûÞ“œ×3Щ؆慜~å×Æs4wCгp(÷žñÕ9ÅÖÔϹd[žBuȪÍá9ì–æ.Ëâò¤í~\NÕô‚Üp)ÑäåÙ;"å‡byvÞæ7ž£–+®SßðÚÆ´½èæ: ¹bõΗÔï±*„^ÁþƒxukçË囟3×èùž/ž£±µ-–mg/Ïzˆªw@§Ë;«w»àå =ÄëOs˜oîôTö~k=ýª|Ôhm —”gØÉ7-O8Ç3ñvœeû¸n§ó܈Ùw‘iƼ-ž…#&@·ŸŽä!ßÚ4;írìÓ€·jBù¤˜6ÛçÙÒÜÇl7ÏtJ¢N˘ûæÁ½|*ÄÜÞëkýl))äÅq§éƒäužŽâÂñ©IãÂdyqÊÚ³Y9ÌÆ •ÇHÛ:^-Ò¹y¥~nÈ0\îÓ0­¾ïÃðãÊÜð:Ìþcz~{{ÝÓ°Ä5t•€"a €@„%–DX a €@„%ɾåáýŠ\À0 iXò\Ê K",ˆ°@ Â|†!âk¥x=ozK„",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ ÂK÷óýýêæóÜòcþøñÇ_§¿Žëç “%'›ËU¾°=ÁÆ “5û‹"9#? KVeisâŸúbý<-?û:ètœcó…°6…ÎÍÏWÉX1$òcÛöK»ØÎä ®Jór³aiX™ï¼•¼Üx¦g®¸ðŠÙÞ7òÕ=YyÞ’¿üªfâÊÐÐ ¨Ÿôbúg6=6â…=ž¢bnïu¡´”çµÅûR{¿iMîÌöMú|; ‹j½¥9-CcA$+»«Ó‚«¬¹¸¯Å5Û7¯t«¿²fÏaö(f©¿äë»+øbšã¶Ée²ù\æó½÷WÅUò½äi”¥Æš<·°1ÍU™/®YY²ãæs Ûmh¬ú/ás†ƒ«…¥¹²n ¿Åá…¹_ó.mûƒ™úÐjÒ 7϶˜Ì­Ùs˜:³Ô^žãî¦5díaŽÙ¨—ÒÜHÈÇÌ`ý¶ª¸V~uäiö_ã¯õl_XÔ~!¬½dZjHçæ׶Æj±a¤ÅnÏ–zÌU»iCÓ¾í0s¡¶Ç•–]lpDyvÞK~nµW(Ï€iΣâéØ7'—á;jL­?͹õ[î¨vÑyiŸ–æ¶ âõhìf “¼X|õàڜνïX·Üñ%οnÛ¯Žm›oXó´Ë°}G§¥yí…ÐØ…Ý%ÍhÎK«Ê¥å~<ïkš¥ÝE«(ýåÉf=•aÕ‰ x6îè´4¯ºŽÉ¿‘“>N[<©•3t6Ϭ= ÛÓì\³Ó­;ˆ—ìýûûÙî¬`Çí¨å2Ü¥z±£JšÇÍ£ëv|½…Õ½¥¹Ç­ùÂ!ëD”žEm^s­âŽ*{ohY³ý0‡êƒF²´AžÏU‡™¯³K)m®ŠÅ<¬Ý{=ÍmYjÉáÚêݲyK拉ä£Ä-5dóæ-iV´_Ó57\>ûž÷¼”n“†aø4 ÃÏ¿~^ ˆîŽw̹ãÙ¼cž7xûöæ;ñ`Ù‹´/ÂÙ No €(ô–ˆåØ°tÐl¢ÅdO›ÅtÂ~×z”OþïÚ,ºþ)‘Ôª4#Ô¥DãTºüOÉ,¸Æ ÷’ï"`Ù¤xí÷46Ü°ÉÙŸ[êwæ|ñ;šNÅñ Y®õ½ô=œ£Xø·8#ñxBa¯·—òýÏïþI&vŸFe(–@äb©½0™?·p(}ÕÒÜ8êS쮲9ó‹{/vDæ>>×}ùø1›¥ƒ4{qÃC‹nXª6s¹*î¨RåŠûZÜÑðtu©Xòõ#º¤Oåbµ™;öÅÏŽÒ¯6ˆ·c}í¼­>tk·š»ËÛýò>¹½¨ïn—ò¬Ü ¯-Òdo1ó=w»OP—ú‘¥ËoïnÑg=3“Ýý|aË’ÜÂÛi“›»ÅÕ’5“a–âší ‡™§v»g~±™ë%{sUÌüÇÌcÛ¢G ‡ÞM¯z<“—g±”Ó,ÝP­6«2Ÿ×±$§+w{{–"Ô¥z>×l‰ýɶ{)Ö–½Ì5-íÒªìm(ÏúŽÚK¾s,tUó;´]%óÍÚìwâ=ÓPÕMÅ9qrÜÚbcâ;ñB €'ÓҬ͆%m"#•8ÞK",ˆ°@ ÂK",ˆ°@ ÂK",ˆ°@ Â|®~E#Œöï-ýí×ßwO€1–’è²6Øüí×ßdzÖæׯV~½Ð¯_ÿìÉÌ 2=G-gêÖ7q*P÷yßäþöëïÿþú¯ÇÏãÓ…GøõëŸ_¿þcÖô|ýúPù):ô¼lpÆ”‡ý×­o´8ͺÞÒ£ß3Ƙä^»¥W4OÅîÔ¸‹ÊŽc¿dÚA™öT}©aÒ¯fúXã_‹æÒÜwóäêkN¹¾÷FÅ’}ü0=Yã†ãší'n+TÎQãæíå D°z/!Û¶]ܼgGs­Ûîk±y½N~-ÚvÅø‘—ü4äW›þÚxâN+ùUå \nuX:îiDÒ„w”<­›’Ú”¤)WIbI½ðÇÓ÷Xmîl6:¢ä“y‰Å;‰CËè÷i†/_~6®] ¡:CÜ×ïßo¾A€@þe”ºp‡9"IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-tcpfltmenu.png0000664000076400007640000001312412173477702022664 0ustar npajkovsnpajkovs‰PNG  IHDR3b4¶©?gAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}ÿ‚ÃÃY‚ÿÃÃÃÿÿÿÿÿÿÿÃ}ÿÿ}}ÿÿ}ÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿ<ÿÿš¾]Ï0008Q}¾Ó×Ûš00óûûÛç㺾ÃÏÏÏš0ÿûÿ<<¾ûÿÿÏÏAçççMMMÏÏÏÏÏVˆ­íbKGDˆH pHYs  ÒÝ~ütIMEÒuGŒ¼IDATxœíiv«8F½þ° o&ç¨÷¿‘~‰‘T“†¾{ºã0h t- dç½^Àå8€3À sf2P)¬}àIˆ~æׇ?'Ò/’;!ͳYã x6Mgâ*8óxzœùò|眪‚‹`:C»ú£8`'QêgâFÚš–É/œy<½ÎÔ'ÆàIxœÁØ~1Ÿé¥ÍÀÆ&8~ÁÚðg€—_g~pg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^®íÌÙÿúø)œô&pærœô&pærœô&pærœô&pærœô&pærœô&pærœô&—wæý,àÌV~9ù],pf3Î\8s)àÌfœ¹ pæRÀ™Í8sAàÌ¥€3› pæ‚|—3îµÂ¿œ’^z›Í{þ®À™ÍÕÏü¶å_{’F5Û÷ßÎå\yz8ÓâÎÎugÊ|¿3ËH¬8nqgâ>2¦Ååž<äL&ulHÖî½ßLÝ} údåL‡/pf´3¹O˜Œ­@ÖÚΰtyl Ä58É3¥é aj[g6Sr¦´%Ǻ34ÑùX=û>6ñ|¤3] œÙŒáLul"ó–†32;ڞϤiвe–Àwb>s Áz¦קc#-qÊÄÓ±ž$ˆtylÉ%–Iú1I>‰­”ÀØÉ3ƒ3ƒÎÜ8³™g.œy.k[Î<—µ­òUΤ?S¸Ðó” YÛ*_åÌç3¼yÎlbm«À™ç²¶U¾Òë p³¶U¾Ñõجbm«ÜÁ™ |÷<χ_ÕãœIOã?{¼ïw‹ÿV[k[å;Y6áŒ8“VU4FDø<Ô™8óÕc8ÓÅCéŠÆˆß8SŽÆˆß8SŽÆ~~}XnN_ß œ3^ì û€¦åÌ›O“×//PgT üËóó²®Yòyuò\g ‹"ä«]ŸÛn:óþüOÚüµ¥Er8³/—uf "9œÙË™ü‰ÿ8ð”œ1¿è´Á™¿ò^¤ƒ˜–}S>Ÿß¤$qPzé\&–œñ!/uR.èÌÇÒ¢K+vþËÎÜžüÅú™\É ÎøP—*¾ïÖîgö˜sg²IíÌ‹9û š¼àÌ Î¬F;Cç3“¹Þ¤ú™U˜Îð±‰;ÃÇ&ºÓãLÌvæ¹Îèï¸VÙò1¾R?#v ÜŠ)Káêg†Ì‡á ýÆt§3¼ãi»tÂØ4i¹D\z®3Öסmgô—±ùÝwק£3¹éØDÆ}ßÄvŠ» š<§7Z©@õgê¨K-¶o‹MýÌikègüì猗k8³pæ gîœ)GcD„ïÀCIßÕÎ÷Lr¼ü1ª)η<Ó£¹Ù9§IºÚ8™‡;ó¹#ª9â}UØ°v@3µ¥1÷ÑBáÌáÓ™t¿<ãLúCz‚‚3zÎH¸’3j¼ãO¤C®_L ¶—3©­S†9“UÕ«!W*wH…O~0OwfÊïyë”7}ƒoŸ/ŸUŸãªô35gœI¨÷3Æz“ÑÏlŽpêgÂ6g6(¼pæJÎLΰΤƳN1œY³Þ$ò4ç3rN[r&¹¶¾Jy¬3zb!£OYæ;Ë^ÞdPû¾‰È¢œ‘·Xì¾im•6òPgº¢a³¥Ÿ1³ ;×57ú™!¨KíˆÆˆÿa7î™ÓZp¦¾p¦¾p¦øÛ‰PÍSžb.«ÉógÃ'gJÑ0þ¡Ñ2ÖC9+Ââq‡3Óõ–·áL)×qFo™#P—ÚŒFåYŠc¼ÎXy./éoî’!?!¦Ïs uœ)ECö3ùq0}‚»às†­ˆ‹oö/1d! KF]†ó0gZ]›ÆBMòk>Y<Î-FØr&°¤²¥%Y¥¾æÞ…‡9ãˆFÁûö¨ò^7aÝCax±$yeΔnÕgJÑ(÷3†^gȦÈÚÙÏœ1†3¥hè[¼P¸3¬5c›ÿÍgB—3åº Î£‘n`&òŒ$Þ«°dbàÍi=Ó#3Û<Š÷MÁp†žÂ¦äª.gÊÑXM¹Ÿ¹p¦¾p¦¾p¦¾uæM&¸ŸŸÆÜ#ÿò½¾¯MÈý²žR«š?Ó-óXgâoåùêç»Õ›Ÿ¶ÚÅVœ™®·’Íy¼3 Ú™Ò÷J¶DØX|¿êRàÌY„BãMÅ~f¤3ä9^§J5Ê5ãÏuÎY1È<Ö™8¯8Ø™eŽ•ÐH¢°ZÀ–ªNá±ÎÄß*Îðï7í3Î…Õæ3ºfje Î '¬p&,ý̶·õ®ÎLgK¿À™Ž±iÓªÎÞýÌùóa8ã˜ÏlŽ0qFÌgŒ»(錱’Í%:Ê¥‡;Ö”pæm>(4î›zV²¹E‡ Zu¦+#"¼/ègF¢.µ##"|àL9#"|àL9#"|àL)ÆìScÍa½L@§ vÆ×[å†3¥hÄ{áô_0>áí°|<ØvfºÞ*7œ)Eø=ɽ gŽ@]j3#áë|Ø»þ*7œ)Ec 3|í`É:°ÿ2ÁUî‡9ãø¾6{×7ÎÝÎ4WŸÎXå~˜3ŽhLdA;=²wú¢"œ‡–‰8W.Þ!e)È«ÒŽ—~3¥h¤©GˆïæiÚÍQÈrfêgD ò*û™3æÃp¦ò|fC„[cÓ›éBÙca’K4Î%8SŠÆgø›2ýZ¼ob“«°ÜFÅ}$sõ28SŽÆˆý̾¨KíˆÆˆß8SŽÆˆß8SŽÆˆߧ:c?Ø0>ÛiÃôy"|êLº¿-G£±L@ž÷y"|àL)üõ*à ÙZÛ*ßçLüß‚³OFhp&<ÏöïCå y.«Vá ÙZÛ*_íL°œ úßÂ.¬.¶"\[Nÿ2àLÝ™Úß,êþÔ ú™2ßçÌgVgjÎ8cðPgâ¬ö3Dל¡«ÇôcÝw‚3e¾Ë™žhŒˆð€3åhŒˆð€3åhŒˆð€3åhŒˆð€3åhìasâŒoΔ£±„•pÎ4ò,Èg.‰ºÔŽhìa¾dA¿>ÀŸü„üXÈz:t2p¦ý#œž$Æýzlâ–$©œ9œÐ^`î8eë*pþØNxw:®é ¿Æµ­òÎtDcD„#©Ùßì_[0¡»¸ž3œµ­gÚy:ûùeε[œ©Gc;µ9pv†}ƒÖ›Æ}—Ö œ©Gc;Æ3=¶dž¾~O!ŸL7LÝ«èGgêÑØÎÝ×~YÛ*pæ¸<ÏÎÔ£±{:³O«À™ãò<—‡:SX`± gÊ|™3"–3æ)pΨh4N3w†/0Yƒ†3e¾ÌsyÄ4œ)óeÎ,—Ï~F¬AïºN~ žíŒX`¾ßô(öi•¯tf¿~æ¢kУاU¾Ñ™ú|Æ<åËÖ G±O«|™3z¹ã”ï[ƒÅ>­òUθß=Î(öi8ó$öi8ÓÃaVîwC<8Óœ¡À™à Îôg(p¦8C3=À œéÎP®ïL{µvü’ðA¥¼w\|Èåyg½ œ¹g½ œ¹g½ œ¹g½ œ¹g½ œ¹g½ÉµWÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3À œ^à ðg€8¼ÀàÎ/px3bÞ'êÌüGÎ|ž½%Í,!?¤·ìŒ?•HU1“ÛåõW´ÿü¹¸!+áÌ+m™%¬hÝ”46cþ™s]â>ëc˜3²üM1çuLn•2žÌsEyç8c^m;¯aÎüÐhÌ42$N³<æÁv†íð6E1´rkg|¬Uimwxöɬ–ô gfÒ±ÿZz³º•Ï§CZÙh:–`®ef9SHÀYöñ‚~ÈΘüg._˜`^‚K¯Af¦¯Ö H>ÓºÔvªðÐgò“šœ=³‘Ç åÑ+ú$Ž1gxÖª¥«ÎÌô:RÖ¹ ãA'«¸‘<¿äÓc󈛄DM”Ø*èGæ«k=Ë«Øç¸sÌ7£MÉÒ­[†×å5ŽÍLÙ¨²Áå;Z=Ö^(g¬è—“‹G–ì¢F:}d&5ãucùZ gGxó5̳‘ -:MîYäZë/O^ŠT÷GT£RÐOÙv§3)(?¼—eñ;ÃÆšxdžy±´t‘ïLëÿÃÏÜóH•JÎäc´t—3üºT­õ¥KÕHþvæŒÜ9ÿÈ X×ϘåÑb™*2ßYþ,ç¹þŒš uƬu½.ª!uõÕïk>#Î6Þ3¶3Vò%()Ÿ´eÅÛGE*_Z.OÏ/Xå¬RFÅ•ÏEš÷M1~ô¹šMÇ—¹žœÏØ=Gnâxi†4,rÖ=Ž¾ag÷MK¯K&‚2Ïõ×Òé9ËÚÜ#G—^Ê,ÚAŠ”÷#®¨PêŒhTÕà²qªß;8_N¯î³(õ3_Å—U÷>ü:óà ðByI–­qRÙ9W*±kðfYÓäõ äkÙ:Ø™W­pæ|ÎŒ.½½óe„3gb9÷Å·ög÷g狽ؙÐS¤†ì˜‹éL<1¦¦%ÔJçå-]+Ý:Ô0œY.·è'–ìXÜŽ“-u&/€&§Í£ŠÕc]Ë‹ž»$¨”.êòbC‘Ëà±ø”ɱ#ñÇdXéLšùŠ¿’ƒUgJcSÙz=òz©­Š3… Ë™Ôk³Ýâkî—nµåLáÌiàÝò)ùîüJ‰%¨Ó_±J)ñ‹ö3¬t™ †¦&¥~&næÝü˜1âð­ÔÆF«ªX.®~Æ<ý¥*‘jbØ-s4 ÖMÚ’¾±I&7[°ÏéEºž´óÅœ±Ç¦‚] †õLßÀ¾û•Ž©;ÝöiàCOÞ{ßôwZâÎŒžžJ`cSÜÒ¥ó\pßÔæn1ºÕÅ\8¼ü:pÐpæý>¬&à[ Îü Â-y/Tó˜¦ø£›É:½™…¬ÌF£}U‘º3¿ñÿ2¿˜TÓôícÈjÀ™S€3À‹áL’Dÿþÿ줩Á¦!þ ËÿÔ£e+í\Æ3²s2·K‘ïX—O%ø+/Žš"ë\gUOÐÆv†ö9±YB|ù4пטnÊ b;ˆI9–Èôè”v²$¤ûcµfyæ /o·€>Ó™Pq&u7ÿHËRr&°Þ%hgäQ³)S?,gŒ*åÿHApf#5gòUpfA43éòùàDw’­²3’‚3ƽydAÚY N.:#‹Šoø”†¶!É'x¡ÇhV©L^ÑÏ•ù i —3VŸß;ŸáÄp†Í´2­ùÌ$ËÛçÁžËû‘´ïM\Êoð˜Lܤ¹‹šÈMÊ2ðt ±[‘CQ•\kv*ÉEDç`¸oòc¬˜=8¼¼ðò?æìøŸØ…·IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-tcpudp.png0000664000076400007640000002226612173477702022011 0ustar npajkovsnpajkovs‰PNG  IHDR2bÛtÂgAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}<ÿ‚ÃÃY‚ÿÿÿš¾]ÿÃÃÃÿÿÿÿÏ00}¾Ó×Óš00ó÷óóûûÛçãš0ÿûÿÏÏÏÿÿÃ}ÿÿ}}ÿÿ}<<¾ûÿÿÏÏÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿçççMMMÏÏÏÏÏ›¢ødbKGDˆH pHYs  ÒÝ~ütIMEÒ8 'Íÿ IDATxœí]aš«* ퟻƒYÇüa/Ìþwò^§ '! IPé”óÝ;VkB€c êã±°°°°°0â‚‹2 J e¾Ò±…Oõ2O:üR"}àøÿàâÌgÃ@™…ÏÆeöð´G©E™Ge^|‰9×¹ÇÒ…I Q þ©F«…OBÅËì;iïkË{e>”içÄ ŸeV`ZxBšÊK»‘¦E™…'Ö‚Á‚‹2 J,Ê,(a§LjÇÂÛ ¤Lx¢<±8ºÏtc+()V–Àí´‰K¥‡PiUéM-­º)½G @Y3?ºÏôc+ÈJ™ßóÝVú±²žÒëZZ¥÷Tä¸tmk.Ê8K_”_Þjó‹÷Ð’N‰äÌ‘€f“lé’I ?ÖÒ.}kŽ†–žÒëZZ¥‡ýÚU­Ú¥÷hAÔ)CÊB—ÂQs½LÀýî² ixU:´´K?¶¥§ôº–Vé©çQYˆ¤·KïÑ‚xQéH!MÊ4Î]v&¥ ‚7nSœ^i¬u-}¥—m)½A™FéW(sXú±Ú(eÐÆrSR&”§¦` ö‚³­·$±Ùö8ÔÒ.½ÃËt”~àe*¥‹]ÕCRzÔöV”)üKgQ¹Ù7¾CK»t eê¥SF*]G™ZégR&“5§u(([Ðì¦R>¼®T^•-íÒ{)Ó.½‡2eéý”i•>š20F y/§d猘H»‚-âpf!~¬¥]úÞ8U-]¥×µ´J»*À‘®Ò;´kJÊt`4%®Â-­Òz>ˆ2Š‰œUzMMDÊ\søÂûÂ@™¯¯Ó­Z˜5Êì¿æ|À߯ý«»Œ}<ýêk{Ï ‰íÄÀÅ·ƒ¯MI™Â”\z –Ëa±a·Œ|§¶%¤Ê×D\€šT·¥áe~©±ýÉŸïeÌïÿ׿×ÿ×ájÓ„ýDÊ€C¿¥)I–pÐÙ[A´ôÔ.[ðú9âon—‡Ôì •}'ÊÐj¤Ú4®É€”9Ú¨®ìÔ1(ÓÑÙ%e†Ñ—8½Go»à…82”>é?ÝœR›ÜÃM7^6`¾ ÙF ²re^r¹ðõ„j[r@:¤ ¦,Àµü Ê@ÿ¤ ·8E0ÙFc°ôTÂã˜2Ù›€ô`«¯«ZIDzô¶ ¹‚ˆ–ÔX\K7eöô÷Ẻ15>){l”a׫,ó@¾äK_Ú ç‹ÉËlÒT™ÞèônÊ0rRŒÐx8xe„2iÓ×4D¼”aéÊP#¨e½Z¨%ø!»V…@q0o¨¨&ý}<¦¤Œ*—ÊaÜd ¸—žÎ&Æ£L“í²ÿ!û [””ÙƒÓ”þ8tpÁQñÚ•¥´%©ì )§P¦ìñÃ* ”!Z`£ Li*åQ7wBç‚f‰e¾/ l$ZJÚ¶äkú‘,ë Y¢8ØöµZ¦³U%I€i Ö-¬µ‚…E™- Ê,,BK™õl™‡H™ô\"ø›KÏrMèÌx=ÕÖý‡‡ozÓù·è (6‹²Ò~-¹@¬Ñ¶ë´%‰ß4!5d6lß)ÕÔ¼  çæ^ö‹¿¶yïµ±Ô´[5~M¥›Á˜šrï+ÒSF‹r¯wÚ’ÊÛ,€=¥ÑªºÃq“ÿI¶˜)#m 5íG°R&_?L‹—2”|Io—\6©Ôb¡LÑçÊð–b’ñˆ2ÂÃKgsÉ{ èÏäãë>‹> âЛ給lž|`R"ÊÞG[’x—h‡$›Í©¨1PË™ÒyÉÛS I»Ç}Í¢4¹¨,ö°^Ö2&×(æèMÉ´ïg/z“,V r±‡2_‰q/ÓyMV(úÍH¸4£•29¨¹¼ŒÅ–lF¾ˆˆ—±S¦8xC.Ã)“/‡C!90  L¤!ßD!(ùs5e"Š{)£ç (“šªu ° Šnr¦¬¿¿›²(³ô8l‰Î® ˆ›Š e¤àteà²>nàš—C™¢„^ÑÂã]éeÊ&€ˆÔ oMʤ©<¥ |§­~³šJ7Nyã¦Læ­Î? m™~Æt^J˜¶a*dbQ»’2ãÈIÂN>o1¼oa¸x>N…‡(“âÌ<”é¨ÑÙ^BÔá”Ù¿á§Mkè%ÝÕ4œ&ƒ(ÃÅ{µ %£(£®ÑQ.ó:©‹ú•l\x¢§´öÆ ef9ý=jšÌt0C(êTZ ‡)0RuŽ¡LE‹†2°TÙÈe˜ë9)—‰n:$Ðó1¡?aUCwjI§‰FØ(CtZ)#…©R,šV²á»r¨ô…riorÆò¼ãó·v‰©u ­òw&S²Ý© “ËÔ#ÑÊb ñ§‡—Rt-Zj”°–%žX”YPBA™……'´”Yžæã!R&Í¥Ð÷÷«Šžás/ÈcWšÙeJóX²hL+©£M¼È‰]¶¨Û%f±eúÛ»,Yœ~2`ö¡^fçFnÀ¿³t›¾Ðj¡âd gµ…ÔOÓ.ØžñÀ–7¥L{²‰IT¦¬ØwF[ +Ùuñ+)Óh/eÊeIœ‰!AëÊl.3ö_Ù©ipÒ"M@Ø»é¥qßèµO™MrØÂæâŽO—Û%II‹‰2åjõð…øeÔøs”γ*er“´¤ëœŠÛ«Ü61šÚ…;©PÑÒG™;?Šß9d™+)£¸šö³©û½“2ŒÂqeô^&’DV%—¡'¡L_7AÌNûq e@•5—y}†“1½¹Œ ÀšÇœË”+Ù±¤Ìµé¯2E ù(ÃÉçM¡ãl¶8)#mJ±hXÉ®ýòî:ÊÐÔ±CZ!‡nªÏhLœTÒ4Ž'cÌ”!íé¡Œ¸’-˜®šÊK‘?×ë ip@Ú#¤ïä4¯ÏòC?É$8ém)¦;­¬=›Zj” f,k­òã°(³ „‚2 Oh)³œÊÇC¤Œj%ûòÐy«"Y„4/-öœÑ˜þ2Õݶ.0 ýµÚB©ç­d_M™S)ýs!8˜N$ÙÛÃ:ÈFÕj[p&ÆR£†ê ×†nhgqj|3Ê„{=b¿‰EhЫMÓoQÔS†ÌÄ0ʸ髧Œ0!ã  _–ÄhEo)¸ˆ;àp÷XŠ8Þ¢+ût>N#“—À_`Š–’¤xE-zÊdÚ|]–Sªt·o’Dì&ƒ—T«2"ð”âžÓµ¯‚‹''}àpȹÑòtq<´Õ³ÁF™ýòËLI_Üàe á•÷ܶèÒß*@Ã’ËËDÜÿz;Ê°\f$e,‰k.½±g¶¥ÖÙrnÊð•ìíÃ_ Ì˜Àd¥L-—@™éoU‹†2$8!eöTXU;3†SF—¸VTÛ(3:—j*Ê9(#®dÃÁükˆëFL<ä÷ç28ÇÅ檴ó^-Õ"‘\ΘjŽ²Å!׬Q2Z”X«“ŸƒE™%”YXxBK™ÿN5ga~È”ù%Æ¿ Ûø¦Åœ³9y«vÊ 3]’lj'¾J•æô7Ð…à´Ø^)¡=aXЛþn”ùÝntyQ1GÀÉ”Á-Nft‰æ!$ÎÊè´ˆ*µs!¥\°Ô¨ÔùªX)wHE˜!`ó›2.SædØ)2; u]” FÊrÔé9mQÔB9\$j(+â߈ÛH"Ù0ÝÁ\P&’ö`§5~ ɘl¾Š›ØS±CO™Ä‰HÒzÊ¿ów ­ûG ‘֘䭶”yGqk•Ùƒß¤¶çT¨’WõQfw‰ œ2‘P "Ù) ŽÁH~)Ù)M«¤Lþ@¼ƒ2ºÀ” GÊìMãËeð°@âj®¤L?c¸Oè]”Iú;û<ÊD5eJå2x¸¤L»N¢ ¯Moûâø6pÐläÒ9º‰—S†$Œ#(ƒÁI Ì%‰ÕFÕ¼,¥6@%cΦL#y•¤òäŽ28úÇGÖlÄ$ú—9tZ`"“M•­*·h³\Vf´%ÿö¼[ ÈV£h¥ Ó¢4%BC&Q‘ؽ`°Ö žX”YPBA™……'´”Y?Œùxˆ”iÝ“]P†=Àê|NíÙš*Í«%™,6D†=j¹Jbn6E™EC±I<Ù H•7Ø^H™< ­•B*’¡ljW™š ŠiÀ¯óGb…oÀŸuj¯¥¢yR³jFLfÊœPV±O,Ò6c(£Ö’¶ ܦ¥Ô©óxE{â´•jݺÁVxVܢ»ø*ÇÊ÷dË„º2J9(Cä#n\¦Lc‹-¼aú;ÂËЃ5ʸo¸î‡‘1gRf[Ì”ym¼¹Lõök‘2—Å%k/ ÁÀ=JIÛYlñ¦¡”¡7ØîqˆÞO/⌙1çQf2[ôƒlþ Ë »yOv BwŒ˜„aF¿è.Ï7>cô¶ˆó‰#l‰[þª—ƒá@UK2Z\X럃E™%”YXxBK™åN>"eš+ÙåÃÌ]Á,cúK†(û e@ÊiLcšj ý¥FTjÔ=ÈæÃ%v*ÔIk"9:3îØZ—`4œ«2Ä× ›íý!Ê#e`ù-=‡%ÑC™Òéù)ãšÊã³4ŹÑ÷tqñ F²³`—¡TA™¤ÈRp"$‰{m1/¤™¢$>„2Å>,oóÅ„óÞ\™?`”µxò‡¤VßMÙãµ»éR[ A4Syõ•ì eâ”IUPÊ|q¥œ1Úl‰H¿2»©Aì”ÁƒÀ¯’2)@)íUƒ6fÓ+{H0ÈN/WPf{-”áupP¦òñL îeb¼‚2¶,$@Ò>ºs™ÜëÚ¼*ÿIâ#üÏ÷R¶8Œª¦Ëb“/ ÈeÀ‡kƒd¶†Çj9.#®dGHv¿r4Šø3ˆÊßXX³*·ïy쀙/ƒ\§g–:ã®S-›í¸pn\Š^PaQfA ežÐRfyš‡H™ÖJöö}¼9PÙ“EÈ5óÜŒs*èT˲¦Ûm9¸W½{M'~/™ám'´’0}öûyļŒqúì%¼Ë%5÷Ú"LÏГ¢y%û-)2í¦1é´H£=÷Ûý”©.K^¶h]ƒ#0½>ÐòX’t:ä3e\ðØ‚íI7xR´þø!1ç.c¼&S“µþùƒ= 8éœÊ‹¤~fC"²¸8)W²Kçs5Bõ:èÛ´G¥¿[P"eŽîÉ&¸÷¦I×êqÀdxŒ=&!\5¾w%; Bõžªš—iÝ`Ë3o‚g)0BÙ´j­¶lÓ ®¡z¡ÓnKsáâý)cî¦$>núÌC™0eêK’1öP¦rƒ­¸¹öÀ”Ä嵓V³h„šŒ‰ØmIMc LeàÙŠäÖl£.˜×R°›†¤2âáôÙ˜¼Êª“˜Š¯ê£ Þ“Í£Êb£öö%¼³b0fÆu/“¾ÃËЃŠ2ãòׂÁL”‰.Êð{²ÿeh`E{0ÈÛéÒ_e؉b¢ÌžÙèmôcÊøŒÙ?¼;eÄ{²‹‘÷½#&{–—ó‡[§òÈ|â¨iEçTÝðsâzéñ‚ ‹2 J((³°ð„–2Ë›|ÜG™3l™†2ùÇ2e ÷—qÆÕM9ÜO™¡¶Ü°’Ý|O¶0bŠÂë²ÝwÀ:ñµÿ8¶Ê–IV²;H°–>‹2 J((³°ð„–2Ë|<š#¦µ’­UêWrïLtO»è ¦[–ü”ÕcƒšÓÚåÍ)ó)«Çz5³Pf­d¨›DK<³]L”Y+Ù5CÞž2íÒGåJö•Aê3VŠ’õvѬ1u/K¾eÞdõبÈaB½]>“2o·zlTd+ý ]4”Y+ÙGJçdŸØ.2eÖJ¶Ñ¿’1ZÎl— e$¬eÉ…'e”PPfaá -e–ùx4GLâJ6=éf˜×¼âÑRj5šB¦Z'·E·`@h2eÌÃã<·¹)oìÀÀvÛÎmËgR挕lXŸqØbÕr¡-:ÊÀJ¶´n€qâ‹.½š>stö$”é²ÅD™ríÚhŽ«±iF˜b$±åæ9ä[ú(#¬dÓU%‹u#`ö2¯¦û§úßÉÍSäî&ÞM™™r™´šg[ü”9Õ–E™q”‘rZµ\h‹†20hâk×zë†ÀI™Ñƒl{*N¢À}ó2]¶È”i¯dç?Œ˜<+¶{Þ»¦ò4¶T(#AdÆ“3 ×bQfA ežÐRf½Çàã!R¦ýžlúÚÀ[a’†}Ö7·ÚFÚâÕRdÁä˨}é1¼-pÊDÿ¼Ì A¶µ‹Ð{D^qÍìoe¾&¡Œ{ÊjQ¦e’…2•—ÇÓŽ‰ñ×&âÆc‡gõ˜ˆ‰¸ScŠÓ@™‘¦ Œ±—èjÁ¨uk7Ñþ¹q*/ ‡jú(#¼';¾7e"ó2cºÉA™á¶øÒß^†œâ•Ç¿C™AŒ1R&•>Ð'c\¹Lùžìøö”áKØ#zɘB2a”-î°Q†§?D™!½d¦LȾe”-N-ŽA¶üžì-³Á ¾ak2o6æ7*Öé³p‚-^-¦©<ðca,Ê,(¡ ÌÂÂZÊ,Oóñ)Ó^Éž)B¹Rΰçw¤¿ƒm‘×1ZºÙ|„=\+Ùñ`–óm© ÇhùhÊŒ_É~s[º´t/àÏd ZíA fpvŽy-›¶Iؘ²ú@[º´è)“™Õ‹ÅÆkqÆü^fLäŸÍ–›)Cº)-XâNÎÆkq\¿Q C¯ì™l™€2xP\¢¿î¼Ž2O¸»iPÊ9‘-7S†¯d7)“½Ì%9²+圤›f²¥K‹†2°¥IL1¶ºjÅÒ™? dÏbË}ƒly%û}¾øw0bzq[Ükú@—jÇMåÍbËSy¨ßhy‘ks™…kq e. L 7@A™……'e”¨PfÏÁZYThî0-ç…]§—µ&… ì É#ÿdÊ„íOsÄw:etªý” \I(.P&ÄØO™áðSæè<á‹ô§« >\&~äõK ?ˆß÷vÿ§ÌsÐO´¼À7ùôФý›ãP›Ù¢LuÊ Ò©8¥ ÝÉ¡Aíœy‡ª–d¦ðúžº¹<ògQ¦  »þòa?‘õ"AN R~J¾$•Pé×&ešMQ¯­©*‰2B²F|/P& ì*‡Ìy³Î ”°P^evËÊkRfa‡DÁ‘öD¦ÀA5éÂPšÄ$¹—i¶S?ʿǨ— ñ¨_(U‡þ\¬¤©ákÒiéçNppQRfwãÔ™oÇ~?¾öY˜O‡A hDØ3™ŽSĨtÛ§æZ%F8eMåÕ!æ2“bõßX”YPâÊü,|/8ÄGZ3ý–=Š uŒ£LEOKuqþCüX?úöÁÏ{Èrü„>|¿þ~ÿþùÝîßH„ܵÈ:¿¿q#¢·Ô¤ú¥Œ—“KÏ”¡ªÙ^­\¤Œl_Óâ)U:¢Ì£ò¹­eÿÓÛ¾(ºÑF™Rç7~ù72º)“~ÿ°‚Hú(S-÷Í(s¼ÿ¨œSà{ï¬~ʘPRæ›~WðˆAC™ïŠÎs)óØŽ½´&åÒ†uÖãñó¨Èí%«fÖlñiû.XÁLê‰ÕÐ}<ý~SÄ¥Ô¡¨åþ¦Oe¶æùÙKS”ÇÜ ¿^¶ì”¡ )7«2[Ãì‡øÝýŽ{•GE.v¨š¨ÛÓ™=™«Këhæ-&}n|Û)R[:‘Ãß7gŒLÞ ŠÂA¿¦dIDATÀorÛ¡FÌËÔÚ°‡2”Ý’"ìŽZï:S„BŸ`±ä vGRªmÕ´DJ¥kòû§<Ș«Nôð…”ym›”ùI=ÖëeèÆB™v{€z“œ’í'6³*”ùyH{ZÊì~h ~ÞŽ22cŽ(nCÆpÊÔÜ\[5ùžœ$©jú—~æðô·ìËŸ”)J¸Š2bJÿ360•›MObª”Ùr™‘KxTT3}?Éq1Êd 4°*ý-:üúi”1qJ3°*´•TeQÆ5"”¡ÜÄSS2çGÞ+7¢ê‘6Y®ð2å),NN­ÇÊ#rÔ܈7AfØÒÄ™o£#¦m˜Ñ¥œ%ì½·—÷RÚJ}Eee0±Çk”)óC[‹­Ô”#Æ+ÑgØ£¹«Ç÷ñ)cp_A@ &¦L_÷?{ "ü”¹{1}á½Ð¦LǯÒÆœ²ð>Ê·À­5ðS:´tüâŸ#=âQz ?x𬒞ÒϘÂgPþm4)³?Ï«u?`r¢vÐðœ0þ´Gá»ê~aññüeêø ”©œ[·ØD™®gÐ}&erØHÂþ“}ØÉ7¤{Fàî·Ö)1Ý;€‚=ª÷¢D™üÄXxî9yð¹ütPÖíR±òKí(e؉"eÐW·›„ý^þ Òw‚zJ¦ \îüñÓøàòؤ í²L³}W™d2b±oA %ÿ>adÊÄe’—@ÊP$h¡§Û¥ÉÞ¿]éJô@¼ëÓ rˆ‹…òê”ùµùIÇ‹2m4)ƒ9J…2Â)”2 è(sâ`ÊTŠ…“s™¤û‹X¶(”ÀS£ =^æ¡ùYÂ'R¦^¬Ž2ÌäϦLÀæiQ²äHö¸zŠH¡Ï”ùÒPF,ÉÛ%2ž58û»óÜì…ÜÑ"eè™\ žRdD¿øÂÏq>ÈG2%3¾è˜‡ c³¬UlŽ7(&˜ËŠ•äþÊð §$k¡§,¼'ÆQ†^½²z/¼% :ügEãÚí¹IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-tcpudpsort.png0000664000076400007640000002365712173477702022726 0ustar npajkovsnpajkovs‰PNG  IHDR5b9¨ÙxgAMA± üaPLTEÿÿÿÃÃÃ4a’ËËËÿÃÃYYY‚AA‚‚‚‚‚AÃÃÿÃ000¢¢¦ßßßÿªYÿߪÿÿ}}}}}ÿ}}ÿÿ}ÿ‚Ã}ÿ}}ÿÿÿ}}ÿ}ÿ}}}¢¢¢aaaÿÿßÿ}}}}}<ÿ‚ÃÃY‚ÿÿÿš¾]ÿÃÃÃÿÿÿÿÏ00}¾Ó×Óš00ó÷óóûûÛçãš0ÿûÿÏÏÏÿÿÃ}ÿÿ}}ÿÿ}<<¾ûÿÿÏÏÿÿ}ÿÃÃÿA‚‚ÃÃAA‚‚ÃÃÿÃÿçççMMMÏÏÏÏÏ›¢ødbKGDˆH pHYs  ÒÝ~ütIMEÒ Û£e IDATxœí˺«,†íÁ¾ƒLzÜóL¸¸ÿ;é?K:Uˆ‡D¾gïe4r^¡ Ä,ÿ·LMY5©™²kR3eׇ?5eФfÊ.BÍK #›z’X[ó!âŠô꿃›g«š©gKAMì§bw5©y¼tÔ¬Èøl÷\“Ù©›¨@ lVàŸb·5õ$•Ûš¸“ö^›<©y¼ôÔÔMä©'ÉFÍ졦>*Ìò¥]z¨IÍÔGÓ£0eפfÊ®IÍ”]»¨qC³2õ5©qñsÙ!§>s·¶„RÄÆh>û‚K©;W(SêÕXj×>$uM,H25räôˆSŸ¹_[B½Ôüïðî°ÔÛ‘iR/ÇRK]s!íÔ­¥9©ÙŸú¤&GâÖȯíWnèR[æò™ñÎ)PrR^Tá]ŠoÇRO}+ŽJ,šÔ˱ÔRwñ\UŒ¬zêšX ªÔ ä`ÃBáǶ5î«Ó¥C/EK=õv^4©—c©¥ž*Fæ<ªðvêšX 5r‡Ò©RS9ÄÕ/–¥t[Ðò­Ç÷¹Šr,ºÔy}÷¤^¡¦’ºC Ô4SoÇ‚ %S³É7œÇOq$‚Š 9’7mJbÉÅBhÆRO]ÑÖ(Ro´5…ÔŪÒPƒR×Äcû6jX+£L*—œ£™WÄROÝBM9õ65Rê6jJ©LMFÖ §—3J ¡œƒjMñðn½_é¥(b©§®¥¦žº†žºžšZêPFM.ï9á”Ç1c(T´ /ŠààL¼K=õX8ÅXT©—c©¥.V•GT©+bA¹©Qh4çÈÐ8ÍÔ+ñ<‹ÃÏL½'Ôœ²®|ê‹ÕGÍëuxƦn¬ 5ñ1Ðü}ů.ȪsÜg»nÚ+çÄh¶cëÑ·%/8K ŠKnÛâàš+*]¥W”¯¯r>¾ôT.ìŠØ%ÕÛš?:¶?ùóUиx‰ò¦,]=äeûGãVÖT*ð”%·¤(*Õ Ãm[V–…TV9€t ,K‹pI_C+PãêÔ jˆC[pД%—‹ºÕìF‰äe5¿”»R€Â5ˆe†¤¥”þãͱâÔ€£­Òɧš‚%dêhË VÝCIƒŒ{(w=3¸‡bä£"ý j`ۙ˿ˆ6 ìþNÿ ¶¡×R“óF½‰bØëI”3‚¨ÉHÝ,3$ 5Ñ^&2´”Sn!ò%Âò/r°5ô Óßß"5 Š¸Ž#ƒîq5)œ’šõ[€-*b®2¶5àà5Ôü}Ðm•¥"„·Ž|Ж°Éq*©8çvOK!ÞÔH™ÀM4’Ñ^–k©ÙJ‡·¯:k˜tÂAC^Ò†Tµš1/ðšô2S#•`‰š~»†ÎÕ\H£vž79{ÚE¸^ ɧšÔ°r¡¤ &ÍòÁcy(N›¢ƒ š|M°Wn‡Ã!z°K9Ît3²„á`²4ŸÒý­Ê,:Á8»94ËË"Dcö(LgÂÔ¤fªC5SSMuP3ß]óx•¨I¯>Ó›À dÓKAó[eÌìGÛ§¼çjmOVÒÇW¬K1êÍÖå¥?˜i}@.^¦¶\|<ß±!Å#ÅRikè{?·F&¾Ö|Ýæ½uc»X›ÀÓõ..×s>~,Égm{ø‰YpÔXSRdšX á"Lð2myI8jó"<¹œò#Bú~j¤ébJÅé5Õ2v°Šð.g{MåÈ”yi†ÃìË … Œà uS#¼t˜79'ý¶lÏ¥©­-éèzîoŸó ÌK=É®=/´nÇš£Ô8AHp™Á€¾‡ð"ÐôZÐ3~Ç%ÝT¹„º¨AÐ(b)F6ö¤pЈ˜ò’L¥í£"/d"õ‰âœ%Î+©y%4üÕmÍ©ñ涅#¹ì²†óå”ÔÈmüìmkðÁóíš-Ãø²z¨ÁÐÜ’Áþ*E®È‹€ç¥›0¤¾’š­ ò”ÿTÃЂ €¶=—²ƒR0S#ÖTo^pdzjÄ k—qHo¢Fê¥.yÃËrN¼0&ž"ßC°½±fs©ŠECM_•"Ó]Q•Ð !}š4ËÝb–/µ# ·J¨]Ú"«ÆRŽÔ¶SÆÂRÝ.lzòB‚«ó"mŽ“ôÂt&L}4©™²ËFÍÔÔGÔÌöæñ*QSóy“(jÝÖè.-™kï6ƒÁ3¹‰ ã4懘ÖÊHJáiÝ—bo8”z­\,#o0ìfç4˜‡G¥ÎéæçÀÈÂ¥YB'…{j)Æ Ç<Úꦣ8ì陯¡yiŒ-y&h¬1”òòUÔ8LSRS›—@ ˜ÜP7„”=Ô¤)y«K™ ÎÃã¾Ã{™ÿÃÞKÚïv õP¹\Ԥυ;¬¯WðÞãঊ‡ƒíaw^@<šL FF¸SC§ø¼´ßõ»Ð|/æÂmÆ,UXŠnÇý²d²k|®"jרû¹b^t6–T£Ú} ¦ú¼“¡ì)'ääáÞ†Ü;Ù¨Õâb{åÑ]æ÷P“?Xê›´/ðs'6©æõy!M´×R¹Ä|—Ït?”šø =}Xµå;£ ¾§|Ñ®ÙâÜ—¥AÔìl÷Œy¡²™è¦†û¼¡s ŸRÛÛ/Pªú[JâD6þöeiPuZ^t2€àѬØ5¤:È®»Í@üž‚íò¯Qcjƒy¸½Ô”}Þà;>xzÁpio¯€Q’ Y3úÁá€m,ÅiÏTO,B–ÜÀ¼xU,ÅÁÔšÞË©&5SvÙ¨™šú¨ƒšÙÞ<^%jÒ ¶xÿ¾*D5jN¦š]4ÅẬa PGŒb{~Ðøßl ã+2Ç"Dj‰— ´)”®eä]ð^²ÓS*•<@UŒSÑ™t!€wdæLK ^‘9!RpW4cåBËÇBú/¢ ÑU6î)L ܱjOŽ`ÎìÔàìXc‘â4Är05Ü{ ghPïup…Ûó˜cM{îp³»Üuä‡ô –XrÏVº0c^à'-{Ä›Âïx >j¸_{¨ç $T¸µy( 4èé*zòjßKÑ®ñbM)⃢hƒ·„h£–{n55‰ˆ{("‡9Pâ-©*bÚÖlñìlkrnìmM™ßÙÖ8X J›:µ.0ÛYçÏ;H{¨¡­ Üë¶@Súf‹DÄew… ÄDMkC\ç}5B!Õ‰Öðnjpe‰%ÝÈŒš½Ö°:–²ýÛòê©IÍÒóz÷§†tTp¯3?=Ôäæà@jÃaVN'5¢Ï[C?Ë'NG)z( 70|oO–J«¢KÁœóåÍμ¤Ô@Ü£}‡÷Ã1]šÓ¤fÊ.5SSuP3›–Ç«DÉç}~…† ÛsýšG?C,P¯‰[™h EÌü]y±Ä²ä@Ñù~€÷òtjÒõ(ÇÌ.ÕMPB`vvcp§˜Æé+Ù²³wm´!Q1Ž¡îK ,Méä»Æ¡É¾<ÂTÌnbödÊC——ŒÉÎÔ¸5Ö‘wÙ{ »-¼(á|pÑ°Œ‹!R¸tWã¿}ÔÀÔµõ+ìQl»ó‚*ÝÒCå^*wT~$5™œ"é$KÙ‘©K­]Cº&ZÂû+ÊF ³kê5eÌ‹)Øð¢«Ð窩>o2E ™2^e—5,ãr¯ 4\;óbŠ´3$šÔÀƒÀu5€5¸}ò£¨¡]Œ–¾Áû2ÃŒ[8ž©‚½§¢†ú¼·—Q{^}MÁáä8jpŸ Í ³¦5ºXÆäÄ]¶rØù¾ÿÝæšh¯³W{z…Ô莠FjÒ5A¤»{/5(/]Ô8GàÑ¢ó}ÿ»Í“aìOCQk US¤Ã¦;×£-lÄ¡ ‘Ô6}yÁ£ ëEx!6jÕ¨˜NÌçhR3e—š'*åßÍÝÓͬaCÈo¤±©¿IM*4¡8½’šØt$(5Ѻ´‘ÂÔxíós´­Y©¡åR¤æŸ¥ÔÃ5¨Á9ƒ¯¶† 5ÀÊA߉A?Ô\|矫HMÙ¡0މ݌š0`O J °yqz5°—¨9·‡ò}Ô€†—ì‰AÃ3©¡ã\œ¾47Œ¦÷Ø CŽþeŒÆSÓë!FgbŸpÛCIM,+5’æLøSx$5uMjZ “&5OT˜Ô0uPó°i¤†©DMm7£†¼&ë¬À¤°úIG‡Œbb {ÙìóO¥ÆAñ¢ô£VìžIMœØu–g³ÿ,’9†Ú´QJ‰¥OÍáÚZ ¯Ÿ¯YCå §fŽ¼£5®øæx5|Å®ð^>°Î…¼åñ¢ò¿^j2€¡ÙA ¤f-$¸AEéw¿Û­ófKÁ=h…ăv¡®©p7ÈÁâ%ºüPVž"žÔ¬Ú㇪­ó¦µÏÞ8‘?ÀáøWyû… µ5¼†1À¦gR5’v0Ž²êÔxÜ%ôvpº\ûªho<(º€#OƒëŸ¯AC›8ÒÁ£É,µÏNYÀ^/‰ßƒÇPS/— 5‚j8üª£!LÓ¤¦¥0©a²QóD…I S5{±D˜Ô0©i¾ÛœŸ‹vTž¥ƒsvúp`®ÏáÈ$…GRC‹‡”¤ï}Kµp.Ü=NÙ±æ;Ö(l„ÐÙ›4ÊJ *kZ”~<5k»°Ñµ5ðÙñWz'5:‚øâròê>ønsNIq û„–J\ |ÂÆWz§ÂC©É…2Žé•ÔÿÐ)ž´Qž‡ë1hl>ïÔ¤¿uë(<”On1T~÷»ÍñKˆÉ¡½t@g_Nžk_ÎQj|žC„GRãAíkkàaDB…û"ñ`Ÿ l£†ù¡¦]ƒu85ÂAÏÞRMWE›Z+l {55ÙíßÓfÚó®,™P帇¢­NÁ®šµ“þNj˜v½a­ònóLT2vò ©ØŠ„ëuÇj{(4Ëçaãcñyÿ¼†û¼O›“¹‘Â3©©jRÓR˜Ô0Ù¨y¢Â¤†©ƒš_}¦ 0©a*QS]çÍßš&€t$\Â#œúpÀ™ ÇRJkøý‘­šÏhˆs—F­‡¢+v'S“®' áØsÙ. „šôG­ï¤—5)Hÿ}Ô 'b Ô8‘7©ÁBÔÈM°ŠšÂ:＄]ÚxŸµÚŒÇž'Ÿ²‡J¸âºëÊ’îx0~ÞªˆKº/ÒÈ»øÙ‹¿é »CD&ëlvÏŒ_f1’` fC ´ {)Ÿ²~,„»H£VÑÑuÞjü5Ô°Œ7Ãzlm ²†Ô’ æÄ%ÝŒ9ÜEÞKTÈ°}Ç:o€È‹S“z*eUvh'5ÄÙmµkŠVMy™eñD ]Ò}FQSx§Z悶5ÞŸFe …ýO˜76k¸„Í^jøéWè¨uÞie·¯÷P‡³‹ŠŽ¹­ÑÚ5é°¼¤{)Ù5#èÐQë¼=°}_¹[òð=…¹¿ÂîXý,žÞÃpý,_úÃEÇBé8Y÷¿Ž¬"<åp×èÔuÞ¿ª ÷(\]ßc4ßm>@aRÃÔá½|˜Âô^2uPó°ö&Lj˜JÔÔ|Þ,’K:.hÔZIèKÈcïA>略×êÀè÷uxû¬áš÷Òó3ÏzZÂzÀ«±‹÷²FM“‚;QÓû´ùQclkâ–P³ä=©Qø¼ÅÍiJGƒµc –Y>4ïÂ^ÖÎD34`¢¦ü,¥ßQH÷/C¿ç÷¼_xZøTK¹>{Ù —ítHP0·5ØmIþlçñÙàä[(?Kù7[Öâêµk¨Ï[to¯,õ7@ÔøX8•X‚Þç-R³žikÒŸ8 ¤à§÷SƒÛ|ð©ÔTK\¬öEhk¶?ÛSXÛÁüËð›³ÑÂï”ðÝÔPOö-¨¹²‡*JÝC­˜³¶P²Óüx CÅ]Ù½ý$»¦¨°öx•íšÁ³!øvÍ>jDŸ7Ž_1†òh,dG]ßC¨ dÔ´í0&Z¿Èc¨øò‡/Bdgi¾Û|€Â…;û9ç»Í(Lj˜¦Ï»¥0½—L=>ïmT “¦Ÿ7£†<{~ŽÈ28cÀ¸±È§‡#|Þ7q9‰JÔ”Kwœ÷ò|jü_Žÿ0‡sdhé´ë¡ª‹ÔÞËo &ywšúê‚r8LiÂc¨Ùšb±\º¼—pweç“ÓáNH³³{ 5fŸ÷’>søebÔÅç»|Þ^ò(¼ÎnpÈ£ú`È’ÉSÄâÙRÓ´kÌ>o|Òù³ÁXÐ{Y(Ý.Ÿ7<@üPWPÓ1eÛ+5´5;}Þ2_wW„ša>ïäAðw ÆwQ#¹£ÄSƒÙ®Ñû¼ 5¹§RýJ~¨vÁç}j°5ÜŽ%줦åó^–Ò÷ ¾¿f´Ï;=Ê—}Þþ{©8ò¶ø¼Ó3Y0Ü=쿧­}ÞѪÆÍ몶¦à•­†ÂÞÜøwÄ,ŸÕç½~&áî1†ƒ ^„~®Ø­+èQ¸ºY5×yP8Òuq³"jú¼(Lï%SÏ{o=|—¤†©Çç½}ï¯ë±€kžvèÑO%ž5ï·õåæ*—Óº©ãÖyoc¦‹¨q`°löC?B~  K mÍÎ÷á5ãÖ(`j¼¿Ššä©þäxR3ZG­ó†žïKœÝˆš® ~.{é> zjzWo_¶¤[úµT¹5ïôyÓe-×M ÷Î ÃGŠ÷ÔGÁ@ òdç òÔ< á­{–O(Cßÿnóû8 z|ÞÂF<5Ô¨Á>oP÷ÆÕÛ·¥f[ãÙþã©ÁJ:d·R~L¢ºzûŽÔT¼|]>ï;Q³Ó{9¶‡ZÿÀMz`7HèC¸%5À³ËËÐ÷¾Û|Û$ß·¡âv‹Ž¼ïBM¶kŒ«·Åƒ)=•å»©‘}Þ`{Õo—§mvù¼«³Y…®1TôrÃn«¶zûnc(<ÊŠÐïö^þ¸K3Ì·T3MjZ “¦éón)Lï%S5ÿþí­ˆ¯R˜Ô0©ùcãߦíøi;í5ºÆ³›ÅPÈþîñô _¥r9)¾»VÈçmœŽ$|¶1k} µ~5Ðõm åÁ;WŽ¡ê¿Uß×~w­Ð¯Šç†wPS×0jëÛÌj°WJRx25Öùš5q?m=íÄÒß|JŽ”õw{ÔEM é F»zû^^n,øk©ƒ©A3,ìj…FCZœnjrCÓ~¾+ôþî%öÜÙ˵g=¥&¶˜)t(Ê1܆/š7L¡Fè󖊸±—k$5ä0"¡BÇ”¿5‰dÞ ²k”«·ïOMÏ[EpÐÓ懮6»ÆVϲ:©Þ\àÊe +Woßžš.Ÿ·L à÷P´Õ©Ù5ÆQ]#oäÍ%/?’Ìvjõö¼ÜXÐçm~*‹ âÁô7£Q£&€C Ba×·1Xöæå3¬Þ¾÷ʱâAeè-…1„izçr³Gá–-ˆ^ÃýPƒªzÐtÍ9 v?Ô[½¦Ï{€Âô^2MŸwKaRôÏç})@U{­®äú¦ Â[†¯ó¾øU|H{ÖC•< ˆ”+©iÏêVÕ\ßLÁôûP\*jøÜñu¢ï6îó¾5c|Þ•XÂIÔÜF{ÞmÞð^¢¹œë†DÔláâƵÖÇ=5ý¿Ò½ðàyõæÉ:ÑÙ}²j×Õ ™7­§t·kJåÝ»Î{Iœ paƒßR-–ËŸ7s@¯Î¶P³¯­9b÷/QC55šqvMz(";™‚uw¸5Ðþ%jz­aÚ?µb fjà& pƒ„>„[R“ŸëófÎîSÕ;òÆ.î¡#ï]ë¼ïEM,›|ÞØÙ}¶:gù’}–¯RÞýë¼Exìuºö½õHÇ{Â\±Ë4©i)Lj˜¦Ï»¥0½—LÔüø;$¨Â¤†©DMó÷¼óë?¯°fíæp¿Ï;ýáÒ¹·ã—wíÏ05Vk¸ö–jðkb– ©m*aˆ÷²4Âü(PÂú_’…š;y¹±5Ö‘wãÝæ×üŽ f÷“&?Ô0jn*Hu–¯õnóË©ùœ°3…Cm~¨ÿ˜Ù½Îû^^n¬Ã¨Y‘¹ššhÐì†f5Èi-ú$Ó™wòrc¤½ÛüÔø-Ç'S†¯óþ]jèÁo¦†AÓM –LMk÷õž'¬QÔðßó~¥ÆçjkØÛ©áÐŒ§Æ°Îû÷©ÉŒÜeäíÍÔÐXFÞé—q÷PÓ9ò.¼Ûü>³|ÞJäGÍòé×yßÉ˵o–OÐÃœ  s7Ó¤¦¥0×y3MŸwKáw¼—ÿ³ªqÖôyPø!jÀß²óy“ß3¼F½>oàŠ’FSTýÒO{ùeÍd­ï:¤è?g©éz´ì½S}Wú|—ÏÛÃus \Jìú®,EŸMÂö¶SÓ³Î[CÍé¿È ÕëóöSƒÝß\A?òÖŸôÔt­ØUx/ýõ6NŸÏ,gé¥æãÄ|3<Öå¼Û»J¶SÞ˱ÀïB$²h\ö£/«WãbjR×t)5Ý>oØ%¹Ô\Ù¨yoðÀúN{ëtÊûMÎ|ƒÈ*Ô'q’>;$°·5®kÅ®ÂçíoÒÖôQƒq1<Ë÷×>ˆõM¨A§Ð3…Sbµs?z<Ž25aß!OêùÔ°ƒ7ðxï¡tK®jQjª,HÔÌr,ï­9‚ŠÊNÚÈ@¾°;xN}jà4Ìçí¯§¦ßç©ißC‹š·¢­¡PÀ*X°¨ƒ3ж†|Š»»©Ùm×Ö'ø „ï¡& fRC›#FMÂÓXàé ž†]/ó5#}Þé§ß¯{wú¼=l^<ßE ØðJ¤7F‚ÍñàïH,XyH8á$/Bô¡u Õ9Ë'èj3æ …šGA5{ÓÔ˜XÚ:Ü£ kRCe|족4u¥÷òa ¿ã½Ôiú¼(Lj˜º|ÞùYó«'‡}mÌ\ —·uçåÓ©9Àç}ùƒÃÃî\ðaõÜðïë¨uÞÛú4ýw¾\'5yÀž]Þ•ç-“©ë½¼5{{(8Ý3©É:ìļHú®†Ëmï¤ë°uÞ7¢fýÐnRSÐQë¼}Zzù½Ôd›hRƒuÔ:oŸž¾Ö°ÙÓCÁU—“¨×y³Wh—]ãa[3GÞY®ó¾5Ìwm çñlÎòEÍuÞžM¨IMKaRÃ4}Þ-…I SÏ{o=|—¤†©ÇçíïÑU÷õÍò¡'@§5W¶TÞÕå½¼5qÈý72†L#vvçÈ{UZÙâ‹åòõÔØçk¤uÞs–/ R3Ò{ùBÝVì½ÀÌNÄÌR™]²þzáÊ“¢l׌_çí·G²2žmìj“«®«ó Í™Ô Á•-c}ÞBï¼à©É±U¦]+5Ý…ŒLƒšgi 5ð è£‚ý—?‡š½~(ÔÜT¨yž¥Ûéó®P“Ûš£Mf0 ²Ì£ï¶]ó<5J·Óç&r5ž£¢€k{È\(¶7\WWà%JíñhŸ7C¥C/¸~áà 8«»|Þ†Y¾ç)2†û¼kmÉI#ïtu^¢F™EÍ =ÔIºº/Q£L¦Ï{Ê®jþý;4GS÷W‘š?6þmÚ>Äo Ü\ƒSÇÜp˜:ïå¶y)Û÷ûciQó·Ý8Y©ØŽ º„šž‘w ˜«§c†ùÞy©Ì%ìå±ÔàGsºëûçò¢ŠÅLMÜOÛ¸!}Ù¿bGv€úýÞpnø§òrKjÀApØÓïöæZ§¾§%€+!/©û™¼ÜƒšØt@šÔLÙU¦&šd5›ÊUwä.?‡¨:´fÉ9ioÞNXEjÜö§:Oy85¶¨÷Sãh$Íç‘jQ㼯ýÑ¥¹ŸšÖyÂéO¾q&5Xu»†Q$hzÁ£¾ ÏVíÏø„Óst“Ow¨{ß䃥œe`’/¨~ÛE‚”+nÖA4V¡ôà§Ô¢¤ ”V©©–»Zœ©< F(ERŽkš\E1Ö!“âø“s(Kày51gôªÔLE‰Ôˆ÷°CßÉÔ(vIˆeÉñ,‘´­©glöPzÕ¨Š·5ηªv‡xÔNo×€\âªÒâ¤Óœ{“Ar›sTÄëAp¨¶ uPCüô9N­Å*f;÷^(K•Œáy½<*œÜP•íš[jVà-4©™²k¥æêéSߥ›S£ÏÙÂ>L&LͲˆÕ*‚¿ˆ‹Á[ß.ô¼EGOÐé½þ}¿áîöù 7=‘ƒ¨Þk)²wå;AêT·¸BŒòÍJé‰Q“½Rº„9‹ÕLHÍÔÔ,…ÏumE¼ýG÷NÇQmöQ“#d(ŽÊØhS ý÷?]üŽ&R£¦˜î÷QÓÞ_ ç0½0),ãJ# ÄOL(42R#f^ºXÔ{¨YÂzlí¯b·%nH}-KX áb í¨In¶Žjû.È3A²¤±×5ëN“š5UUÔ<%™šµÃ mÅbjÚôÞˆ É;¥Ò)V‡•š­lâ¡~ðw´mY áRzͨQtÑ´YðÉ4j15EIouøf7b©­ÁyÑ 6jí„hûÜxEÔVB-+N*ˆe¨¤3.Åk¤TÍñ>O]…Ô. ˦Ô>2@Qs£­],W2CU•hqèU¤&H uS³Å.]Œ¿NMH5fhk𦇚H^ì)„ E§,¹iDy£ùgÔ„EÚ³R³~@Õ‘Ôà„‚”P/55»&è©-‡¬#¨)÷µ¨Ñ÷è$)ªj+£‡V&êñ¤¦ÐÔÑCñÍ5hŠÔlv͂‰),…¨I|!5_„š°ÊØd ¿ùû–G{¨‘å„Än H.%}*Œª@ ÆÖX5À–^òß, ¶8†Ú2²°G¢Æ§,0=pr*@’ ‡³»€àUÅñ žåÖ$2(×Ô»©!³|x*Ž%h)i’Aqâ9¿œ*¾PÉÃdËc·{{t[ª»v½Û§ŒÑ×&tojt,•½©#ôeOJLÝBMjO²9eê{„©€õ %ÑS±(Ö P¥_Q”~׃lüø‡&u!ŠÆ›¬àÏ<þ¶ZÔ¬ìV‹ô¸aX,ä`#NIô…ïŠû,ÇíÇ'5eý5…sË9î¢Fõ¾»ÇR“ûT×.þ€ÜÉKÒ°®vŠO«`WA~îy‰šüÓ¬à—ÆÑOË¿ÁIj^J6ÿ°0 ȲK)öW~«¦5°Å`kV\zE€GH¤ï„Xð)™pÓÓ_{†?î«ÔàZˤÅ=zÕȪ“-´˜q/eð÷™)Rã+Ô¤¶ Û!!| Šs»A_¸Ø •‚©í­ýt‚Ü׈ɂôÊÔ¼@´ùW…'5¨¨Sí•5Â)˜š$Ø4`xü`j É‚“›vMŠû…r6©1Rz 5ø87KóïöHM9Y5$˧ÆÁªQŒf)c±àSDj„jï¤æe¡FLò« ç5?™ŽH€Fì¹\×"5øL <±—RÁ:Ï·r>HÇ6Ž!²¶œÕ’Í &d—$+…û9Éï”ppS>uEr,ø”©ïÔPjð=,Ç‚oó©¯ÔJÍÔ”Iÿt_G‘!¹IEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf-timermenu.png0000664000076400007640000001667012173477702022521 0ustar npajkovsnpajkovs‰PNG  IHDR‚“‹Lƒ„gAMA± üaiPLTEÿÿÿ‚¢¢¢YYY000ßßßÏšeÿÿÚššeeeÏÿÿ0eeÏÿÏšee ÿ¶¶¶Ã¢ammmeššMMMA0ššÿÿUšÿÿ²Ãÿÿóóó²²²²²UÿÿW§XòbKGDˆH pHYs  ÒÝ~ütIMEÒ  MñÅIDATxœí‹’«*·Fû1v•EÓyÿ‡üW:ó† " ùF­ÕFEÄé^ úóCù`4€üÁX˜‚Û?>ßÃøA‘˜ Àyx-ø1ëãá‚ÿ&ÂAЈCÿ\3úÌ G îÿê<`&Éh­ wm‹^®"×IÕ‚r<œò\¥TA§ŽÏ4 ‚Á@A0˜Ä­isÜ_–àr4 t`0P  ‚Á@A0˜ þ?‚`0P  ‚Á@A0(Á`   ƒ‚`0P  ‚Á@A0(Á`  Œ¡àè.Œ`M   Èï?Î- ÿ5ç‡á¹ìÇÇñä”$<ñß›äG~¡ (áãÇ­ >(8 *Ìþÿ—ý6NÞ˜›Óùlb~.$è¹¥Ç@ÁaH©"nÿHýÔµÛoœÊæ‹qðø «œSðTò‰6ùh*(«ÄOòob­W® ÌfH<< 6sÿ«0OÒLÉ &Rªêòµ¥½[Á½öœ(ØÚ©PÁx¢—\MBÁiv$솽çSHª <“Ø$9å›ù\ v#Qù„S¸_îG¦Æ3ÇÔ4Î'KСX^§ ìÆ4Ç¿áà@ÁnL¡ =œ(Ø)tÓP°s(8P°PÐ v Ú\UðõGýúãëx‘Ia/W¿Ò1˜ ¦_ë\Æôñ‹~È¡çr-øÎ>rñUÆ2†‰å†] ÆwÕ1yüþÔðØ00ƒ‚ûe·CØÛ¼)~M"Ìtth¦àæßÆäؽ¯˜é†î!ÜìÝÁ_BK<¡0Ö3Ç Î¿tΨ¯(øúèØ€†ÒœNä“øð"²sDøØ´IkÈ”‚L½Õâ+ÀýP_:´¨C%ÈBEbK¾aº¡K|ýR!¤‘Së™d-*½ãקüûïKÎ65Lø|0¿`Ö·':B] ÌÂáxÕøM¥`âK&BhÄùÔĩŧᢂÝã×$Œ½›¦6Ë ‘H&„Öºìªb ò ο§(øWÄ¡"§2!†æ½@s~A¶\Ì7¤gË=슘nÇ’ñó·¦o¼™…I½#ÌÝ@7.~P°PÐf§=üF¦Vp`üVQðL­à@ `7   ì´¹¬àF¯æÉh˜íöûMäšÿÜYÇô'y…¶ðìíïÐ_ÐjË$A3o{ž ê³wA$q_Ðå¶ðÑÛߣ¿à§“†¿¡.Ówã+\…Z[1$ê=ú Ê(RÅŒ!¥ ¯¨ce*Uÿ‡¶èÖGÏÂÍþ [KÒ tŸáÝÛ?‚ÎÝÑF¬ÜbTùØj@ò¥£ LL]¾7t­A”Žç¢‡Íö£H\Žè¶•¶¿GA«”ÓÂ{|èÔy£È?¤£k!jû³–ß$¯ˆ©:«mÿ˜Z}È*èüq˜/ŸÞbq²Ëø.ˆ &‘0}S†–w±íï®à¦b•WÐw´qör—wÁðŠÀsx9Òaû‡„¡£‚R12}pQEdªî ª½aåq´ ëD^Á{·]ý©I¼5ý7FgÇS·Éズ"Žû`£ù§®pcìùiüs®ˆY9—Ûþ/ê/8?h ³‚Ý€‚6P°PÐ v Ú@Án@A(Ø (hsUAÕ`tÖ÷¦¾)S¾IŠ‘ôs(ôl¤æ!ŸdÖ>Üm’â_ƒÝæ4QÐͤIöá=ÏL3Éf¸YÁÐ8âÛŠîæÿõ™}ét¡ƒ‘?nªVƒÐHeŽÇâˆþr²ua¹z´ŽÇ” úýOhÒqß±¶àã6ZòžŽ8CþÐ! ³§ÅÙ6Þæj¥@¶îŽxÌé7(kÃVµ Ýå!Tθ\‰ ÊƯ}üKò±C.ÃíóÑ»fx5˜ë5}KF1`dþr¨àªñ#r·½ –òÝ ¢œ(§PÚ(øZ6„ 9PÐ~h[&~c/_P°€¢þ‚P𴂯y` í÷¦û¿ùÿ«ô€;KòÖôFã²ZüƼ؇(ªG…°Å t_¿Ö sþR¤àƯy-¨ž\›˜ÿ}”Õ‚ß?ô”ézÊØ@Án@A(Ø (hÓ@AyjâÇå9K¸Ð+,Új'=)?£`¸X˜Åuå–n™–æ;|xüôç ea—Üd߫܆OÂ~$[G:Åïžp&=,oy¾ ¹soòû» Ž¶Í›þY.ä3í{„[‘~¦ÌAü蟋ñ»OAÚËÅÆø¥mÝqŸ¶mŠ¸u“§á¶Ñ|h{è*˜Š™4güt|6 ÍÃáYm;î³MߧÐå NûáV¶§âW®à øŶ_fqJÈæšÖ‚qJøp]ÁêàÌF¾ŒS謋 Þ´5žœ‚äš™ `7F+xO(ÉØVP|{œ ÒÅs„B–>ä3ë{„[Q~.Hãõ¼¿ÛÏ Œ ¿Û¼å\Б“Ž}Ò¾ÅÞAo ›/ÎQT>[ˆã"§‚eWÄNÅLž0~/zEÌ;²+bR%6ÿ)ûq«ö tkÄo¤‚kD°˜æ .¿Q ®s|-¦©‚ Å=eºž26P°PÐ v Ú4è)SuRBoYnj̤âfE’ÔìÔR2ß³›áÓ—.v|S¦]æâþç ÖÞ:~½ü+Ãí¯d>a_W)˜4“ßÇ­V°x±Tq¼Ñç³»‡©`?e—÷©? TÐÿžDýŽÐ(è62¬å²‚¡÷Õ½qc.šZtY݇¡[ˆè§Ë¶WWD,_Ñ*@ö”‘_l4à*¶‡7ž¯Ú²4Wº¾˜¿h¤Póùž2WâN¡ s²uεë¸OCHˆXhIÞÕ±|D.kå+“ë9ƒ¢û‚ïQº:¶¼T„VUtÏ’ù©Gx¦Îuœ*⎂ta¸óD;ö™†4pDÑØ.æ™ÊZÕÒ@ãHÁ 3(&6÷–T¤@ÁÔ.ÏtS¨‹=óÍÓÑ¥tê[G÷¥ÚÑ¢h©o¿vîˆ:Þåd³oTЦ¨§ÌÙ8Äôä€mNC­Ö+åTy.¤`yèêèÓ‡¨8‹‚›>'‘ ʸ…ž5­ ™V¤ /G^A9ߦ¬¿`erC­Nô8W`ŸM12¯`•‚ŽÏ÷ùÈ¡Ê—ÄYì§Dq9G'È+N‘/ÉSäÏr óe©d¨eü´*•qÈ_aÌó èl `7   ì´‚Ý€‚6P  ‚Á@A0(Á`   ƒ©UðwR&.Ú8&Ê'föòõföx@Áå™=Ppyf\žÙã—göx@Áå™=Ppyf\žÙ㱪‚?;ûOº·Ÿ/Å=dAÁeqÙ_W ï»ó;U®`|D4„|ù¤…ž>Jgw¿‚ñÝúå^aþ_£àÇ¿ø?ð:©à³jTw»‚/öCu3Áq×ü<$k"„‚ÛGÀí3v `!PñÊ*˜£Á¹`|»’‹?úOp½Õ/Ï÷£o˜À,úTâ!åß_ÿãÿgYû«5¦‚¯ð0Õ ¨~?1Ù_M$æñg¤¤žx9…Bü@ì¯^ö6ÜkÒ Øû\N$oóé+Åþjª  Ï<ñÕ`æq?­Éׂ ©àç¼ÑR šˆWn†/g(h±ïSБ©Ÿ$l¤ ˜SœSP=p¿£‚Ý*Âå¥È(x‘“ 6±;R€çÜÉa+Lí2oþ)è¯G~„‚©1wQ§ÂØ_­Ñtio9Œ·Ùãåóö6òÉ™ÃVýßxkZì¥xE¼Eåq¼Tö7x àþ²C]ŽÄ?ä‘çÓ½øÐ@GpÙ_PpYÜCö\÷ý—Å=d-¨ Ì(¸<³ÇcuSع›Br~á=¤n­A9ºtÖ2Z=b‚ã VW° ÑI‹ÍúÉm¡†‚­û2BA {§R]¬¿FAß:ã{’ÑŽŽ÷käòðùɇö‡d­B~Á»·´Œ! öí/8¦‚ôE[¢ÿXl¹&ó l>kèNô‡ ‘£¹YAß>ç^BÁ»û Ž~.] òÛäý!eÛ¸ûWK(س¿àlô«É™¿û>öœ CÁ¼‰ó ÞÑ_p6´‚¯Æ nº?¤ÌÛ±9æ°]”7eºöœukú¯êW²ñœ-ŒËs¹1?^"óþ.fçB‚}†3‡½èÐ_pÿÀ&Ç?_Ú_ðˆœ ³AñˆýõE bsþBf\žÙã—göx´øñ>$?×܇ûô0ÿ°$Åç`¹dÆÃçÊ2έWÞ/L¦ãuÙ7C쯻ÖSæ&¿#Þ?‰›²‘ ·é…¡É&÷º_‹¼_X”¬üúº“‚7­'Ý_0Çeɪíûm­wÁô .Õ"áIR 6]ßÀþ‚qÕòniD ã±U$ødÅBÂæ“ô²¿^j“xë5ò'ëw|úÆÊ›.Çtý ?ñÐë¹WÁWh±‡¢|-$í¦GbÑf& cïEr %扂̇•Õ¸W-4¡ÛEK`•#ΰÊÛ¿aˆÇë1:k±6áTw×BÁÖt/žR0Õ¿N+è¬ýf ®÷oˆÈ÷³bÙïO¬ž•ƒ×z±nTÕ ÊÀ©õ°Z°‡‚7¯G*{Å|ü³Ú÷ôV×*¨Ó“ÔRA–,ye§oBøž2F©¤šNŽŠrÆdô/#] Êõm;þâq÷ztíÆŸAg5ï/8NÁd,“å³JõÅ 6]Ÿu9B;I$+ßÝ ’½ÐDÁMŸ’aZA¹2™ÿYy9è¢<k;DžÆv´R¥‹‚FÁ~ç‚Οlé_¦ùMÞ÷I˜Ìw»Lï$®$‰ƒ4ŸŒ‚á Læ#¯h…‚t{|:^^URp–_b;bXT¼œ9¬%œ šqn†8Àö»"¾ú8µ-ß]‡Ç~|AÝ=@ÁV@Á:..š–ï®ÃVG `wf/_of\žÙã—göx4i c9ª“§³çRWϽxÈY?2ªW›;é“ Œ»+U\WŽœ‚Ö?îù‚ºŸXbO•rùôßVPß[>½âÔ†‰ûyg¹¯,'¬\º¿`ÅJ*X ¡à_;„¿KÜHAs ¹Ó]ÁÔúOd`Á  l­ØÄO·\Àˆ¤豅 ±IŽ­JV´‚XåVCÞ>ãâ7±| h‘­*Ûv/•>y"‘„õ”)^ÿE{>_ðÅŸÙâùhNÜ ñŸUƒ+S汉öU¬œ‚ò«`–[],¯õŒâ±òÈølo3ÎÅKÄÉØÞ¡øÌúÏ¢û ö{q1ùZ9GÆÉ—ìXA«¾¢ó6š–M>§ ž)Ó…²ÄüÙ$‘ž+¨«A¶­b;Ù(OWzºÜ<·þ³]V»=_~ËÉ6$·N– ²ðÎ •µ ±IbMçt[.®‹ç¤¥‘ñ!䆊ÊUÇÉÊ?O¬O¬ÿ,ú@Üïù‚w)h˜x]A½@ZAž?[¿H_§ ÚR©û<^ÿÙU•+ؼ¿ ?¾Óý,k¦Ýþ”‚$äE òØÙ¿K8›*·5‹§¤ëÐ炇ëUñq2¶7g§<,ZÿA~6º¿`¯ç †“NyåH¯¬ø¸˜¸ò#ÒmŽüþäB=ÐWˆ y¹Ô‰TªÜÆðoïÈ|Ée”¹¹þŠ¹xå··HÁÓë?Íóž/X·%YÌÕ Uw¯¬%sÅCóTcªg®CÁ£<{gáDS…¼Ùmê™*è)³<³Ç .Ïìñ€‚Ë3{< àòÌ(¸<³Ç .Ïìñ€‚Ë3{< àòÌZG¿w8ÅìåëÍ#âQ§àÄÌ^¾Þ<"Ppe(¸2ˆ\™GÄ ®Ì#âWæñ€‚+óˆx@Á•yD< àÊÞú(¸«+HžâX–p“?2$?º¤Yäïg°òm2ò£ÇÒ‚>œÕŒ¿’¿nÍbü¦œÿ,Žÿ=±˜1C>_P.s¶ Oç+tWÜîUЬð à(} ‡#Lúpÿ, 2¤¿ê'ÏO8¥ õ´’ŸRpsô×ýd1q€O”ûé²~‚ûeùƒ7ÈÃ(؃8Âté}€™¬!ò7òÓúý”ÓÉ‚ÊdÛf?Ë ŽãD-Èöìf¼çWN;6Övt(§Ó©R¾ Y ’gž$t›Un(8–âsÁ7RA>YM—ÎÕ*èäS~¬sÁOAËÔë‚㨽9£ To —… ª„‰Ë(øDÎÞ”±Îù,ɉ\JUW¨ ÌO•Ïçg ’¼™‚8OÃÉ[ÓÛþ„Ëö4<2=¤ßó¡O»‹×¬dù˜Žç£Ÿ‹gÞšfWÄ<}(žÈ7Œ?ÜÁÕœÙË×(ØÙË×(ØÙË×(ØÙË×(ØÙË×(ØÙË×›Õô7eÌ{$ô^†èpÐïO&?Liä9«+HÞÄ)î«æÙ5å8pòõQ:#ä ð ºkQÐêü݃Þè‹cN(˜Og„¾AÁ½m$­ opS­¡-Œ¸C“E¨\ý¨¨MÅä|‚¯œ‚ôÀLõ#–éZOž ¦ÚleÿD((ùsµ ²¶XGÚ„µ‚®PA§œõ¤*hye¨ä*Iµ*ìiB Å¡y ¦Ë;50Àž&œT0^7ø)ü²X*ÈÔ‚·2Àž&Þš~S·¦©4ÑïOøJ®ˆ¹¦âö¢=pØÓ„Iè ÚyØÓ„ TbPÄ{š0¡‚ÇÛ*ØÓ„U °§ P°%¾E< (Ø(Xl ¬ ¶ V[+€‚-‚@Á–@Á ø>âY‚u l ¬ ¶ V[+€‚-‚@Á–@Á  `K `P°%P°(Ø(Xl ¬ ¶ VP `|I™´ wMÑsiz±ž§+(©õOÚÎåû^¸À¿ˆR/½ï—ÿà½,ý#‚*øv"÷¾_ù¸…-û¾_g?C&šjÌrAɘ#?'ŸI3P°‚µ`Á›.ãP8æ³ìgÉ@Áo¢ø\ðÍ :jü&N]Ž@Á P°‚37eòïûµÏk$.BÁµ9qk:÷¾ßp.g=q?$àé>¶‘ܼz›™ .È º¹Mª V0@Áù+³j `#jÁuŸ+@O™–@Á  `K `P°%P°(Ø(Xl ¬ ¶ V[+€‚-‚¤u@ÁÓØ ‚ Ø‹ 6gÀ^|4P°9ö⣂Í° l΀½øh `sìÅG›3`/>(Øœ{ñÑ Ð(Á`   ƒ‚`0P  ‚Á@A0(Á`   ƒ‚`0P  ‚Á@A0(Á`   ƒ‚`0P  ‚Á@A0(Á`   ƒ‚`0P  ‚ÁüSpôÛbÀwÁ`¨‚?oØÜ”ž?{òÔìœ×™åÕ¬Ÿ0ý(S=7[’|K×ÿ‰ßÏþŒæó--ÇU|þÙrÉøóåJÃZQpž±f]ÂÃÙÙPæ–ÿ7Ã.GNL>åK&f—)(ÿ—¯¶—‚ù`~ÏW0«‚¿%åÈ­UæSKéúÿœßSW)Ø“ Êéw)H«[v 2ýךrŠ•BÈgá˳Œõþé$½^’Œåc”C­áWÌ·âÓy½ÌífU† \\Ï,×/_ojû’Û!–Óé|ò‚tF|Ètçkü'bôKãHv¤U;¥ä|‘EØN–#qI,”0:&ùl»Z/]ɇŽ•—*ÃòQëëJn÷¯/¨1“gNãË?Àš¯–#qg7â$—3w@œn„¦qE¿,Db!¾Ÿbzž LO+h†P¯P)ðc®W•Gì×LyIš^´”‚©í–‹ùQ#:n*ƒtÜýG¥ºØ¶™F\ŒU³åT9/"oÊ°o@Ü(ëK‘øÆ°"Ëtm4Öj”ߌŸµQμ‚ÛÚ © µ¼ˆ{z1ž¿R0æ£gýêüÊTÛ_…q9b„^¬ æ·;±ÙvçÔŸëÔê¿b}º|Q –Î(¿Ø¾"‰íÐÛ/âçÓé*??_LJ܊°¶¿ŽÎ t}מ@G €®µ`›z,zÊ€ÁüSpô+¤ÁwÁ`ˆ‚¯—ÿÃy½)ÈjÛüŸ³l©¥Š2{½T KŠ[BÍÆ€“(øžVâà[¤¤L¹EÏL–¼ Ç Xô) ncÀ9² ¾Œ]l³}¨)Åu|*†‚ÿ^dbüÿ 6ÊtŽ(îóGšéÇãôÏ@LßÔx¢’}ÄÉó3Á——§Så#Ó­õƒ{°jARëÑiD=•îÍ[‘'ûˆ’trzüȦ‹™›Ÿ)ðg‚ôûÁËþå žQé¬ùÂ9.(áXA¶kiíGÓùÚ/¥ž:@‡ª/L• ³L)h«°×‚ZARm³r’êÍX¯VÕà*HªÂ=iåJ·MT,lüPA _«dtþÖzÍZÜÆ‘‚b׶SPÕ@AýÕ‚Ïà@Aº ùe?ÀyÔ¹œ8×J¦;:ù™¨¯¿VrªŒle%ç‚›>—m¡­#òJRL&óÍÝK/ÂYÔ>`{P]iŠqz¥Ì®TmŒ¯„¸"V^»xbˆ+âX tbp'P ÆP°°I€& § Ì?ÿÀPþ‰0p0¯þkIEND®B`‚iptraf-ng-1.1.4/Documentation/iptraf.xpm0000664000076400007640000000017512173477702020527 0ustar npajkovsnpajkovs/* XPM */ static char * iptraf_xpm[] = { "5 5 2 1", " c None", ". c #15FF00", " ... ", ".....", ".....", ".....", " ... "}; iptraf-ng-1.1.4/Documentation/itrafmon.html0000664000076400007640000004226312173477702021225 0ustar npajkovsnpajkovs The IP Traffic Monitor
IPTraf User's Manual
<<< PreviousNext >>>

The IP Traffic Monitor

Executing the first menu item or specifying -i to the iptraf command takes you to the IP traffic monitor. The traffic monitor is a real-time monitoring system that intercepts all packets on all detected network interfaces, decodes the IP information on all IP packets and displays the appropriate information, most notably the source and destination addresses. It also determines the encapsulated protocol within the IP packet, and displays some important information about that as well.

There are two windows in the traffic monitor, both of which can be scrolled with the Up and Down cursor keys. Just press W to move the Active indicator to the window you want to control.

Figure 1. The IP traffic monitor

The Upper Window

The upper window of the traffic monitor displays the currently detected TCP connections. Information about TCP packets are displayed here. The window contains these pieces of information:

  • Source address and port

  • Packet count

  • Byte count

  • Source MAC address

  • Packet Size

  • Window Size

  • TCP flag statuses

  • Interface

NoteNote
 

Previous versions of IPTraf showed both the source and destination addresses on each line. IPTraf 2 and higher show only the source host:port combination to save on screen real estate. TCP connection endpoints are still indicated with the green brackets (on color terminals) along the left edge of the screen.

The Up and Down cursor keys move an indicator bar between entries in the TCP monitor, scrolling the window if necessary. The PgUp and PgDn keys display the previous and next screenfuls of entries respectively.

The IP traffic monitor computes the data flow rate of the currently highlighted TCP flow and displays it on the lower-right corner of the screen. The flow rate is in kilobits or kilobytes per second depending on the Activity mode switch in the Configure... menu.

Because this monitoring system relies solely on packet information, it does not determine which endpoint initiated the connection. In other words, it does not know which endpoints are the client and server. This is necessary because it can operate in promiscuous mode, and as such cannot determine the socket statuses for other machines on the LAN. However, a little knowledge of the well-known TCP port numbers can give a good idea about which address is that of the server.

The system therefore displays two entries for each connection, one for each direction of the TCP connection. To make it easier to determine the direction pairs of each connection, a bracket is used to "join" both together. This bracket appears at the leftmost part of each entry.

Just because a host entry appears at the upper end of a connection bracket doesn't mean it was the initiator of the connection.

Each entry in the window contains these fields:

Source address and port

The source address and port indicator is in address:port format. This indicates the source machine and TCP port on that machine from which this data is coming.

The destination is the host:port at the other end of the bracket.

Packet count

The number of packets received for this direction of the TCP connection

Byte count

The number of bytes received for this direction of the TCP connection. These bytes include total IP and TCP header information, in addition to the actual data. Data link header (e.g. Ethernet and FDDI) data are not included.

Source MAC address

The address of the host on your local LAN that delivered this packet. This can be viewed by pressing M once if Source MAC addrs in traffic monitor is enabled in the Configure... menu.

Packet Size

The size of the most recently received packet. This item is visible if you press M for more TCP information. This is the size of the IP datagram only, not including the data link header.

Window Size

The advertised window size of the most recently received packet. This item is visible if you press M for more TCP information.

Flag statuses

The flags of the most recently received packet.

S

SYN. A synchronization is taking place in preparation for connection establishment. If only an S is present (S---) the source is trying to initiate a connection. If an A is also present (S-A-), this is an acknowledgment of a previous connection request, and is responding.

A

ACK. This is an acknowledgment of a previously received packet

P

PSH. A request to push all data to the top of the receiving queue

U

URG. This packet contains urgent data

RESET

RST. The source machine indicated in this direction reset the entire connection. The direction entries for reset connections become available for new connections.

DONE

The connection is done sending data in this direction, and has sent a FIN (finished) packet, but has not yet been acknowledged by the other host.

CLOSED

The FIN has been acknowledged by the other host. When both directions of a connection are marked CLOSED, the entries they occupy become available for new connection entries.

-

The flag is not set

Some other pieces of information can be viewed as well. The M key displays more TCP information. Pressing M once displays the MAC addresses of the LAN hosts that delivered the packets (if the Source MAC addrs in traffic monitor option is enabled in the Configure... menu). N/A is displayed if no packets have been received from the source yet, or if the interface doesn't support MAC addresses (such as PPP interfaces).

If the Source MAC addrs in traffic monitor option is not enabled, pressing M simply toggles between the counts and the packet and window sizes.

By default, only IP addresses are displayed, but if you have access to a name server or host table, you may enable reverse lookup for the IP addresses. Just enable reverse lookup in the Configure... menu.

The rvnamed Process

The IP traffic monitor starts a daemon called rvnamed to help speed up reverse lookups without sacrificing too much keyboard control and accuracy of the counts. While reverse lookup is being conducted in the background, IP addresses will be used until the resolution is complete.

If for some reason rvnamed cannot start (probably due to improper installation or lack of memory), and you are on the Internet, and you enable reverse lookup, your keyboard control can become very slow. This is because the standard lookup functions do not return until they have completed their tasks, and it can take several seconds for a name resolution in the foreground to complete.

rvnamed will spawn up to 200 children to process reverse DNS queries.

TipTip
 

If you notice unusual SYN activity (too many initial (S---) but frozen SYN entries, or rapidly increasing initial SYN packets for a single connection), you may be under a SYN flooding attack or TCP port scan. Apply appropriate measures, or the targeted machines may begin denying network services.

Entries not updated within a user-configurable amount of time may get replaced with new connections. The default time is 15 minutes. This is regardless of whether the connection is closed or not. (Some unclosed connections may be due to extremely slow links or crashes at either end of the connection.) This figure can be changed at the Configure... menu.

Some early entries may have a > symbol in front of its packet count. This means the connection was already established when the monitor started. In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. Eventually, these > entries will close (or time out) and disappear. TCP entries without the > were initiated after the traffic monitor started, and the counts indicate the totals of the connection itself. Just consider entries with > partial.

Some > entries may go idle if the traffic monitor was started when these connections were already half-closed (FIN sent by one host, but data still being sent by the other). This is because the traffic monitor cannot determine if a connection was already half-closed when it started. These entries will eventually time out. (To minimize these entries, an entry is not added by the monitor until a packet with data or a SYN packet is received.)

Direction entries also become available for reuse if an ICMP Destination Unreachable message is received for the connection.

The lower part of the screen contains a summary line showing the IP, TCP, UDP, ICMP, and non-IP byte counts since the start of the monitor. The IP, TCP, UDP, and ICMP counts include only the IP datagram header and data, not the data-link headers. The non-IP count includes the data-link headers.

NoteTechnical note: IP Forwarding and Masquerading
 

Previous versions of IPTraf issued a warning if the kernel had IP masquerading enabled due to the way the kernel masqueraded and translated the IP addresses. The new kernels no longer do it as before and IPTraf now gives output properly on masquerading machines. The -q parameter is no longer required to suppress the warning screen.

On forwarding (non-masquerading) machines packets and TCP connections simply appear twice, one each for the incoming and outgoing interfaces if all interafaces are being monitored.

On masquerading machines, packets and connections from the internal network to the external network also appear twice, one for the internal and external interface. Packets coming from the internal network will be indicated as coming from the internal IP address that sourced them, and also as coming from the IP address of the external interface on your masquerading machine. In much the same way, packets coming in from the external network will look like they're destined for the external interface's IP address, and again as destined for the final host on the internal network.

Closed/Idle/Timed Out Connections

A TCP connection entry that closes, gets reset, or stays idle too long normally gets replaced with new connections. However, if there are too many of these, active connections may become interspersed among closed, reset, or idle entries.

IPTraf can be set to automatically remove all closed, reset, and idle entries with the TCP closed/idle persistence... configuration option. You can also press the F key to immediately clear them at any time.

NoteNote
 

The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains on-screen. The TCP closed/idle persistence... parameter flushes entries that have been idle for the number of minutes defined by the TCP timeout... option.

Sorting TCP Entries

The TCP connection entries can be sorted by pressing the S key, then by selecting a sort criterion. Pressing S will display a box showing the available sort criteria. Press P to sort by packet count, B to sort by byte count. Pressing any other key cancels the sort.

The sort operation compares the larger values in each connection entry pair and sorts the counts in descending order.

Over time, the entries will go out of order as counts proceed at varying rates. Sorting is not done automatically so as not to degrade performance and accuracy.

Figure 2. The IP traffic monitor sort criteria

<<< PreviousHomeNext >>>
Supported Network Interfaces Lower Window
iptraf-ng-1.1.4/Documentation/ln9.html0000664000076400007640000000445712173477702020113 0ustar npajkovsnpajkovs
IPTraf User's Manual

This manual is released under the terms of the GNU Free Documentation License of March, 2000 as published by the Free Software Foundation, reproduced in this manual as Appendix B.

IPTraf is open-source software released under the terms of the GNU General Public License version 2 or any later version as published by the Free Software Foundation, reproduced in the LICENSE file in the distribution's top-level directory.

The accomanying software and the information contained in this document are provided "AS IS" without warranty of any kind, express or implied, including, without limitation, the implied warranties of mercantability or fitness for any particular purpose.

In no event shall the author be liable for any indirect, special, consequential, or incidental damages arising from the use of this manual or the accompanying software even if the author has been advised of the possibility of such damages.

Linux is a registered trademark of Linus Torvalds. Pentium is a registered trademark of Intel Corporation. All other trademarks are property of their respective owners.

Some structure declarations were based on code copyrighted by the Regents of the University of California.

Token Ring parsing code based on the Token Ring packet construction code in the Linux 2.2 kernel.

 Home 
iptraf-ng-1.1.4/Documentation/lowerwin.html0000664000076400007640000003306712173477702021256 0ustar npajkovsnpajkovs Lower Window
IPTraf User's Manual
<<< PreviousThe IP Traffic MonitorNext >>>

Lower Window

The lower window displays information about the other types of traffic on your network. The following protocols are detected internally:

  • User Datagram Protocol (UDP)

  • Internet Control Message Protocol (ICMP)

  • Open Shortest-Path First (OSPF)

  • Interior Gateway Routing Protocol (IGRP)

  • Interior Gateway Protocol (IGP)

  • Internet Group Management Protocol (IGMP)

  • General Routing Encapsulation (GRE)

  • Layer 2 Tunneling Protocol (L2TP)

  • IPSec AH and ESP protocols (IPSec AH and IPSec ESP)

  • Address Resolution Protocol (ARP)

  • Reverse Address Resolution Protocol (RARP)

Other IP protocols are looked up from the /etc/services file. If /etc/services doesn't contain information about that protocol, the protocol number is indicated.

Non-IP packets are indicated as Non-IP in the lower window.

NoteNote
 

The source and destination addresses for ARP and RARP entries are MAC addresses.

Strictly speaking, ARP and RARP packets aren't IP packets, since they are not encapsulated in an IP datagram. They're just indicated because they are integral to proper IP operation on LANs.

For all packets in the lower window, only the first IP fragment is indicated (since that contains the header of the IP-encapsulated protocol) but with no further information from the encapsulated protocol.

UDP packets are also displayed in address:port format while ICMP entries also contain the ICMP message type. For easier location, each type of protocol is color-coded (only on color terminals such as the Linux console).

UDP

Red on White

ICMP

Yellow on Blue

OSPF

Black on Cyan

IGRP

Bright white on Cyan

IGP

Red on Cyan

IGMP

Bright green on Blue

GRE

Blue on white

ARP

Bright white on Red

RARP

Bright white on Red

Other IP

Yellow on red

Non-IP

Yellow on Red

The lower window can hold up to 512 entries. You can scroll the lower window by using the W key to move the Active indicator to it, and by using the Up and Down cursor keys. The lower window automatically scrolls every time a new entry is added, and either the first entry or last entry is visible. Upon reaching 512 entries, old entries are thrown out as new entries are added.

Some entries may be too long to completely fit in a screen line. You can use the Left and Right cursor keys to vertically scroll the lower window when it is marked Active. If your terminal can be resized (e.g. xterm), you may do so before starting IPTraf.

Entries for packets received on LAN interfaces also include the source MAC address of the LAN host which delivered it. This behavior is enabled by turning on the Source MAC addrs in traffic monitor toggle in the Configure... menu.

Entry Details

In general, the entries in the lower window indicate the protocol, the IP datagram size (full frame size for non-IP, including ARP and RARP), the source address, the destination address, and the network interface the packet was detected on. However, some protocols have a little more information.

ICMP

ICMP entries are displayed in this format:

ICMP type [(subtype)] (size bytes) from source to destination
[(src HWaddr srcMACaddress)] on interface

where type could be any of the following:

echo req, echo rply

ICMP echo request and reply. Usually used by the ping program and other network monitoring and diagnostic program.

dest unrch

ICMP destination unreachable. Something failed to reach its target. The dest unreach type is supplemented with a further indicator of the problem. Destination unreachable messages for TCP traffic causes the corresponding TCP entry in the upper window to be made available for reuse by new connections.

redirct

ICMP redirect. Usually generated by a router to tell a host that a better gateway is available.

src qnch

The ICMP source quench is used to stop a host from transmitting. It's a flow control mechanism for IP.

time excd

Indicates a packet's time-to-live value expired before it got to its destination. Mostly happens if a destination is too far away. Also used by the traceroute program.

router adv

ICMP router advertisement

router sol

ICMP router solicitation

timestmp req

ICMP timestamp request

timestmp rep

ICMP timestamp reply

info req

ICMP information request

info rep

ICMP information reply

addr mask req

ICMP address mask request

addr mask rep

ICMP address mask reply

param prob

ICMP parameter problem

bad/unknown

An unrecognized ICMP packet was received, or the packet is corrupted.

The destination unreachable message also includes information on the type of error encountered. Here are the destination unreachable codes:

ntwk

network unreachable

host

host unreachable

proto

protocol unreachable

port

port unreachable

pkt fltrd

packet filtered (normally by an access rule on a router or firewall)

DF set

the packet has to be fragmented somewhere, but its don't fragment (DF) bit is set.

src rte fail

source route failed

src isltd

source isolated (obsolete)

net comm denied

network communication denied

host comm denied

host communication denied

net unrch for TOS

network unreachable for specified IP type-of-service

host unrch for TOS

host unreachable for specified IP type-of-service

prec violtn

precedence violation

prec cutoff

precedence cutoff

dest net unkn

destination network unknown

dest host unkn

destination network unknown

For more information on ICMP, see RFC 792.

OSPF

OSPF messages also include a little more information. The format of an OSPF message in the window is:

OSPF type (a=area r=router) (sizebytes) from source to destination
[(src HWaddr srcMACaddress)] on interface

The type can be one of the following:

hlo

OSPF hello. Hello messages establish OSPF communications and keep routers informed of each other's presence.

DB desc

OSPF Database Description

LSR

OSPF Link State Request

LSU

OSPF Link State Update. Messages indicating the states of the OSPF network links

LSA

OSPF Link State Acknowledgment

The entries in parentheses:

a=area

The area number of the OSPF message

r=router

The IP address of the router that generated the message. It is not necessarily the same as the source address of the encapsulating IP packet.

Many times, the destination addresses for OSPF packets are class D multicast addresses in standard dotted decimal notation or (if reverse lookup is enabled), hosts under the MCAST.NET domain. Such multicast addresses are defined as follows:

224.0.0.5 (OSPF-ALL.MCAST.NET)

OSPF all routers

224.0.0.6 (OSPF-DSIG.MCAST.NET)

OSPF all designated routers

See RFC 1247 for details on the OSPF protocol.

<<< PreviousHomeNext >>>
The IP Traffic MonitorUpAdditional Information
iptraf-ng-1.1.4/Documentation/manual.aux0000664000076400007640000000664112173477702020514 0ustar npajkovsnpajkovs\relax \ifx\hyper@anchor\@undefined \global \let \oldcontentsline\contentsline \gdef \contentsline#1#2#3#4{\oldcontentsline{#1}{#2}{#3}} \global \let \oldnewlabel\newlabel \gdef \newlabel#1#2{\newlabelxx{#1}#2} \gdef \newlabelxx#1#2#3#4#5#6{\oldnewlabel{#1}{{#2}{#3}}} \AtEndDocument{\let \contentsline\oldcontentsline \let \newlabel\oldnewlabel} \else \global \let \hyper@last\relax \fi \pagelabel{PREFACE}{7} \pagelabel{ADDINFO}{7} \pagelabel{CONVENTIONS}{7} \pagelabel{GETTINGSTARTED}{9} \pagelabel{65}{9} \pagelabel{INSTALLATION}{9} \pagelabel{96}{9} \pagelabel{134}{10} \pagelabel{149}{10} \pagelabel{186}{11} \pagelabel{UPGRADING}{11} \pagelabel{STARTSTOP}{12} \pagelabel{CMDLINE}{12} \pagelabel{MENUS}{14} \pagelabel{EXITING}{14} \gdef \LT@i {\LT@entry {2}{186.4pt}\LT@entry {2}{186.4pt}} \pagelabel{PREPARINGTOUSE}{17} \pagelabel{NUMBERS}{17} \pagelabel{INSTANCES}{17} \pagelabel{UPDATES}{18} \pagelabel{IFACES}{18} \pagelabel{ITRAFMON}{21} \pagelabel{UPPERWIN}{21} \pagelabel{725}{25} \pagelabel{736}{25} \pagelabel{LOWERWIN}{26} \pagelabel{835}{27} \pagelabel{1076}{30} \pagelabel{NETSTATS}{33} \pagelabel{GENSTATS}{33} \pagelabel{DETSTATS}{33} \pagelabel{STATBREAKDOWNS}{37} \pagelabel{PKTSIZE}{37} \pagelabel{SERVMON}{37} \pagelabel{1230}{38} \pagelabel{1222}{38} \pagelabel{1230}{39} \pagelabel{HOSTMON}{41} \pagelabel{SORTINGLAN}{41} \pagelabel{MORELANMONINFO}{42} \pagelabel{FILTERS}{43} \pagelabel{IPFILTERS}{43} \pagelabel{1304}{43} \gdef \LT@ii {\LT@entry {2}{186.0pt}\LT@entry {2}{186.0pt}} \gdef \LT@iii {\LT@entry {2}{186.0pt}\LT@entry {2}{186.0pt}} \gdef \LT@iv {\LT@entry {2}{186.0pt}\LT@entry {2}{186.0pt}} \gdef \LT@v {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@vi {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@vii {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@viii {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@ix {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@x {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@xi {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@xii {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \gdef \LT@xiii {\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}\LT@entry {2}{124.0pt}} \pagelabel{1902}{50} \pagelabel{1907}{50} \pagelabel{1922}{51} \pagelabel{1926}{51} \pagelabel{NONIPFILTERS}{51} \pagelabel{CONFIG}{53} \pagelabel{TOGGLES}{53} \pagelabel{1946}{53} \pagelabel{1950}{53} \pagelabel{1961}{53} \pagelabel{1971}{54} \pagelabel{1975}{54} \pagelabel{2012}{55} \pagelabel{2016}{55} \pagelabel{TIMERS}{55} \pagelabel{2029}{56} \pagelabel{2032}{56} \pagelabel{2037}{56} \pagelabel{2047}{57} \pagelabel{CUSTOMPORTS}{57} \pagelabel{2060}{57} \pagelabel{2065}{57} \pagelabel{2069}{57} \pagelabel{BACKOP}{59} \pagelabel{MESSAGES}{61} \pagelabel{IPTRAFMESSAGES}{61} \pagelabel{RVNAMEDMESSAGES}{67} \pagelabel{GFDL}{69} \pagelabel{GFDL-0}{69} \pagelabel{GFDL-1}{69} \pagelabel{GFDL-2}{70} \pagelabel{GFDL-3}{70} \pagelabel{GFDL-4}{71} \pagelabel{GFDL-6}{72} \pagelabel{GFDL-5}{72} \pagelabel{GFDL-6}{73} \pagelabel{GFDL-7}{73} \pagelabel{GFDL-8}{73} \pagelabel{GFDL-9}{73} \pagelabel{GFDL-10}{73} \pagelabel{GFDL-11}{74} iptraf-ng-1.1.4/Documentation/manual.dvi0000664000076400007640000263621412173477702020510 0ustar npajkovsnpajkovs÷ƒ’À;è TeX output 2005.08.04:1500‹;ÿÿÿÿ‘·ºâŸ·ºâòO! /DvipsToPDF { 72.27 mul Resolution div } def /PDFToDvips { 72.27 div Resolution mul } def /HyperBorder { 1 PDFToDvips } def /H.V {pdf@hoff pdf@voff null} def /H.B {/Rect[pdf@llx pdf@lly pdf@urx pdf@ury]} def /H.S { currentpoint HyperBorder add /pdf@lly exch def dup DvipsToPDF /pdf@hoff exch def HyperBorder sub /pdf@llx exch def } def /H.L { 2 sub dup /HyperBasePt exch def PDFToDvips /HyperBaseDvips exch def currentpoint HyperBaseDvips sub /pdf@ury exch def /pdf@urx exch def } def /H.A { H.L currentpoint exch pop vsize 72 sub exch DvipsToPDF HyperBasePt sub sub /pdf@voff exch def } def /H.R { currentpoint HyperBorder sub /pdf@ury exch def HyperBorder add /pdf@urx exch def currentpoint exch pop vsize 72 sub exch DvipsToPDF sub /pdf@voff exch def } def systemdict /pdfmark known not {userdict /pdfmark systemdict /cleartomark get put} if ïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if endï˜ps:SDict begin [ /Title () /Subject () /Creator (LaTeX with hyperref package) /Author () /Producer (dvips + Distiller) /Keywords () /DOCINFO pdfmark end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.1) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ   ýš‘tó?Á|‰ ptmr8t½This–æhis“T›ÿLÐeX,“V‘þã×ersion“3.14159“(W‘ÿ37eb2C‘æA7.4.5)“(./manual.teÙ x“JadeT˜eX‘æA2001/01/18:“3.2“(/usr/share/te•Ù xmf/te“x/late“x/psnfss/t1ptm.fd)Ž¤ ‘`Elements–æhwill“be“labelled“Jade“bešÙ gin“document“sequence“at“19“(./manual.aux)“(/usr/share/te˜xmf/te˜x/late˜x/c˜yrillic/t2acmr‘ÿs8.fd)Ž¡‘`(/usr/share/te•Ù xmf/te“x/late“x/base/ts1cmr‘ÿs8.fd)›æh(/usr/share/te“xmf/te“x/late“x/hó7yperref/nameref.sty)˜(./manual.outŽ¡‘`This–æhis“T›ÿLÐeX,“V‘þã×ersion“3.14159“(W‘ÿ37eb2C‘æA7.4.5)“(./manual.teÙ x“JadeT˜eX‘æA2001/01/18:“3.2“(/usr/share/te•Ù xmf/te“x/late“x/psnfss/t1ptm.fd)Ž¡‘`Elements–æhwill“be“labelled“Jade“bešÙ gin“document“sequence“at“19“(./manual.aux)“(/usr/share/te˜xmf/te˜x/late˜x/c˜yrillic/t2acmr‘ÿs8.fd)Ž¡‘`(/usr/share/te•Ù xmf/te“x/late“x/base/ts1cmr‘ÿs8.fd)›æh(/usr/share/te“xmf/te“x/late“x/hó7yperref/nameref.sty)˜(./manual.out)Ž¡‘`(./manual.out‘€ïTps:SDict begin [ /Page 1 /View [ /Fit ] /PageMode /UseOutlines /DOCVIEW pdfmark endïJps:SDict begin [ {Catalog} << /ViewerPreferences << >> >> /PUT pdfmark endïps:SDict begin H.S endïps:SDict begin 12 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (Doc-Start) cvn H.B /DEST pdfmark endïpapersize=0.0pt,0.0ptïps:SDict begin H.S endïps:SDict begin 12 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (MANUAL) cvn H.B /DEST pdfmark endŽŸË…’ã¸óúá phvb8t¿IPT‘þ¶2raf–zUser'‘ÿ¢s“ManÖÇualŽŽŸ0‘`ïcolor push Black’¤ï color popŽŽŒ‹;*‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.2) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black’¤ï color popŽŽŒ‹; ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.3) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ   ýš‘`óú phvb8tÀIPT‘ÿ37raf–ǧUser'‘ÿfgs“ManægualŽ¤ ‘`óŒEÕ( pplr8t¾Copyright–€óÝ#òZ pplr8cÁ€©“¾1997,“2003“by“GerarÑðd“Paul“JavaŽ©‘`óŒEÕ( pplr8tÂThis–manual“is“ršÛ&eleased“under“the“terms“of“the“GNU“Fr˜ee“Documentation“License“of“Mar˜ch,“2000“as“published“by“theŽ¡‘`Fr•Û&ee›Softwar“e˜Foundation,˜r“epr“oduced˜in˜this˜manual˜as˜Appendix˜B.Ž¡‘`IPT‘ÿG³raf–is“open-souršÛ&ce“softwar˜e“r˜eleased“under“the“terms“of“the“GNU“General“Public“License“version“2“or“any“laterŽ¡‘`version–as“published“by“the“FršÛ&ee“Softwar˜e“Foundation,“r˜epr˜oduced“in“the“LICENSE“le“in“the“distribution's“top-levelŽ¡‘`dirÛ&ectory‘ÿ¬.Ž¡‘`The–accomanying“softwaršÛ&e“and“the“information“contained“in“this“document“ar˜e“pr˜ovided“"AS“IS"“without“warranty“ofŽ¡‘`any–kind,“expršÛ&ess“or“implied,“including,“without“limitation,“the“implied“warranties“of“mer˜cantability“or“tness“for“anyŽ¡‘`particular‘purpose.Ž¡‘`In–ïwno“event“shall“the“author“be“liable“for“any“indiršÛ&ect,“special,“consequential,“or“incidental“damages“arising“fr˜om“the“useŽ¡‘`of–this“manual“or“the“accompanying“softwarÛ&e“even“if“the“author“has“been“advised“of“the“possibility“of“such“damages.Ž¡‘`Linux–is“a“r•Û&egister“ed–trademark“of“Linus“T‘ÿC™orvalds.“Pentium“is“a“r•Û&egister“ed–trademark“of“Intel“Corporation.“All“otherŽ¡‘`trademarks–aršÛ&e“pr˜operty“of“their“r˜espective“owners.Ž¡‘`Some–strï ucturšÛ&e“declarations“wer˜e“based“on“code“copyrighted“by“the“Regents“of“the“University“of“California.Ž¡‘`T›ÿC™oken–Ring“parsing“code“based“on“the“T˜oken“Ring“packet“constrï uction“code“in“the“Linux“2.2“kernel.Ž¦ŽŸ0‘`ïcolor push Black’¤ï color popŽŽŒ‹;q‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.4) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black’¤ï color popŽŽŒ‹;p‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.5) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ   ýš®;‘`óú¤ phvb8tÃT‘þÔ-abÚ†le–ïof“Contentsïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (1.0) cvn H.B /DEST pdfmark endŽŸR-’ïcolor push gray 0ïps:SDict begin H.S endó,  pplb8tÄAbout–€This“Documentïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (PREFACE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ø€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (PREFACE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ff’¨ïcolor push gray 0ïps:SDict begin H.S end¾For–€Additional“Informationïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (ADDINFO) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’#ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (ADDINFO) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽŸ ’¨ïcolor push gray 0ïps:SDict begin H.S endDocument‘€Conventionsïps:SDict begin 11 H.L endïqps:SDict begin [ /Subtype /Link /Dest (CONVENTIONS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïqps:SDict begin [ /Subtype /Link /Dest (CONVENTIONS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄ1.–€Getting“Startedïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (GETTINGSTARTED) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’âïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (GETTINGSTARTED) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾About‘€IPT‘ÿ rafïps:SDict begin 11 H.L endïhps:SDict begin [ /Subtype /Link /Dest (65) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’âïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïhps:SDict begin [ /Subtype /Link /Dest (65) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ’¨ïcolor push gray 0ïps:SDict begin H.S endInstallationïps:SDict begin 11 H.L endïrps:SDict begin [ /Subtype /Link /Dest (INSTALLATION) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Ú€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïrps:SDict begin [ /Subtype /Link /Dest (INSTALLATION) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endSystem‘€RequirÑðementsïps:SDict begin 11 H.L endïhps:SDict begin [ /Subtype /Link /Dest (96) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ €ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïhps:SDict begin [ /Subtype /Link /Dest (96) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endA‘ÿvailabilityïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (134) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ó€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (134) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endInstalling–€Downloaded“Packagesïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (149) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’R€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (149) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endInstalling–€a“Floppy“Distributionïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (186) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’M€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (186) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endUpgrading–€frÑðom“Earlier“V‘þã×ersionsïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (UPGRADING) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’9€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (UPGRADING) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endStarting–€and“Stopping“IPT‘ÿ rafïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (STARTSTOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’(ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (STARTSTOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endCommand-line‘€Optionsïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endUsing–€the“Menusïps:SDict begin 11 H.L endïkps:SDict begin [ /Subtype /Link /Dest (MENUS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’öïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïkps:SDict begin [ /Subtype /Link /Dest (MENUS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endExiting‘€IPT‘ÿ rafïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (EXITING) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’çïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (EXITING) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ff’ïcolor push gray 0ïps:SDict begin H.S endÄ2.–€Preparing“to“Use“IPT‘þã×rafïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (PREPARINGTOUSE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (PREPARINGTOUSE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾Number–€Display“Notationsïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (NUMBERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’#ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (NUMBERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ’¨ïcolor push gray 0ïps:SDict begin H.S endInstances–€and“Loggingïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (INSTANCES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ €ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (INSTANCES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endScrÑðeen–€Update“Delaysïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (UPDATES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (UPDATES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endSupported–€Network“Interfacesïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (IFACES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’/€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (IFACES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ff’ïcolor push gray 0ïps:SDict begin H.S endÄ3.–€The“IP“T‘þã×rac“Monitorïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (ITRAFMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (ITRAFMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾The–€Upper“W‘ÿs8indowïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (UPPERWIN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (UPPERWIN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ’Àïcolor push gray 0ïps:SDict begin H.S endClosed/Idle/T‘ÿs8imed–€Out“Connectionsïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (725) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’f€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (725) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endSorting–€TCP“Entriesïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (736) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (736) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endLower‘€W‘ÿs8indowïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (LOWERWIN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’î€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (LOWERWIN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endEntry‘€Detailsïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (835) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ûïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïips:SDict begin [ /Subtype /Link /Dest (835) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endAdditional‘€Informationïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1076) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1076) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ff’ïcolor push gray 0ïps:SDict begin H.S endÄ4.–€Network“Interface“Statisticsïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (NETSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (NETSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾General–€Interface“Statisticsïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (GENSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (GENSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ© ’¨ïcolor push gray 0ïps:SDict begin H.S endDetailed–€Interface“Statisticsïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (DETSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ €ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (DETSTATS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄ5.–€Statistical“Breakdownsïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (STATBREAKDOWNS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (STATBREAKDOWNS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾Packet‘€Sizesïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (PKTSIZE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’߀ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (PKTSIZE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endTCP–€and“UDP“T‘ÿ rac“Statisticsïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (SERVMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’/€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (SERVMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endSorting–€TCP/UDP“Entriesïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1222) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’4€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1222) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endAdditional‘€Informationïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1230) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’(ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1230) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄ6.–€LAN“Station“Statisticsïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (HOSTMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (HOSTMON) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾Sorting–€the“LAN“Station“Monitor“Entriesïps:SDict begin 11 H.L endïpps:SDict begin [ /Subtype /Link /Dest (SORTINGLAN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’\€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïpps:SDict begin [ /Subtype /Link /Dest (SORTINGLAN) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endAdditional‘€Informationïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (MORELANMONINFO) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (MORELANMONINFO) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄ7.‘€Filtersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (FILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’·€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (FILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾IP‘€Filtersïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (IPFILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Ѐïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïops:SDict begin [ /Subtype /Link /Dest (IPFILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endDening–€a“New“Filterïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1304) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ €ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1304) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endApplying–€a“Filterïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1902) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ €ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1902) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endEditing–€a“Dened“Filterïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1907) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’(ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1907) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endDeleting–€a“Dened“Filterïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1922) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’-ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1922) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endDetaching–€a“Filterïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1926) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1926) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endARP–þµÇ,›€RARP“,˜and˜other˜Non-IP˜Packet˜Filtersïps:SDict begin 11 H.L endïrps:SDict begin [ /Subtype /Link /Dest (NONIPFILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’k€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïrps:SDict begin [ /Subtype /Link /Dest (NONIPFILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄ8.–€Conguring“IPT‘þã×rafïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ñïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾T‘ÿogglesïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (TOGGLES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Ë€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (TOGGLES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endReverse–€DNS“Lookupsïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1946) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’%€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1946) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endTCP/UDP–€Service“Namesïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1950) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’4€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1950) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’Àïcolor push gray 0ïps:SDict begin H.S endFor•Ñðce‘€pr“omiscuousïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1961) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1961) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽŽŸ0‘`ïcolor push Black’ŸóŽY‡× pplri8tÅ5ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Ë‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.6) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ   ýš’Àïcolor push gray 0ïps:SDict begin H.S end¾Colorïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1971) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Ú€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1971) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ’Àïcolor push gray 0ïps:SDict begin H.S endLoggingïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1975) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’çïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (1975) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endActivity‘€modeïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2012) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2012) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endSourÑðce–€MAC“addrs“in“trac“monitorïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2016) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’dïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2016) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endT‘ÿs8imersïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (TIMERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Æ€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (TIMERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endTCP‘€T‘ÿs8imeoutïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2029) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ûïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2029) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endLog‘€Intervalïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2032) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ø€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2032) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endScrÑðeen–€Update“Intervalïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2037) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’(ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2037) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endTCP–€closed/idle“persistenceïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2047) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’>€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2047) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S endCustom‘€Informationïps:SDict begin 11 H.L endïqps:SDict begin [ /Subtype /Link /Dest (CUSTOMPORTS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïqps:SDict begin [ /Subtype /Link /Dest (CUSTOMPORTS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endAdditional‘€portsïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2060) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2060) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endDelete‘€port/rangeïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2065) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2065) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’Àïcolor push gray 0ïps:SDict begin H.S endLAN–€Station“Identiersïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2069) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’(ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (2069) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¤ ff’ïcolor push gray 0ïps:SDict begin H.S endÄ9.–€Background“Operationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (BACKOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (BACKOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endA.‘€Messagesïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (MESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’Éïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïnps:SDict begin [ /Subtype /Link /Dest (MESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾IPT‘ÿ raf‘€Messagesïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (IPTRAFMESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ñïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïtps:SDict begin [ /Subtype /Link /Dest (IPTRAFMESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ© ’¨ïcolor push gray 0ïps:SDict begin H.S endrvnamed‘€Messagesïps:SDict begin 11 H.L endïups:SDict begin [ /Subtype /Link /Dest (RVNAMEDMESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ý€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïups:SDict begin [ /Subtype /Link /Dest (RVNAMEDMESSAGES) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’ïcolor push gray 0ïps:SDict begin H.S endÄB.–€GNU“Free“Documentation“Licenseïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (GFDL) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’9€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïjps:SDict begin [ /Subtype /Link /Dest (GFDL) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’¨ïcolor push gray 0ïps:SDict begin H.S end¾PREAMBLEïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-0) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’߀ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-0) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endAPPLICABILITY–€AND“DEFINITIONSïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-1) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’R€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-1) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endVERBA‘ÿBTIM‘€COPYINGïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-2) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-2) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endCOPYING–€IN“QUANTITYïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-3) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-3) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endMODIFICA‘ÿBTIONSïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-4) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ûïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-4) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endCOMBINING‘€DOCUMENTSïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-5) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’*€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-5) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endCOLLECTIONS–€OF“DOCUMENTSïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-6) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’C€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-6) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endAGGREGA‘ÿBTION–€WITH“INDEPENDENT“WORKSïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-7) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’‡ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-7) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endTRANSLA‘ÿBTIONïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-8) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ñïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-8) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endTERMINA‘ÿBTIONïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-9) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’ñïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (GFDL-9) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endFUTURE–€REVISIONS“OF“THIS“LICENSEïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (GFDL-10) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’_ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (GFDL-10) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¦’¨ïcolor push gray 0ïps:SDict begin H.S endHow–€to“use“this“License“for“your“documentsïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (GFDL-11) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’k€ïcolor push Black.ï color popŽ–€ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ“ïcolor push Black.ï color popŽ‘+ˆïcolor push gray 0ïps:SDict begin H.S end-999ïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (GFDL-11) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽŽŸ0‘`ïcolor push BlackÅ6ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Í‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.7) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (PREFACE) cvn H.B /DEST pdfmark endŸ ®;ÃAbout–ïThis“Documentïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (2.0) cvn H.B /DEST pdfmark endŽŸ ~³ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (20) cvn H.B /DEST pdfmark endŸ Ñ,‘0¾This–Ì®document“contains“the“instrëˆuctions“on“how“to“use“the“IPT‘ÿ raf“network“monitorÑð-Ž¤ ‘0ing– XsoftwaršÑðe“version“3.0.“This“manual“details“the“dier˜ent“statistical“facilities,“the“userŽ¡‘0interface,–€and“the“important“featuršÑðes“of“the“softwar˜e.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (ADDINFO) cvn H.B /DEST pdfmark endŸÍ×óú O\ phvb8tÇFor–³6AdÝîditional“Inf»Þormationïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (2.1.1) cvn H.B /DEST pdfmark endŽ©Ò@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (23) cvn H.B /DEST pdfmark endŸ Õn‘0¾See–»€the“included“README‘»qle“for“summarized“and“late-brÑðeaking“information.“AlsoŽ¡‘0ršÑðead–T—the“RELEASE-NOTES‘T`le“for“important“new“information“about“this“new“ver˜-Ž¡‘0sion.–ieThe“CHANGES‘i`le“contains“a“r•Ñðecor“d–ieof“the“changes“made“to“the“softwarÑðe“sinceŽ¡‘01.0.0.–êÿREADME.rvnamed“contains“information“on“the“rvnamed“ršÑðeverse“r˜esolutionŽ¡‘0prÑðogram.–€See“the“other“README“les“for“support“and“development“information.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (CONVENTIONS) cvn H.B /DEST pdfmark endŸÒ1ÇDocument‘³6Con‘ÿw¼ventionsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (2.2.1) cvn H.B /DEST pdfmark endŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (26) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–€following“symbols“and“typefaces“aršÑðe“used“thr˜oughout“this“manual:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (27) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (29) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (30) cvn H.B /DEST pdfmark end©.‘0ó‰š pcrr8tÈ[‘ff]ŽŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (31) cvn H.B /DEST pdfmark endŸòs‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (32) cvn H.B /DEST pdfmark end¾items–{in“brackets“arÑðe“optional.“Brackets“also“denote“items“that“may“or“may“notŽ¡‘Dbe–€displayed“onscrÑðeen“depending“on“settings“or“conditions.Ž¤ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (34) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (35) cvn H.B /DEST pdfmark end¦‘0È{‘ff}ŽŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (36) cvn H.B /DEST pdfmark endŸòs‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (37) cvn H.B /DEST pdfmark end–€¾curly“braces“enclose“items“you“choose“frÑðomŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (39) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (40) cvn H.B /DEST pdfmark end¦‘0È|ŽŸ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (41) cvn H.B /DEST pdfmark endŸ À‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (42) cvn H.B /DEST pdfmark end–€¾the“vertical“bar“separates“choices“in“curly“bracesŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (44) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (45) cvn H.B /DEST pdfmark end¦‘0Ènormal‘ffmonospaceŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (46) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (47) cvn H.B /DEST pdfmark end–_<¾normal“monospace“text“in“syntax“specications“should“be“typed“in“exactly“asŽ¤ ‘DpršÑðesented.–æhBecause“UNIX‘æAand“variants“ar˜e“case-sensitive,“case“must“be“pr˜eserved.Ž¡‘DMonospace–€is“also“used“in“pršÑðesenting“items“that“appear“on“the“scr˜een.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (49) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (50) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (51) cvn H.B /DEST pdfmark end¦‘0ó‰š pcrro8tÉmonospace‘ffitalicsŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (52) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (53) cvn H.B /DEST pdfmark end–觾italics“in“syntax“specications“indicate“items“that“aršÑðe“to“be“r˜eplaced“with“anŽ¡‘Dactual–ÕBitem“(e.g.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (54) cvn H.B /DEST pdfmark endó‰š pcrro8tÊinterface“¾should“be“rÑðeplaced“with“an“actual“interface“name,Ž¡‘Dlike‘€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (55) cvn H.B /DEST pdfmark endÈeth0¾).ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (56) cvn H.B /DEST pdfmark endŸç°‘0Additional–J[information“appears“distinctively“set“apart“fršÑðom“the“main“text.“This“infor˜-Ž¡‘0mation–€includes“Notes,“T‘ÿs8ips,“or“T‘ÿechnical“Notes.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (57) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (58) cvn H.B /DEST pdfmark end¦‘0ÅNotes–´2¾aršÑðe“additional“pieces“of“information“that“may“be“useful“or“may“clarify“the“pr˜e-Ž¡‘0ceeding–€paragraphs“of“the“manual.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (59) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (60) cvn H.B /DEST pdfmark end¦‘0ÅT‘ÿs8ips–B¾pršÑðovide“shortcuts,“clarify“tasks“that“may“not“be“immediately“obvious,“or“pr˜ovideŽ¡‘0r•Ñðefer“ences–€to“additional“sourÑðces“of“information.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (61) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (62) cvn H.B /DEST pdfmark endŸ Èø‘0ÅT‘þã×echnical–p¶notes“¾aršÑðe“explanations“of“a“mor˜e“technical“natur˜e“and“may“be“of“mor˜e“use“toŽ¡‘0prÑðogrammers–€and“advanced“users.ŽŽŸ0‘`ïcolor push Black’žúèÅ7ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;^¨‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.8) cvn H.B /DEST pdfmark endï color popŸüfdÅAbout–€This“DocumentŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black8ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;Š‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïJps:SDict begin [ /View [/XYZ H.V] /Dest (page.9) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïRps:SDict begin [ /View [/XYZ H.V] /Dest (GETTINGSTARTED) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï1.“Getting“StarJñtedïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (3.0) cvn H.B /DEST pdfmark endŽŸ?ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (65) cvn H.B /DEST pdfmark endŸ]ÔÇAbout‘³6IPT‘þïorafïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (3.3.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (67) cvn H.B /DEST pdfmark endŸ Õn‘0¾IPT‘ÿ raf–2is“a“network“monitoring“utility“and“trac“analyzer“for“IP‘1ïnetworks.“It“interÑð-Ž¤ ‘0cepts–æ·packets“and“ršÑðeturns“data“about“captur˜ed“the“network“trac“in“various“statisticalŽ¡‘0facilities.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (68) cvn H.B /DEST pdfmark endŸ Èø‘0IPT‘ÿ raf–€comes“with“these“major“featurÑðes:Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (69) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (70) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push Blackó Ý#òZ pplr8cË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (71) cvn H.B /DEST pdfmark end¾An–ÞIP›Ýütrac“monitor“that“shows“TCP˜connection“information“(hosts,“packet/byteŽ¡‘:counts,–€ags,“window“sizes),“and“colorÑð-coded“information“about“other“IP“packetsŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (72) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (73) cvn H.B /DEST pdfmark end¾Statistics–å‘(counts“and“load“rates)“for“network“interfaces“in“general“and“detailedŽ¡‘:viewsŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (74) cvn H.B /DEST pdfmark endŸ Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (75) cvn H.B /DEST pdfmark end¾Statistics–€per“TCP/UDP“portŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (76) cvn H.B /DEST pdfmark end¤.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (77) cvn H.B /DEST pdfmark end¾Statistical–€bršÑðeakdown“accor˜ding“to“packet“sizesŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (78) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (79) cvn H.B /DEST pdfmark end¾A–€LAN“host“monitor“that“ršÑðeturns“counts“and“loads“per“detected“MAC“addr˜essŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (80) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (81) cvn H.B /DEST pdfmark end¾A–€powerful“ltering“system“for“users“to“view“only“interÑðesting“tracŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (82) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (83) cvn H.B /DEST pdfmark end¾LoggingŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (84) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (85) cvn H.B /DEST pdfmark end¾An–€asynchršÑðonous“DNS“r˜esolver“for“the“IP“trac“monitorŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (86) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (87) cvn H.B /DEST pdfmark end¾A‘pMtext-based,–p‹full-color‘ÿB,“menu-driven“user“interface“suitable“for“use“on“all“LinuxŽŸ ‘:systems–€with“terminals,“especially“Linux“consoles“and“color“xtermsŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (88) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (89) cvn H.B /DEST pdfmark end¾Easy‘€congurationŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (90) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (91) cvn H.B /DEST pdfmark end¾Fully–€softwaršÑðe-based.“No“additional“har˜dwar˜e“r˜equir˜edŽ©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (92) cvn H.B /DEST pdfmark end¡‘0Basic–ï®knowledge“of“the“important“TCP/IP‘ïPprÑðotocols“(IP›þµÇ,“TCP˜,“UDP˜,“ICMP˜,“etc.)“isŽ¤ ‘0necessary–€for“you“to“best“understand“the“information“generated“by“the“prÑðogram.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïPps:SDict begin [ /View [/XYZ H.V] /Dest (INSTALLATION) cvn H.B /DEST pdfmark endŸÒ1ÇInstallationïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (95) cvn H.B /DEST pdfmark endŸ Õn‘0¾IPT‘ÿ raf–F¼is“most“ršÑðeadily“available“on“the“Internet,“but“some“may“r˜eceive“it“on“a“diskette.Ž¡‘0Her•Ñðe›€ar“e˜the˜instrëˆuctions˜for˜both˜types˜of˜distributions.Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (96) cvn H.B /DEST pdfmark endŸ§ó!ú š phvb8tÌSystem‘]Requirementsïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.1.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (98) cvn H.B /DEST pdfmark endŸ~Б0¾IPT‘ÿ raf‘€r•Ñðequir“es:Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïFps:SDict begin [ /View [/XYZ H.V] /Dest (99) cvn H.B /DEST pdfmark endŸ‡²‘0ó"ú phvb8tÍHarDZdÕÉware‘ÒRequirementsïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.1.1.3) cvn H.B /DEST pdfmark endŽŸFåïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (101) cvn H.B /DEST pdfmark endŸ€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (102) cvn H.B /DEST pdfmark endŸ¹‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (103) cvn H.B /DEST pdfmark end–sÿ¾16“megabytes“of“physical“RAM‘sü(moršÑðe“r˜ecommended,“at“least“64“MB‘süfor“very“busyŽ¤ ‘:networks)Ž©Pïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (104) cvn H.B /DEST pdfmark endŸç°‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (105) cvn H.B /DEST pdfmark end–1ý¾2“megabytes“of“fršÑðee“disk“space“for“installation“(mor˜e“will“be“needed“if“you“log“highŽ¡‘:amounts–€of“trac“over“time)Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (106) cvn H.B /DEST pdfmark endŸç°‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (107) cvn H.B /DEST pdfmark end–‰¾Pentium-class“pršÑðocessor“or“higher“(Pentium-II‘‰ 200“MHz“or“higher“r˜ecommended)Ž¡‘:or‘€equivalent.Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (108) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (109) cvn H.B /DEST pdfmark end–€¾One“or“morÑðe“of“the“supported“network“interfaces.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (110) cvn H.B /DEST pdfmark endŸG²‘0ÍOperating–ÒSystem“Requirementsïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.1.2.3) cvn H.B /DEST pdfmark endŽŸr‰ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (112) cvn H.B /DEST pdfmark endŸ€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (113) cvn H.B /DEST pdfmark endŸw‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (114) cvn H.B /DEST pdfmark end–€¾Linux“kernel“2.2.0“or“higherŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (115) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (116) cvn H.B /DEST pdfmark end–€¾GNU“C“Library“2.1“or“laterŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (117) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’ŸÅ9ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;‚‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.10) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€1.“Getting“StartedŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’ïcolor push BlackË€ˆï color popŽŽ’šïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (118) cvn H.B /DEST pdfmark end–æh¾ncurses“4.2“or“later“with“the“complete“terminfo“database“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (119) cvn H.B /DEST pdfmark endÈ/usr/share/terminfo¾.ŽŸ ’šSupport–€for“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (120) cvn H.B /DEST pdfmark endÈlinux¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (121) cvn H.B /DEST pdfmark endÈvt100¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (122) cvn H.B /DEST pdfmark endÈxterm¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (123) cvn H.B /DEST pdfmark endÈxterm-color“¾rÑðecommended.Ž‘`ŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (124) cvn H.B /DEST pdfmark endŸG²‘0ÍCompilation‘ÒRequirementsïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.1.3.3) cvn H.B /DEST pdfmark endŽŸÆåïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (126) cvn H.B /DEST pdfmark endŸ¹‘0¾The–§following“components“aršÑðe“r˜equir˜ed“when“compiling“IPT‘ÿ raf“fr˜om“the“sour˜ce“code.Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (127) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (128) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (129) cvn H.B /DEST pdfmark end–€¾gcc“2.7.2.3“or“laterŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (130) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (131) cvn H.B /DEST pdfmark end–€¾GNU“C“(glibc)“development“library“2.1“or“laterŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (132) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (133) cvn H.B /DEST pdfmark end–€¾ncurses“development“libraries“4.2“or“laterŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (134) cvn H.B /DEST pdfmark endŸ}tÌA„ vÂailabilityïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.2.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (136) cvn H.B /DEST pdfmark endŸ~Б0¾IPT‘ÿ raf–æhcan“be“downloaded“fršÑðom“the“Internet“fr˜om“the“ocial“FTP‘æAsite“at“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (137) cvn H.B /DEST pdfmark endftp://iptraf.seul.or˜g/pub/iptraf/Ÿüó#ŒEÕ( pplr8tÎ1Ž‘¾.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (138) cvn H.B /DEST pdfmark end¦‘0The–æhsoftwaršÑðe“is“available“in“sour˜ce“form“in“compr˜essed“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (139) cvn H.B /DEST pdfmark endÈ.tar.gz“¾les“named“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (140) cvn H.B /DEST pdfmark endÈiptraf-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (141) cvn H.B /DEST pdfmark endÉx.y.zÈ.tar.gzŽ¤ ‘0¾wheršÑðe–óïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (142) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (143) cvn H.B /DEST pdfmark endÉx.y.z“¾is“the“version“number‘ÿB.“Pr˜ecompiled“r˜eady-to-rëˆun“softwar˜e“is“availableŽ¡‘0in–Œthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (144) cvn H.B /DEST pdfmark endÈiptraf-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (145) cvn H.B /DEST pdfmark endÉx.y.z.machinetypeÈ.bin.tar.gz“¾les.“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (146) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (147) cvn H.B /DEST pdfmark endÉmachinetype“¾indicates“whatŽ¡‘0platform–Pˆthe“prÑðecompiled“binaries“rëˆun“on.“The“ocial“distribution“will“only“be“forŽ¡‘0the–€Intel“x86“ar•Ñðchitectur“e–€indicated“as“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (148) cvn H.B /DEST pdfmark endÈi386¾.)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (149) cvn H.B /DEST pdfmark endŸ7 ÌInstalling–]DoÑ‘wnloaded“P£acÂkaágøesïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.3.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (151) cvn H.B /DEST pdfmark endŸNБ0¾Y‘ÿou–ì\will“need“to“have“GNU›ì6tar“and“GNU˜zip“installed.“All“modern“Linux“installationsŽ¡‘0alršÑðeady–€have“these“utilities“r˜eady‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (152) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (153) cvn H.B /DEST pdfmark endŸ.‘>ïcolor push Black1.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (154) cvn H.B /DEST pdfmark end–€DecomprÑðess“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (155) cvn H.B /DEST pdfmark endÈ.tar.gz“¾le“by“enteringŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (156) cvn H.B /DEST pdfmark endŸ~‘HÈtar–ffzxvf“iptraf-ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (157) cvn H.B /DEST pdfmark endÉx.y.zÈ.tar.gzŽ¤i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (158) cvn H.B /DEST pdfmark end© –I‘H¾for–€the“sourÑðce“code“orŽŸ7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (159) cvn H.B /DEST pdfmark endŸ ¯^‘HÈtar–ffzxvf“iptraf-ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (160) cvn H.B /DEST pdfmark endÉx.y.zÈ.i386.bin.tar.gzŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (161) cvn H.B /DEST pdfmark end¦‘H¾for–€the“pršÑðecompiled“x86“pr˜ograms.Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (162) cvn H.B /DEST pdfmark endŸ.‘HIf–Õ¢your“tar“doesn't“support“the“z“option,“you“can“separately“decomprÑðess“theŽŸ ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (163) cvn H.B /DEST pdfmark endÈ.tar.gz–€¾le“then“extract“the“ršÑðesulting“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (164) cvn H.B /DEST pdfmark endÈ.tar“¾ar˜chive.Ž¡ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (165) cvn H.B /DEST pdfmark endŸ~‘HÈgunzip‘ffiptraf-ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (166) cvn H.B /DEST pdfmark endÉx.y.zÈ.tar.gzŽŸ æf‘Htar–ffxvf“iptraf-ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (167) cvn H.B /DEST pdfmark endÉx.y.zÈ.tarŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (168) cvn H.B /DEST pdfmark end¦‘H¾This–¨Ëwill“decompršÑðess“the“sour˜ces“into“a“dir˜ectory“called“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (169) cvn H.B /DEST pdfmark endÈiptraf-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (170) cvn H.B /DEST pdfmark endÉx.y.z“¾(sour˜ceŽ¤ ‘Hcode)–0%or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (171) cvn H.B /DEST pdfmark endÈiptraf-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (172) cvn H.B /DEST pdfmark endÉx.y.zÈ.bin“¾(pršÑðecompiled).“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (173) cvn H.B /DEST pdfmark endÊx.y.z“¾her˜e“should“be“the“IPT‘ÿ rafŽ¡‘Hversion–€number“you'rÑðe“installing,“like“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (174) cvn H.B /DEST pdfmark endÈ3.0.0¾).Ž¤‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (175) cvn H.B /DEST pdfmark endŽ¡‘>ïcolor push Black2.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (176) cvn H.B /DEST pdfmark endChange–€to“the“cršÑðeated“top“level“dir˜ectory‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (177) cvn H.B /DEST pdfmark endŸ .‘>ïcolor push Black3.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (178) cvn H.B /DEST pdfmark endT‘ÿo–€compile“and“install“the“softwaršÑðe,“rëˆun“the“Setup“pr˜ogram“by“enteringŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (179) cvn H.B /DEST pdfmark endŸ~‘HÈ./SetupŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (180) cvn H.B /DEST pdfmark end¦‘H¾while–¹!you“aršÑðe“logged“in“as“r˜oot.“The“Setup“script“will“r˜ecognize“the“sour˜ce“dis-Ž¤ ‘Htribution–£2and“compile“the“softwaršÑðe“befor˜e“installing.“It“will“immediately“installŽ¡‘Ha–€prÑðecompiled“distribution.ŽŸŽŸ0‘`ïcolor push BlackÅ10ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;«Ü‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.11) cvn H.B /DEST pdfmark endï color popŸüfd’8;1ÅChapter–€1.“Getting“StartedŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (181) cvn H.B /DEST pdfmark endŸ ‘0¾The–{èršÑðesulting“binaries“will“be“placed“in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (182) cvn H.B /DEST pdfmark endÈ/usr/local/bin“¾dir˜ectory‘þã×.“All“neededŽ¤ ‘0diršÑðectories–€will“also“be“cr˜eated.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (183) cvn H.B /DEST pdfmark endŸ Èø‘0After–C½installation,“you“will“be“asked“if“you“want“to“rÑðead“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (184) cvn H.B /DEST pdfmark endÈRELEASE-NOTES‘C‹¾le.“ItŽ¡‘0is–×rÑðecommended“that“you“do“so“at“that“point,“since“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (185) cvn H.B /DEST pdfmark endÈRELEASE-NOTES‘×¾le“containsŽ¡‘0important–€information“about“the“new“version.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (186) cvn H.B /DEST pdfmark endŸ}tÌInstalling–]a“FloppÑ‘y“DistribÂutionïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (3.4.4.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (188) cvn H.B /DEST pdfmark endŸNБ0¾If–æhyou“ršÑðeceived“IPT‘ÿ raf“on“a“diskette,“the“sour˜ces“ar˜e“alr˜eady“decompr˜essed.“The“disketteŽ¡‘0is–Unin“Second“Extended“lesystem“format.“Perform“the“following“steps“to“install“theŽ¡‘0softwarÑðe.Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (189) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (190) cvn H.B /DEST pdfmark endŸÈø‘>ïcolor push Black1.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (191) cvn H.B /DEST pdfmark endInsert–€the“oppy“in“the“drive.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (192) cvn H.B /DEST pdfmark endŸ .‘>ïcolor push Black2.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (193) cvn H.B /DEST pdfmark endMount–ì1the“oppy“on“an“empty“dirÑðectory‘þã×.“For“example,“to“mount“the“oppy“inŽ¡‘Hthe–€rst“oppy“drive“under“a“dirÑðectory“called“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (194) cvn H.B /DEST pdfmark endÈ/mnt¾,“enterŽ¦ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (195) cvn H.B /DEST pdfmark endŸ~‘HÈmount–ff-t“ext2“/dev/fd0“/mntŽŸµÿïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (196) cvn H.B /DEST pdfmark endŸ J‘H¾This–õoassumes“your“oppy“is“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (197) cvn H.B /DEST pdfmark endÈ/dev/fd0¾.“Y‘ÿou“can“use“any“empty“dirÑðectory“inŽ¡‘Hplace–€of“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (198) cvn H.B /DEST pdfmark endÈ/mnt¾.“W‘ÿs8ith“most“Linux“installations,“this“will“work“ne.Ž¤‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (199) cvn H.B /DEST pdfmark endŽ¡‘>ïcolor push Black3.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (200) cvn H.B /DEST pdfmark end–€After“mounting,“change“to“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (201) cvn H.B /DEST pdfmark endÈ/mnt“¾(or“whatever)“dirÑðectory‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (202) cvn H.B /DEST pdfmark endŸ .‘>ïcolor push Black4.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (203) cvn H.B /DEST pdfmark endEnterŽŸ7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (204) cvn H.B /DEST pdfmark endŸ ¯^‘HÈ./SetupŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (205) cvn H.B /DEST pdfmark endŸ –I‘H¾while–Emlogged“in“as“rÑðoot.“Setup“will“determine“whether“the“diskette“contains“aŽ¤ ‘HsouršÑðce–ãcode“distribution“or“r˜eady-to-rëˆun“pr˜ecompiled“softwar˜e.“This“will“copyŽ¡‘Hthe–€binaries“to“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (206) cvn H.B /DEST pdfmark endÈ/usr/local/bin¾,“and“cršÑðeate“the“necessary“working“dir˜ectories.Ž¤‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (207) cvn H.B /DEST pdfmark endŽ¡‘>ïcolor push Black5.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (208) cvn H.B /DEST pdfmark endUnmount–€the“diskette“by“typingŽ¦ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (209) cvn H.B /DEST pdfmark endŸ~‘HÈumount‘ff/mntŽŸµÿïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (210) cvn H.B /DEST pdfmark endŸ J‘H¾(That's–€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (211) cvn H.B /DEST pdfmark endÅu¾mount,“not“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (212) cvn H.B /DEST pdfmark endÅun¾mount.)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (213) cvn H.B /DEST pdfmark endŸç°‘HY‘ÿou–€can“then“eject“the“diskette.“StorÑðe“it“in“a“safe“place.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (214) cvn H.B /DEST pdfmark end¤.‘HY‘ÿou–jwill“also“be“asked“if“you“want“to“view“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (215) cvn H.B /DEST pdfmark endÈRELEASE-NOTES‘b¾le.“It“is“rÑðecom-ŽŸ ‘Hmended–€that“you“do“so“at“that“point.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (216) cvn H.B /DEST pdfmark end¡‘HIn–ÁAboth“cases“(downloaded“and“oppy),“the“installation“will“storšÑðe“the“pr˜ogramŽ¤ ‘Hin–]Çïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (217) cvn H.B /DEST pdfmark endÈ/usr/local/bin“¾with“the“binaries“owned“by“user“ršÑðoot,“r˜eadable,“writable,Ž¡‘Hand–šÁexecutable“by“the“owner‘ÿB,“no“permissions“for“the“grÑðoup,“no“permissions“forŽ¡‘Hall–€others.“(700“octal,“or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (218) cvn H.B /DEST pdfmark endÈ-rwx------¾).ŽŸPïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (219) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (221) cvn H.B /DEST pdfmark endŸÎ‘\ó%ú phvb8tÐNote:–èó$áÚŽ phvr8tÏY‘þ½vou“mèöust“be“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (222) cvn H.B /DEST pdfmark endó&‰šš pcrr8tÑroot“Ïto“do“the“installation.“The“old“style“of“installation“(ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (223) cvn H.B /DEST pdfmark endÐcdŽŸ æf‘\srÑîc;make–€}installÏ)“is“still“suppor\#ted.ŽŸŸŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (224) cvn H.B /DEST pdfmark end¡‘0¾Be–«×suršÑðe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (225) cvn H.B /DEST pdfmark endÈ/usr/local/bin“¾is“included“in“your“envir˜onment's“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (226) cvn H.B /DEST pdfmark endP›ÿA‘ÿBTH‘«Ìvariable.“Y˜ou“canŽ¡‘0edit–Ý/the“apprÑðopriate“command“in“your“login“customization“le“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (227) cvn H.B /DEST pdfmark endÈ.profile“¾for“theŽ¡‘0Bourne-type–€shells,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (228) cvn H.B /DEST pdfmark endÈ.cshrc“¾for“the“C“shell“and“its“rÑðelatives).ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (UPGRADING) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’šÅ11ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;Øq‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.12) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€1.“Getting“StartedŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš‘`ÇUpgrading–³6fr»Þom“Earlier“V‘ÿU¡erÌìsionsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (3.5.1) cvn H.B /DEST pdfmark endŽ‘`Ÿ Éïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (231) cvn H.B /DEST pdfmark endŸ å‘0¾IPT‘ÿ raf–æÖ3.0“is“a“major“ršÑðevision“fr˜om“IPT‘ÿ raf“2.7.“The“lter“subsystem“has“been“completelyŽ¤ ‘0ršÑðedesigned–/“and“as“such,“is“incompatible“with“pr˜evious“lter“formats.“Ther˜efor˜e“oldŽ¡‘0IPT›ÿ raf–Ýlters“can“no“longer“be“used.“The“installation“pr•Ñðocedur“e–Ýfor“IPT˜raf“3.0“willŽ¡‘0rÑðename–€the“lter“list“les“but“not“delete“them.Ž©7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (232) cvn H.B /DEST pdfmark endŸ Èø‘0If–߸you“install“a“distribution“package“(e.g.“RPM,“dpkg),“old“lters“may“still“appear“inŽ¡‘0the–€lter“selection“list“but“the“new“IPT‘ÿ raf“version“will“be“unable“to“load“them.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (STARTSTOP) cvn H.B /DEST pdfmark endŸ"mÇStarD!ting–³6and“Stopping“IPT‘þïorafïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (3.6.1) cvn H.B /DEST pdfmark endŽŸ Éïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (235) cvn H.B /DEST pdfmark endŸ å‘0¾After–€installation,“you“can“start“the“prÑðogram“by“simply“enteringŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (236) cvn H.B /DEST pdfmark endŸ~‘0ÈiptrafŽŸ i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (237) cvn H.B /DEST pdfmark endŸ –I‘0¾at–·¸the“shell“pršÑðompt.“Y‘ÿou“will“see“a“copyright“notice,“with“an“instrëˆuction“to“pr˜ess“anyŽ¡‘0key–fNto“get“started.“Just“prÑðess“any“character“key‘þã×,“and“you“will“be“immediately“taken“toŽ¡‘0the–€main“menu.“All“major“functions“of“the“pršÑðogram“ar˜e“found“ther˜e.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (238) cvn H.B /DEST pdfmark endŸ.‘0Entering–çÉthe“IPT‘ÿ raf“command“without“any“command-line“parameters“brings“up“theŽ¡‘0pršÑðogram's–€main“menu.“Fr˜om“ther˜e,“you“can“select“the“facilities“you“want.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (239) cvn H.B /DEST pdfmark endŸ.‘0IPT‘ÿ raf–Ðkdetermines“and“makes“use“of“the“maximum“number“of“lines“and“columns“onŽ¡‘0the‘€terminal.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (240) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (242) cvn H.B /DEST pdfmark endŸ ¯^‘DÐNote:–…ÏIPT‘þëˆrèöaf“does“not“haÑîvÆfe“a“SIGWINCH“handlerE;“it“does“not“adjust“itself“when“an“xter9™mŽ¤ æf‘Dor–€}some“other“X“ter9™minal“is“resizÝved.ŽŸæf‘ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (243) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (245) cvn H.B /DEST pdfmark end¡‘DÐT‘ÿuÃecšèöhnical–2±note:“ÏIPT‘þëˆr˜af“needs“to“refšºåer“to“the“ter9™minf˜o“database“in“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (246) cvn H.B /DEST pdfmark endÑ/usr/share/terminfoÏ.Ž¡‘DIf–Ä2the“supplied“e•ºåx“ecutabÑîle›Ä2prog•èör“am˜fºåails˜with˜ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (247) cvn H.B /DEST pdfmark endÑError–Ü)opening“terminalÏ,˜yÑîour˜ter9™minfºåoŽ¡‘Ddatabase–þœmašºåy“be“located“someÑîwhere“elseÝv.“Y‘þ½vou“can“control“the“ter9™minf˜o“search“path“bÑîyŽ¡‘Dusing–Ôœthe“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (248) cvn H.B /DEST pdfmark endTERMINFO‘Ô‡enšÑîvironment“vÆfar"‰iab˜leÝv.“Fšºåor“e˜xampleÝv,“if“yÑîou'ŒÌre“using“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (249) cvn H.B /DEST pdfmark endÐsh“Ïor“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (250) cvn H.B /DEST pdfmark endÐbashŽ¡‘DÏshell,–Ñ=and“yÑîour“ter9™minfšºåo“database“is“in“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (251) cvn H.B /DEST pdfmark endÑ/usr/lib/terminfo“Ï(typical“f˜or“SlacÑîkwÝvare“distr"‰i-Ž¡‘Db•Ñîutions),›€}y“ou˜can˜use˜the˜commands:ŽŸ äùïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (252) cvn H.B /DEST pdfmark endŸý‘DÑTERMINFO=/usr/lib/terminfoŽŸèö‘Dexport‘Ü)TERMINFOŽŸ E‹ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (253) cvn H.B /DEST pdfmark endŸ Û‘DÏY‘þ½vou–P'can“place“these“commands“in“yÑîour“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (254) cvn H.B /DEST pdfmark endÑ~/.profile“Ïor“the“systemwide“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (255) cvn H.B /DEST pdfmark endÑ/etc/profileŽ¡‘DÏstar\#tup‘€}lesÝv.ŽŸäùïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (256) cvn H.B /DEST pdfmark endŸm‘DY‘þ½vou–Hcan“also“create“a“symbolic“link“named“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (257) cvn H.B /DEST pdfmark endÑ/usr/share/terminfo“Ïto“let“it“point“to“yÑîourŽ¡‘De•ºåxisting›€}ter9™minf“o˜(assuming˜again˜yÑîour˜ter9™minf“o˜is˜in˜ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (258) cvn H.B /DEST pdfmark endÑ/usr/lib/terminfoÏ):ŽŸ ¢ïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (259) cvn H.B /DEST pdfmark endŸèT‘DÑln–Ü)-s“/usr/lib/terminfo“/usr/share/terminfoŽŸ £Ìïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (260) cvn H.B /DEST pdfmark endŸ Bš‘DÏOr–b¤yšÑîou“can“recompile“y˜our“prog•èör“am–b¤to“use“y˜our“eºåxisting“ncurses“librèöarEy“installation.“If“y˜ouŽ¡‘Ddo–€}thisÝv,“makšÑîe“sure“y˜ou“ha˜vÆfe“ncurses“4.2“or“laterŒÌ.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (CMDLINE) cvn H.B /DEST pdfmark endŸ"¤ÇCommand-line‘³6Optionsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïIps:SDict begin [ /View [/XYZ H.V] /Dest (3.7.1) cvn H.B /DEST pdfmark endŽŸ hüïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (263) cvn H.B /DEST pdfmark endŸ>²‘0¾IPT‘ÿ raf–&¹has“a“few“optional“command-line“parameters.“As“with“most“UNIX‘&¢commands,ŽŸ ‘0IPT‘ÿ raf–€command-line“parameters“arÑðe“case-sensitive“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (264) cvn H.B /DEST pdfmark endÈ-l“¾is“NOT“the“same“as“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (265) cvn H.B /DEST pdfmark endÈ-L¾).ŽŽŸ0‘`ïcolor push BlackÅ12ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;þ/‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.13) cvn H.B /DEST pdfmark endï color popŸüfd’8;1ÅChapter–€1.“Getting“StartedŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (266) cvn H.B /DEST pdfmark endŸ ‘0¾The–€following“command-line“parameters“can“be“supplied“to“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (267) cvn H.B /DEST pdfmark endÄiptraf“¾command:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (268) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (270) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (271) cvn H.B /DEST pdfmark end¤.‘0È-i‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (272) cvn H.B /DEST pdfmark endÉifaceŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (273) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (274) cvn H.B /DEST pdfmark end–[¾causes“the“IP‘Wtrac“monitor“to“start“immediately“on“the“specied“interface.“If“-iŽŸ ‘Dall–€is“specied,“all“interfaces“aršÑðe“monitor˜ed.Ž© Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (276) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (277) cvn H.B /DEST pdfmark end¡‘0È-gŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (278) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (279) cvn H.B /DEST pdfmark end–€¾starts“the“general“interface“statisticsŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (281) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (282) cvn H.B /DEST pdfmark end¡‘0È-d‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (283) cvn H.B /DEST pdfmark endÉifaceŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (284) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (285) cvn H.B /DEST pdfmark end–€¾shows“detailed“statistics“for“the“specied“interfaceŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (287) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (288) cvn H.B /DEST pdfmark end¡‘0È-s‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (289) cvn H.B /DEST pdfmark endÉifaceŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (290) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (291) cvn H.B /DEST pdfmark end–€¾starts“the“TCP/UDP“trac“monitor“for“the“specied“interfaceŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (293) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (294) cvn H.B /DEST pdfmark end¡‘0È-z‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (295) cvn H.B /DEST pdfmark endÉifaceŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (296) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (297) cvn H.B /DEST pdfmark end–€¾starts“the“packet“size“brÑðeakdown“for“the“specied“interfaceŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (299) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (300) cvn H.B /DEST pdfmark end¡‘0È-l‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (301) cvn H.B /DEST pdfmark endÉifaceŽ£0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (302) cvn H.B /DEST pdfmark end©Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (303) cvn H.B /DEST pdfmark end–‰V¾starts“the“LAN‘‰Sstation“monitor“on“the“specied“interface.“If“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (304) cvn H.B /DEST pdfmark endÈ-l‘ffall“¾is“specied,ŽŸ ‘Dall–€LAN“interfaces“aršÑðe“monitor˜ed.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (306) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (307) cvn H.B /DEST pdfmark endŸ Èø‘0È-t‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (308) cvn H.B /DEST pdfmark endÉtimeoutŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (309) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (310) cvn H.B /DEST pdfmark end–>>¾The“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (311) cvn H.B /DEST pdfmark endÈ-t“¾parameter‘ÿB,“when“used“with“one“of“the“other“parameters“that“specify“aŽ¤ ‘Dfacility–U^to“start,“tells“IPT‘ÿ raf“to“rëˆun“the“indicated“facility“for“only“timeout“minutes,Ž¡‘Dafter–€which“the“facility“exits.“The“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (312) cvn H.B /DEST pdfmark endÈ-t“¾parameter“is“ignorÑðed“in“menu“mode.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (313) cvn H.B /DEST pdfmark endŸ.‘DIf–6?this“parameter“is“not“specied,“the“facility“rëˆuns“until“the“exit“keystrÑðoke“isŽ¡‘DprÑðessed.Ž©Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (315) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (316) cvn H.B /DEST pdfmark end¡‘0È-BŽïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (317) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (318) cvn H.B /DEST pdfmark end–»Ò¾RediršÑðects“all“terminal“output“to“the“"bit“bucket"“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (319) cvn H.B /DEST pdfmark endÈ/dev/null¾,“closes“standar˜d“in-Ž¡‘Dput,–$çand“places“the“pršÑðogram“in“the“backgr˜ound.“This“parameter“can“be“used“onlyŽ¡‘Dwith–å«one“of“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (320) cvn H.B /DEST pdfmark endÈ-i¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (321) cvn H.B /DEST pdfmark endÈ-g¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (322) cvn H.B /DEST pdfmark endÈ-d¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (323) cvn H.B /DEST pdfmark endÈ-s¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (324) cvn H.B /DEST pdfmark endÈ-z¾,“or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (325) cvn H.B /DEST pdfmark endÈ-l“¾parameters.“See“ïcolor push gray 0ïps:SDict begin H.S endBackgrÑðound‘€Operationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (BACKOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡‘Din–€Chapter“9.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (327) cvn H.B /DEST pdfmark endÈ-B“¾is“ignorÑðed“in“menu“mode.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (329) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (330) cvn H.B /DEST pdfmark end©.‘0È-L‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (331) cvn H.B /DEST pdfmark endÉfilenameŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (332) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (333) cvn H.B /DEST pdfmark end–[b¾Allows“you“to“specify“an“alternate“log“le“name“when“the“any“facility“is“dirÑðectlyŽ¡‘Dstarted–ºöfršÑðom“the“command“line,“whether“in“for˜egr˜ound“or“backgr˜ound“mode.“IfŽ¡‘Dspecied–·in“for•Ñðegr“ound–·mode,“the“log“lename“prÑðompt“is“bypassed,“even“whenŽ¡‘Dlogging–Xis“turned“on“in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (334) cvn H.B /DEST pdfmark endÅCongurÑðe...“¾menu.“If“this“parameter“is“omitted“in“back-Ž¡‘DgrÑðound–€mode,“the“default“log“lename“is“used.Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (335) cvn H.B /DEST pdfmark end¦‘DThis–€parameter“always“turns“on“logging.Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (336) cvn H.B /DEST pdfmark end¦‘DIf–ÉZan“absolute“path“is“not“specied,“the“log“le“will“be“crÑðeated“in“the“default“logŽ¤ ‘Dle‘€dirÑðectoryŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (338) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (339) cvn H.B /DEST pdfmark end¡‘0È-I‘ffïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (340) cvn H.B /DEST pdfmark endÉintervalŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (341) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (342) cvn H.B /DEST pdfmark end–a.¾Sets“the“logging“interval“(in“minutes)“when“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (343) cvn H.B /DEST pdfmark endÈ-L‘a&¾parameter“is“used.“This“overÑð-Ž¡‘Drides–Zthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (344) cvn H.B /DEST pdfmark endÅLog“interval...“¾setting“in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (345) cvn H.B /DEST pdfmark endÅConguršÑðe...“¾menu.“If“omitted,“the“congur˜edŽŽŸ0‘`ïcolor push Black’šÅ13ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Ñ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.14) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (379) cvn H.B /DEST pdfmark endŸfdÅChapter–€1.“Getting“StartedŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¤¾value–ÕZis“used.“This“parameter“is“ignorÑðed“when“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (346) cvn H.B /DEST pdfmark endÈ-L‘ÕD¾parameter“is“omitted“andŽ¤ ’¤logging–€is“disabled.Ž‘`ŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (347) cvn H.B /DEST pdfmark end©.‘DThe–€value“specied“herÑðe“will“aect“all“facilities“except“for“the“IP“trac“monitor‘ÿB.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (349) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (350) cvn H.B /DEST pdfmark end¡‘0È-qŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (351) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (352) cvn H.B /DEST pdfmark end–ôC¾PršÑðeviously“used“to“suppr˜ess“the“warning“scr˜een“when“IPT‘ÿ raf“is“rëˆun“on“kernelsŽ¡‘Dwith–²IP‘Žmasquerading.“Since“the“masquerading“code“now“prÑðocesses“packets“inŽ¡‘Da–p‡way“better“suited“to“raw“capturÑðe,“this“parameter“is“no“longer“needed“and“isŽ¡‘DrÑðetained–€only“for“compatibility‘þã×.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (354) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (355) cvn H.B /DEST pdfmark end¦‘0È-fŽïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (356) cvn H.B /DEST pdfmark endŸ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (357) cvn H.B /DEST pdfmark end–Å0¾ForšÑðces“IPT‘ÿ raf“to“clear“all“lock“les“and“r˜eset“all“instance“counters“to“zer˜o“befor˜eŽ¡‘Drëˆunning–€any“facilities.“IPT‘ÿ raf“will“then“think“it's“the“rst“instance“of“itself.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (358) cvn H.B /DEST pdfmark end¦‘DThe–éDïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (359) cvn H.B /DEST pdfmark endÈ-f“¾parameter“overrides“the“existing“locks“and“counters“imposed“by“the“IP-Ž¡‘DT‘ÿ raf–õzprÑðocess“and“by“the“various“facilities,“causing“this“instance“to“think“it“is“theŽ¡‘Drst–²‘0¾IPT‘ÿ raf–ò¦initially“ršÑðeturns“exact“counts“of“bytes“and“packets.“However‘ÿB,“as“they“gr˜owŽ¤ ‘0laršÑðger‘ÿB,–€IPT‘ÿ raf“begins“displaying“them“in“incr˜easingly“higher“denominations.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (389) cvn H.B /DEST pdfmark endŸ.‘0A›ç2number–çYstanding“alone“with“no“sux“r•Ñðepr“esents–çYan“exact“count.“A˜number“with“a“KŽ¡‘0following–is“a“kilo“(thousand)“guršÑðe.“An“M,“G,“and“T‘sux“r˜epr˜esents“mega“(million),Ž¡‘0giga–€(billion),“and“tera“(trillion)“rÑðespectively‘þã×.“The“following“table“shows“examples.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (390) cvn H.B /DEST pdfmark endŸ.‘0ÄT‘þã×able–€2-1.“Numeric“Display“NotationsŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (392) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.1) cvn H.B /DEST pdfmark endžff‘0„fftÌÌŽŽ‘0„fftÌÌŽŽŸ k~‘0Ÿ„k~ffŸý¾1024067ŽŽŽ’êffexactly‘€1024067ŽŽ’¤ffŸ„k~ffŽŽ¤k~‘0Ÿ„k~ffŸý1024KŽŽŽ’êffapprÑðoximately‘€1024000ŽŽ’¤ffŸ„k~ffŽŽ¡‘0Ÿ„k~ffŸý1024MŽŽŽ’êffapprÑðoximately‘€1024000000ŽŽ’¤ffŸ„k~ffŽŽ¡‘0Ÿ„k~ffŸý1024GŽŽŽ’êffapprÑðoximately‘€1024000000000ŽŽ’¤ffŸ„k~ffŽŽ¡‘0Ÿ„k~ffŸý1024TŽŽŽ’êffapprÑðoximately‘€1024000000000000ŽŽ’¤ffŸ„k~ffŽŽŸff‘0„fftÌÌŽŽ‘0„fftÌÌŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (409) cvn H.B /DEST pdfmark end¤ ‘0These–€notations“apply“to“both“packet“and“byte“counts.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (INSTANCES) cvn H.B /DEST pdfmark endŸÒ1ÇInstances–³6and“LogÝîgingïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (4.11.1) cvn H.B /DEST pdfmark endŽŸ Éïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (412) cvn H.B /DEST pdfmark endŸ å‘0¾Since–p‹version“2.4,“IPT‘ÿ raf“allows“multiple“instances“of“the“facilities“at“the“same“time“inŽ¡‘0dier•Ñðent›[¯pr“ocesses˜(for˜example,˜you˜can˜now˜rëˆun˜two˜or˜mor“e˜IP‘[¥T‘ÿ rac˜Monitors˜atŽ¡‘0the–S2same“time).“However“only“one“can“listen“on“a“specic“interface“or“all“interfaces“atŽ¡‘0once.–ÏEThe“only“exception“is“the“general“interface“statistics,“which“is“still“rÑðestricted“toŽ¡‘0only–€one“instance“at“a“time.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (413) cvn H.B /DEST pdfmark endŸ.‘0Because–å6of“this“rÑðelaxation,“each“instance“now“generates“log“les“with“unique“namesŽ¡‘0for–ƒ¼instances,“depending“on“either“their“instance“or“the“interface“they'rÑðe“listening“on.Ž¡‘0If–`úthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (414) cvn H.B /DEST pdfmark endÅLogging“¾option“is“turned“on“(see“the“ïcolor push gray 0ïps:SDict begin H.S endCongurationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘C*·chapter),“IPT‘ÿ raf“will“prÑðomptŽ¡‘0you–„Úfor“a“log“le“name“while“prÑðesenting“a“default.“Y‘ÿou“may“accept“this“default“orŽ¡‘0change–ø;it.“PrÑðess“Enter“to“accept,“or“Ctrl+X‘øto“cancel.“Canceling“will“turn“logging“oŽ¡‘0for–€that“particular“session.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (416) cvn H.B /DEST pdfmark endŸ.‘0If–Qþyou“don't“specify“an“absolute“path,“the“log“le“will“be“placed“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (417) cvn H.B /DEST pdfmark endÈ/var/log/iptraf¾.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (418) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (420) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï@PSfile="iptraf-logprompt.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€2-1.“The“logle“prompt“dialogŽŽŸ0‘`ïcolor push Black’™úèÅ17ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;sX‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.18) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (506) cvn H.B /DEST pdfmark endŸfdÅChapter–€2.“PrÑðeparing“to“Use“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (421) cvn H.B /DEST pdfmark endŸ ‘0¾See–D•the“Logging“section“in“the“ïcolor push gray 0ïps:SDict begin H.S endCongurationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘Bñíchapter“for“detailed“information“on“log-Ž¤ ‘0ging.–¤†See“also“the“documentation“on“each“statistical“facility“for“the“default“log“leŽ¡‘0names.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (423) cvn H.B /DEST pdfmark endŸ Èø‘0The–}7default“log“le“names“will“also“be“used“if“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (424) cvn H.B /DEST pdfmark endÈ-B‘|ö¾parameter“is“used“to“rëˆun“IP-Ž¡‘0T‘ÿ raf–ʽin“the“backgrÑðound.“Y‘ÿou“can“override“the“defaults“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (425) cvn H.B /DEST pdfmark endÈ-L‘Êh¾parameter‘ÿB.“SeeŽ¡‘0ïcolor push gray 0ïps:SDict begin H.S endBackgrÑðound‘€Operationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (BACKOP) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’—ëBin–€Chapter“9.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (UPDATES) cvn H.B /DEST pdfmark endŸÒ1ÇScreen–³6Update“Dela»Þysïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (4.12.1) cvn H.B /DEST pdfmark endŽŸ hüïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (429) cvn H.B /DEST pdfmark endŸ>²‘0¾Older–¼ versions“of“IPT‘ÿ raf“updated“the“scršÑðeen“as“soon“as“a“packet“was“r˜eceived.“How-Ž¡‘0ever‘ÿB,–ð„scršÑðeen“update“is“one“of“the“slowest“operations“the“pr˜ogram“performs.“SinceŽ¡‘0version–JV1.3,“a“conguration“option“has“been“available“to“contršÑðol“scr˜een“update“speed.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (430) cvn H.B /DEST pdfmark end©.‘0See–‡Îthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (431) cvn H.B /DEST pdfmark endÅScrÑðeen“update“interval...“¾conguration“option“under“the“ïcolor push gray 0ïps:SDict begin H.S endCongurationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘Cx_chapterŽ¡‘0of–€this“manual.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (IFACES) cvn H.B /DEST pdfmark endŸ"mÇSupporD!ted–³6Netw»Þork“Interfacesïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (4.13.1) cvn H.B /DEST pdfmark endŽŸ hüïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (435) cvn H.B /DEST pdfmark endŸ>²‘0¾IPT‘ÿ raf–€currÑðently“supports“the“following“network“interface“types“and“names.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (436) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (438) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (439) cvn H.B /DEST pdfmark end¦‘0ÈloŽ¨0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (440) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (441) cvn H.B /DEST pdfmark end–æh¾The“loopback“interface.“Every“machine“has“one,“and“has“an“IP‘æAaddrÑðess“of“127.0.0.1.Ž¡‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (442) cvn H.B /DEST pdfmark endÈlo–€¾is“also“indicated“if“data“is“detected“on“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (443) cvn H.B /DEST pdfmark endÈdummyïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (444) cvn H.B /DEST pdfmark endÉn“¾interface(s).ŽŸ Pïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (446) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (447) cvn H.B /DEST pdfmark endŸç°‘0Èethïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (448) cvn H.B /DEST pdfmark endÉnŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (449) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (450) cvn H.B /DEST pdfmark end–?W¾An“Ethernet“interface.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (451) cvn H.B /DEST pdfmark endÊn“¾starts“fršÑðom“0.“Ther˜efor˜e,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (452) cvn H.B /DEST pdfmark endÈeth0“¾r˜efers“to“the“rst“EthernetŽ¡‘Dinterface,–€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (453) cvn H.B /DEST pdfmark endÈeth1“¾to“the“second,“and“so“on.“Most“machines“only“have“one.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (455) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (456) cvn H.B /DEST pdfmark endŸ.‘0Èfddiïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (457) cvn H.B /DEST pdfmark endÉnŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (458) cvn H.B /DEST pdfmark end¤Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (459) cvn H.B /DEST pdfmark end–€¾An“FDDI“interface.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (460) cvn H.B /DEST pdfmark endÊn“¾starts“frÑðom“0.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (462) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (463) cvn H.B /DEST pdfmark endŸ Èø‘0Ètrïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (464) cvn H.B /DEST pdfmark endÉnŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (465) cvn H.B /DEST pdfmark end¡‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (466) cvn H.B /DEST pdfmark end–€¾A“T‘ÿoken“Ring“interface,“wheršÑðe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (467) cvn H.B /DEST pdfmark endÊn“¾starts“fr˜om“0.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (469) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (470) cvn H.B /DEST pdfmark endŸ.‘0Èpppïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (471) cvn H.B /DEST pdfmark endÉnŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (472) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (473) cvn H.B /DEST pdfmark end–€¾A“PPP“interface.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (474) cvn H.B /DEST pdfmark endÊn“¾starts“frÑðom“0.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (476) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (477) cvn H.B /DEST pdfmark endŸ Èø‘0Èsliïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (478) cvn H.B /DEST pdfmark endÉnŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (479) cvn H.B /DEST pdfmark end¡‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (480) cvn H.B /DEST pdfmark end¾A–€SLIP“interface.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (481) cvn H.B /DEST pdfmark endÊn“¾starts“frÑðom“0.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (483) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (484) cvn H.B /DEST pdfmark endŸ Èø‘0Èipppïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (485) cvn H.B /DEST pdfmark endÉnŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (486) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (487) cvn H.B /DEST pdfmark end–€¾A“synchršÑðonous“PPP“interface“using“ISDN.“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (488) cvn H.B /DEST pdfmark endÊn“¾starts“fr˜om“0.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (490) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (491) cvn H.B /DEST pdfmark endŸ.‘0Èisdnïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (492) cvn H.B /DEST pdfmark endÉnŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (493) cvn H.B /DEST pdfmark end¡‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (494) cvn H.B /DEST pdfmark end–}*¾ISDN‘|èinterfaces“can“be“given“arbitrary“names,“but“for“them“to“work“with“IP-Ž¤ ‘DT›ÿ raf,–(Ythey“must“be“named“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (495) cvn H.B /DEST pdfmark endÈisdnïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (496) cvn H.B /DEST pdfmark endÉn¾.“IPT˜raf“supports“synchrÑðonous“PPP‘(.(the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (497) cvn H.B /DEST pdfmark endÈipppïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (498) cvn H.B /DEST pdfmark endÉnŽ¡‘D¾interfaces–€above),“raw“IP‘þµÇ,“and“Cisco-HDLC“encapsulation.ŽŽŸ0‘`ïcolor push BlackÅ18ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;‹¥‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.19) cvn H.B /DEST pdfmark endï color popŸüfd’+ôÅChapter–€2.“PrÑðeparing“to“Use“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (500) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (501) cvn H.B /DEST pdfmark endŸ ‘0Èplipïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (502) cvn H.B /DEST pdfmark endÉnŽ¤i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (503) cvn H.B /DEST pdfmark end©–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (504) cvn H.B /DEST pdfmark end–Z;¾PLIP›Zinterfaces.“These“arÑðe“point-to-point“IP˜connections“using“the“PC˜parallelŽŸ ‘Dport.ŽŸ‘0ÈipsecÉnŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (509) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (510) cvn H.B /DEST pdfmark end–€¾This“ršÑðefers“to“Fr˜ee“s/W‘ÿAN“(and“possibly“other)“logical“VPN“interfaces.Ž¤ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (512) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (513) cvn H.B /DEST pdfmark end©.‘0Èsbniïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (514) cvn H.B /DEST pdfmark endÉnŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (515) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (516) cvn H.B /DEST pdfmark end–€¾SBNI“long-range“modem“interfacesŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (518) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (519) cvn H.B /DEST pdfmark end¦‘0Èdvbïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (520) cvn H.B /DEST pdfmark endÉn¾,–€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (521) cvn H.B /DEST pdfmark endÈsm200¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (522) cvn H.B /DEST pdfmark endÈsm300Ž¤£Óïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (523) cvn H.B /DEST pdfmark end©\-‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (524) cvn H.B /DEST pdfmark end–€¾DVB“satellite-rÑðeceive“interfacesŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (526) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (527) cvn H.B /DEST pdfmark endŸ Èø‘0Èwlanïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (528) cvn H.B /DEST pdfmark endÉn¾,‘€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (529) cvn H.B /DEST pdfmark endÈwvlanïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (530) cvn H.B /DEST pdfmark endÉnŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (531) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (532) cvn H.B /DEST pdfmark end–€¾W‘ÿs8irÑðeless“LAN“interfacesŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (534) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (535) cvn H.B /DEST pdfmark endŸ Èø‘0Ètunïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (536) cvn H.B /DEST pdfmark endÉnŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (537) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (538) cvn H.B /DEST pdfmark end¾general–€logical“tunnel“interfacesŽ¤ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (540) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (541) cvn H.B /DEST pdfmark end©.‘0Èbrgïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (542) cvn H.B /DEST pdfmark endÉnŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (543) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (544) cvn H.B /DEST pdfmark end¾general–€logical“bridge“interfacesŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (546) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (547) cvn H.B /DEST pdfmark end¦‘0Èhdlcïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (548) cvn H.B /DEST pdfmark endÉnŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (549) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (550) cvn H.B /DEST pdfmark end–€¾Frame“Relay“base“(FRAD)“interfaces“(non-PVC)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (552) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (553) cvn H.B /DEST pdfmark end¦‘0Èpvcïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (554) cvn H.B /DEST pdfmark endÉnŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (555) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (556) cvn H.B /DEST pdfmark end–€¾Frame“Relay“Permanent“V‘ÿs8irtual“CirÑðcuit“interfacesŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (557) cvn H.B /DEST pdfmark end¦‘0Y‘ÿour–|`system's“network“interfaces“must“be“named“accorÑðding“to“the“schemes“speciedŽŸ ‘0above.ŽŽŸ0‘`ïcolor push Black’šÅ19ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;»¨‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.20) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€2.“PrÑðeparing“to“Use“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black20ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Ú.‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.21) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (ITRAFMON) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï3.“The“IP“T‘þÔ-rac“Monitorïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (5.0) cvn H.B /DEST pdfmark endŽŸWµïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (560) cvn H.B /DEST pdfmark endŸø*‘0¾Executing–)hthe“rst“menu“item“or“specifying“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (561) cvn H.B /DEST pdfmark endÈ-i“¾to“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (562) cvn H.B /DEST pdfmark endÄiptraf“¾command“takes“you“toŽ¤ ‘0the–x:IP‘wútrac“monitor‘ÿB.“The“trac“monitor“is“a“rÑðeal-time“monitoring“system“that“in-Ž¡‘0terÑðcepts–—,all“packets“on“all“detected“network“interfaces,“decodes“the“IP‘–äinformationŽ¡‘0on–Ö·all“IP‘Ö packets“and“displays“the“appršÑðopriate“information,“most“notably“the“sour˜ceŽ¡‘0and–²‘0¾The–V„upper“window“of“the“trac“monitor“displays“the“currÑðently“detected“TCP‘VLcon-Ž¡‘0nections.–7¬Information“about“TCP‘7}packets“aršÑðe“displayed“her˜e.“The“window“containsŽ¡‘0these–€pieces“of“information:Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (571) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (572) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (573) cvn H.B /DEST pdfmark end¾Sour•Ñðce›€addr“ess˜and˜portŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (574) cvn H.B /DEST pdfmark end¤.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (575) cvn H.B /DEST pdfmark end¾Packet‘€countŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (576) cvn H.B /DEST pdfmark endŸ Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (577) cvn H.B /DEST pdfmark end¾Byte‘€countŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (578) cvn H.B /DEST pdfmark end¡‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (579) cvn H.B /DEST pdfmark end¾SouršÑðce–€MAC“addr˜essŽ£7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (580) cvn H.B /DEST pdfmark end© Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (581) cvn H.B /DEST pdfmark end¾Packet‘€SizeŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (582) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (583) cvn H.B /DEST pdfmark end¾W‘ÿs8indow‘€SizeŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (584) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (585) cvn H.B /DEST pdfmark end¾TCP–€ag“statusesŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (586) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (587) cvn H.B /DEST pdfmark end¾InterfaceŽ¡ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (588) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (590) cvn H.B /DEST pdfmark endŸ ¯^‘DÐNote:–°9ÏPreºåvious“vÆfersions“of“IPT‘þëˆršèöaf“shoÝvw˜ed“both“the“source“and“destination“addresses“onŽ¤ æf‘Deach–ºŠlinešÝv.“IPT‘þëˆrèöaf“2“and“higher“sho˜w“only“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (591) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (592) cvn H.B /DEST pdfmark endó(‰šš pcrro8tÓsource‘Ü)hostÑ:ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (593) cvn H.B /DEST pdfmark endÓport“Ïcombination“to“saÑîvÆfe“onŽ¡‘Dscreen–öQreal“estateÝv.“TCP‘ö3connection“endpoints“are“still“indicated“with“the“gšèöreen“br˜ac•Ñîk“etsŽ¡‘D(on–€}color“ter9™minals)“along“the“left“edge“of“the“screen.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (594) cvn H.B /DEST pdfmark end¤ ‘0¾The–”½Up“and“Down“cursor“keys“move“an“indicator“bar“between“entries“in“the“TCPŽ¡‘0monitor‘ÿB,–¯ßscrÑðolling“the“window“if“necessary‘þã×.“The“PgUp“and“PgDn“keys“display“theŽ¡‘0pršÑðevious–€and“next“scr˜eenfuls“of“entries“r˜espectively‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (595) cvn H.B /DEST pdfmark end¦‘0The–ÜÙIP‘ÜÁtrac“monitor“computes“the“data“ow“rate“of“the“currÑðently“highlighted“TCPŽ¡‘0ow–ÛEand“displays“it“on“the“loweršÑð-right“corner“of“the“scr˜een.“The“ow“rate“is“in“kilo-Ž¡‘0bits–›Üor“kilobytes“per“second“depending“on“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (596) cvn H.B /DEST pdfmark endÅActivity“mode“¾switch“in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (597) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡‘0¾menu.ŽŽŸ0‘`ïcolor push Black’šÅ21ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Üב·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.22) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (656) cvn H.B /DEST pdfmark endŸfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (599) cvn H.B /DEST pdfmark endŸ ‘0¾Because–A`this“monitoring“system“rÑðelies“solely“on“packet“information,“it“does“not“de-Ž¤ ‘0termine–D\which“endpoint“initiated“the“connection.“In“other“worÑðds,“it“does“not“knowŽ¡‘0which–…Áendpoints“arÑðe“the“client“and“server‘ÿB.“This“is“necessary“because“it“can“operate“inŽ¡‘0prÑðomiscuous–ð¹mode,“and“as“such“cannot“determine“the“socket“statuses“for“other“ma-Ž¡‘0chines–ü(on“the“LAN.“However‘ÿB,“a“little“knowledge“of“the“well-known“TCP‘üport“num-Ž¡‘0bers–€can“give“a“good“idea“about“which“addrÑðess“is“that“of“the“server‘ÿB.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (600) cvn H.B /DEST pdfmark endŸ.‘0The–isystem“ther•Ñðefor“e–idisplays“two“entries“for“each“connection,“one“for“each“dirÑðectionŽ¡‘0of–[cthe“TCP‘[Zconnection.“T‘ÿo“make“it“easier“to“determine“the“dirÑðection“pairs“of“each“con-Ž¡‘0nection,–~¡a“bracket“is“used“to“"join"“both“together‘ÿB.“This“bracket“appears“at“the“leftmostŽ¡‘0part–€of“each“entry‘þã×.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (601) cvn H.B /DEST pdfmark end©.‘0Just–@sbecause“a“host“entry“appears“at“the“upper“end“of“a“connection“bracket“doesn'tŽ¡‘0mean–€it“was“the“initiator“of“the“connection.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (602) cvn H.B /DEST pdfmark endŸ Èø‘0Each–€entry“in“the“window“contains“these“elds:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (603) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (605) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (606) cvn H.B /DEST pdfmark end¦‘0ÅSour•Ñðce›€addr“ess˜and˜portŽŸ‡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (607) cvn H.B /DEST pdfmark endŸ =y‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (608) cvn H.B /DEST pdfmark end–Sz¾The“souršÑðce“addr˜ess“and“port“indicator“is“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (609) cvn H.B /DEST pdfmark endÊaddress¾:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (610) cvn H.B /DEST pdfmark endÊport“¾format.“This“indi-Ž¡‘Dcates–­šthe“souršÑðce“machine“and“TCP‘­Žport“on“that“machine“fr˜om“which“this“data“isŽ¡‘Dcoming.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (611) cvn H.B /DEST pdfmark end¦‘DThe–€destination“is“the“host:port“at“the“other“end“of“the“bracket.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (613) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (614) cvn H.B /DEST pdfmark end¡‘0ÅPacket‘€countŽžÛïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (615) cvn H.B /DEST pdfmark endŸå%‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (616) cvn H.B /DEST pdfmark end–€¾The“number“of“packets“ršÑðeceived“for“this“dir˜ection“of“the“TCP“connectionŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (618) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (619) cvn H.B /DEST pdfmark end¦‘0ÅByte‘€countŽŸ‡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (620) cvn H.B /DEST pdfmark endŸ =y‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (621) cvn H.B /DEST pdfmark end–c[¾The“number“of“bytes“ršÑðeceived“for“this“dir˜ection“of“the“TCP‘c connection.“TheseŽ¡‘Dbytes–Ëinclude“total“IP›¯and“TCP˜header“information,“in“addition“to“the“actual“data.Ž¡‘DData–€link“header“(e.g.“Ethernet“and“FDDI)“data“arÑðe“not“included.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (623) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (624) cvn H.B /DEST pdfmark end¦‘0ÅSouršÑðce–€MAC“addr˜essŽ¨Ûïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (625) cvn H.B /DEST pdfmark endŸå%‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (626) cvn H.B /DEST pdfmark end–ÞŸ¾The“addršÑðess“of“the“host“on“your“local“LAN‘Þ‡that“deliver˜ed“this“packet.“This“canŽ¡‘Dbe–ηviewed“by“pršÑðessing“M‘΢once“if“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (627) cvn H.B /DEST pdfmark endÅSour˜ce“MAC‘΢addrs“¾in“trac“monitor“is“enabledŽ¡‘Din–€the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (628) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘2¾menu.ŽŸ ‡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (631) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (632) cvn H.B /DEST pdfmark endŸ=y‘0ÅPacket‘€SizeŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (633) cvn H.B /DEST pdfmark endŸå%‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (634) cvn H.B /DEST pdfmark end–o¾The“size“of“the“most“ršÑðecently“r˜eceived“packet.“This“item“is“visible“if“you“pr˜ess“MŽ¡‘Dfor–FÙmorÑðe“TCP›FÊinformation.“This“is“the“size“of“the“IP˜datagram“only‘þã×,“not“includingŽ¡‘Dthe–€data“link“header‘ÿB.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (636) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (637) cvn H.B /DEST pdfmark endŸ Èø‘0ÅWÌÐindow‘€SizeŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (638) cvn H.B /DEST pdfmark endŸå%‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (639) cvn H.B /DEST pdfmark end–œ¾The“advertised“window“size“of“the“most“ršÑðecently“r˜eceived“packet.“This“item“isŽ¡‘Dvisible–€if“you“pršÑðess“M“for“mor˜e“TCP“information.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (641) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (642) cvn H.B /DEST pdfmark end¤.‘0ÅFlag‘€statusesŽŸ‡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (643) cvn H.B /DEST pdfmark endŸ =y‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (644) cvn H.B /DEST pdfmark end–€¾The“ags“of“the“most“ršÑðecently“r˜eceived“packet.‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (645) cvn H.B /DEST pdfmark endŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (647) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (648) cvn H.B /DEST pdfmark end¡‘DÈSŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (649) cvn H.B /DEST pdfmark endŸÏ ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (650) cvn H.B /DEST pdfmark end–nã¾SYN.“A‘n¦synchršÑðonization“is“taking“place“in“pr˜eparation“for“connection“es-ŽŸ ‘Xtablishment.–6“If“only“an“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (651) cvn H.B /DEST pdfmark endÈS‘6d¾is“pršÑðesent“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (652) cvn H.B /DEST pdfmark endÈS---¾)“the“sour˜ce“is“trying“to“initiate“aŽŽŸ0‘`ïcolor push BlackÅ22ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;þv‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.23) cvn H.B /DEST pdfmark endï color popŸüfd’ZÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¸¾connection.–°If“an“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (653) cvn H.B /DEST pdfmark endÈA‘n¾is“also“prÑðesent“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (654) cvn H.B /DEST pdfmark endÈS-A-¾),“this“is“an“acknowledgment“of“aŽŸ ’¸pršÑðevious–€connection“r˜equest,“and“is“r˜esponding.ŽŸ’¤ÈAŽ‘`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (658) cvn H.B /DEST pdfmark end¤‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (659) cvn H.B /DEST pdfmark end–€¾ACK.“This“is“an“acknowledgment“of“a“pršÑðeviously“r˜eceived“packetŽ© Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (661) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (662) cvn H.B /DEST pdfmark endŸ.‘DÈPŽïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (663) cvn H.B /DEST pdfmark end¡‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (664) cvn H.B /DEST pdfmark end–€¾PSH.“A“ršÑðequest“to“push“all“data“to“the“top“of“the“r˜eceiving“queueŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (666) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (667) cvn H.B /DEST pdfmark end¤.‘DÈUŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (668) cvn H.B /DEST pdfmark endŸÏ ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (669) cvn H.B /DEST pdfmark end–€¾URG.“This“packet“contains“urÑðgent“dataŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (671) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (672) cvn H.B /DEST pdfmark end¡‘DÈRESETŽ¨0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (673) cvn H.B /DEST pdfmark endŸÏ ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (674) cvn H.B /DEST pdfmark end–n+¾RST‘ÿB.“The“souršÑðce“machine“indicated“in“this“dir˜ection“r˜eset“the“entir˜e“connec-Ž¤ ‘Xtion.–zýThe“diršÑðection“entries“for“r˜eset“connections“become“available“for“newŽ¡‘Xconnections.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (676) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (677) cvn H.B /DEST pdfmark endŸ Èø‘DÈDONEŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (678) cvn H.B /DEST pdfmark endŸÏ ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (679) cvn H.B /DEST pdfmark end–!X¾The“connection“is“done“sending“data“in“this“dirÑðection,“and“has“sent“a“FINŽ¡‘X(nished)–€packet,“but“has“not“yet“been“acknowledged“by“the“other“host.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (681) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (682) cvn H.B /DEST pdfmark endŸ.‘DÈCLOSEDŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (683) cvn H.B /DEST pdfmark endŸÏ ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (684) cvn H.B /DEST pdfmark end–3¬¾The“FIN‘3™has“been“acknowledged“by“the“other“host.“When“both“dirÑðections“ofŽ¡‘Xa–úwconnection“arÑðe“marked“CLOSED,“the“entries“they“occupy“become“availableŽ¡‘Xfor–€new“connection“entries.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (686) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (687) cvn H.B /DEST pdfmark endŸ Èø‘DÈ-Žïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (688) cvn H.B /DEST pdfmark endŸ‘Dïcolor push Black‘€ï color popŽŽ‘Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (689) cvn H.B /DEST pdfmark end–€¾The“ag“is“not“setŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (690) cvn H.B /DEST pdfmark end©.‘0Some–4‘other“pieces“of“information“can“be“viewed“as“well.“The“M‘4bkey“displays“morÑðeŽ¡‘0TCP› information.– ,PrÑðessing“M˜once“displays“the“MAC˜addrÑðesses“of“the“LAN˜hosts“thatŽ¡‘0deliveršÑðed–ëÊthe“packets“(if“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (691) cvn H.B /DEST pdfmark endÅSour˜ce“MAC‘ë¤addrs“in“trac“monitor“¾option“is“enabled“in“theŽ¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (692) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘2O¾menu).–sHïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (694) cvn H.B /DEST pdfmark endÈN/A‘sE¾is“displayed“if“no“packets“have“been“ršÑðeceived“fr˜om“the“sour˜ceŽ¡‘0yet,–€or“if“the“interface“doesn't“support“MAC“addrÑðesses“(such“as“PPP“interfaces).ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (695) cvn H.B /DEST pdfmark end¦‘0If–Àthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (696) cvn H.B /DEST pdfmark endÅSouršÑðce“MAC‘~addrs“in“trac“monitor“¾option“is“not“enabled,“pr˜essing“M‘~simplyŽ¡‘0toggles–€between“the“counts“and“the“packet“and“window“sizes.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (697) cvn H.B /DEST pdfmark end¦‘0By–ÐHdefault,“only“IP‘Ð4addršÑðesses“ar˜e“displayed,“but“if“you“have“access“to“a“name“serverŽ¡‘0or–B¥host“table,“you“may“enable“ršÑðeverse“lookup“for“the“IP‘B–addr˜esses.“Just“enable“r˜everseŽ¡‘0lookup–€in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (698) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘2¾menu.ŽŽŸ0‘`ïcolor push Black’šÅ23ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;%‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.24) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ   þ: €’ ÿVô€‰L ¬ €„¬ €Ÿý‘ ÿYô€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (700) cvn H.B /DEST pdfmark endŸ9˜‘ÄThe–€rvnamed“ProcessŽŸkïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (702) cvn H.B /DEST pdfmark endŸ â•‘¾The–ÝóIP‘ÝÚtrac“monitor“starts“a“daemon“called“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (703) cvn H.B /DEST pdfmark endÄrvnamed“¾to“help“speed“upŽ¤ ‘ršÑðeverse–- lookups“without“sacricing“too“much“keyboar˜d“contr˜ol“and“accu-Ž¡‘racy–­Pof“the“counts.“While“rÑðeverse“lookup“is“being“conducted“in“the“back-Ž¡‘gršÑðound,–€IP“addr˜esses“will“be“used“until“the“r˜esolution“is“complete.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (704) cvn H.B /DEST pdfmark endŸ.‘If–;lfor“some“ršÑðeason“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (705) cvn H.B /DEST pdfmark endÄrvnamed“¾cannot“start“(pr˜obably“due“to“impr˜oper“in-Ž¡‘stallation–Óor“lack“of“memory),“and“you“arÑðe“on“the“Internet,“and“you“enableŽ¡‘ršÑðeverse–œ?lookup,“your“keyboar˜d“contr˜ol“can“become“very“slow‘ÿ.“This“is“be-Ž¡‘cause–ìÆthe“standaršÑðd“lookup“functions“do“not“r˜eturn“until“they“have“com-Ž¡‘pleted–ùtheir“tasks,“and“it“can“take“several“seconds“for“a“name“rÑðesolutionŽ¡‘in–€the“for•Ñðegr“ound–€to“complete.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (706) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (707) cvn H.B /DEST pdfmark endŸ.‘Ärvnamed–€¾will“spawn“up“to“200“childršÑðen“to“pr˜ocess“r˜everse“DNS“queries.ŽŽŽŽ’J„¬ €ŽŸ‰LŽŽŽ’Þ€ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (708) cvn H.B /DEST pdfmark endŽ‘`Ÿïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (710) cvn H.B /DEST pdfmark endŸž–‘DÐTip:–‹ÍÏIf“yšÑîou“notice“unèöusual“SYN‘‹Ëactivity“(too“manÝvy“initial“(ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (711) cvn H.B /DEST pdfmark endÑS---Ï)“b˜ut“frozšÝven“SYN‘‹Ëentr"‰ies˜,“orŽ¤ æf‘Drèöapidly–Ó`increasing“initial“SYN‘ÓKpac•Ñîk“ets–Ó`fšºåor“a“single“connection),“yÑîou“ma˜y“be“under“a“SYNŽ¡‘Dooding–™cattacÑîk“or“TCP‘™\por\#t“scan.“Apply“appropr"‰iate“measuresÝv,“or“the“targeted“machinesŽ¡‘Dmaºåy–€}begin“denšÝvying“netwèöor"‰k“serEvices˜.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (712) cvn H.B /DEST pdfmark end¤ ‘0¾Entries–ô²not“updated“within“a“useršÑð-congurable“amount“of“time“may“get“r˜eplacedŽ¡‘0with–Þ7new“connections.“The“default“time“is“15“minutes.“This“is“r•Ñðegar“dless–Þ7of“whetherŽ¡‘0the–?€connection“is“closed“or“not.“(Some“unclosed“connections“may“be“due“to“extrÑðemelyŽ¡‘0slow–ìlinks“or“crashes“at“either“end“of“the“connection.)“This“gurÑðe“can“be“changed“atŽ¡‘0the‘€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (713) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘2¾menu.ŽŸ‡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (715) cvn H.B /DEST pdfmark endŸ=y‘0Some–¸Äearly“entries“may“have“a“ó  b> cmmi10µ>“¾symbol“in“frÑðont“of“its“packet“count.“This“meansŽ¡‘0the–‘Çconnection“was“alršÑðeady“established“when“the“monitor“started.“In“other“wor˜ds,Ž¡‘0the–ø guršÑðes“indicated“do“not“r˜eect“the“counts“since“the“start“of“the“TCP‘÷íconnection,Ž¡‘0but–¹^rather›ÿB,“since“the“start“of“the“trac“monitor˜.“Eventually‘þã×,“these“µ>“¾entries“will“closeŽ¡‘0(or–ìtime“out)“and“disappear‘ÿB.“TCP‘Æentries“without“the“>“werÑðe“initiated“after“the“traf-Ž¡‘0c–¬4monitor“started,“and“the“counts“indicate“the“totals“of“the“connection“itself.“JustŽ¡‘0consider–€entries“with“µ>“¾partial.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (716) cvn H.B /DEST pdfmark endŸ.‘0Some–\µ>“¾entries“may“go“idle“if“the“trac“monitor“was“started“when“these“connectionsŽ¡‘0wer•Ñðe›Láalr“eady˜half-closed˜(FIN‘LÔsent˜by˜one˜host,˜but˜data˜still˜being˜sent˜by˜the˜other).Ž¡‘0This–Lâis“because“the“trac“monitor“cannot“determine“if“a“connection“was“alrÑðeady“half-Ž¡‘0closed–ºwhen“it“started.“These“entries“will“eventually“time“out.“(T‘ÿo“minimize“theseŽ¡‘0entries,–(”an“entry“is“not“added“by“the“monitor“until“a“packet“with“data“or“a“SYN‘(~packetŽ¡‘0is‘€rÑðeceived.)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (717) cvn H.B /DEST pdfmark endŸç°‘0DiršÑðection–(×entries“also“become“available“for“r˜euse“if“an“ICMP‘(ÁDestination“Unr˜eachableŽ¡‘0message–€is“rÑðeceived“for“the“connection.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (718) cvn H.B /DEST pdfmark endŸ.‘0The–ârlower“part“of“the“scrÑðeen“contains“a“summary“line“showing“the“IP›þµÇ,“TCP˜,“UDP˜,Ž¡‘0ICMP›þµÇ,–hand“non-IP‘Abyte“counts“since“the“start“of“the“monitor‘ÿB.“The“IP˜,“TCP˜,“UDP˜,“andŽ¡‘0ICMP›¹†counts–¹•include“only“the“IP˜datagram“header“and“data,“not“the“data-link“head-Ž¡‘0ers.–€The“non-IP“count“includes“the“data-link“headers.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (719) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (721) cvn H.B /DEST pdfmark endŸ ¯^‘DÐT‘ÿuÃecšèöhnical–°Ènote:“IP‘°¼ForwarÑîding“and“Masquerading:“ÏPreºåvious“vÆfersions“of“IPT‘þëˆr˜af“issuedŽ¤ æf‘Da–cÞwÝvarš9™ning“if“the“kÑîer˜nel“had“IP‘c×masquerèöading“enabšÑîled“due“to“the“wÝvaºåy“the“k˜er9™nel“masquer-Ž¡‘Daded–•and“trèöanslated“the“IP‘TaddressesÝv.“The“nešÑîw“k˜er9™nels“no“longer“do“it“as“befºåore“andŽ¡‘DIPT‘þëˆršèöaf–WnoÝvw“givÆfes“output“proper"‰ly“on“masquer˜ading“machinesÝv.“The“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (722) cvn H.B /DEST pdfmark endÑ-q“Ïpar˜ameter“is“noŽ¡‘Dlonger–€}required“to“suppress“the“wÝvar9™ning“screen.ŽŽŸ0‘`ïcolor push BlackÅ24ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;Cû‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.25) cvn H.B /DEST pdfmark endï color popŸüfd’ZÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (723) cvn H.B /DEST pdfmark endŸ ‘DÏOn–1ÍfºåorwÝvarding“(non-masquerèöading)“machines“pac•Ñîk“ets–1Íand“TCP‘1 connections“simply“ap-Ž¤ æf‘Dpear–«¸twiceÝv,“one“each“fšºåor“the“incoming“and“outgoing“interf˜aces“if“all“interèöaf˜aces“are“beingŽ¡‘Dmonitored.ŽŸzïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (724) cvn H.B /DEST pdfmark endŸ Ëì‘DOn–U£masqueršèöading“machinesÝv,“pac•Ñîk“ets–U£and“connections“from“the“inter9™nal“netw˜or"‰k“to“theŽ¡‘Dešºåxter9™nal–9änetwèöor"‰k“also“appear“twiceÝv,“one“f˜or“the“inter9™nal“and“e˜xter9™nal“interf˜aceÝv.“P£Üac•Ñîk“etsŽ¡‘Dcoming–bÑfrom“the“interš9™nal“netwèöor"‰k“will“be“indicated“as“coming“from“the“inter˜nal“IP‘bÊaddressŽ¡‘Dthat–sourced“them,“and“also“as“coming“from“the“IP‘áaddress“of“the“ešºåxter9™nal“interf˜ace“onŽ¡‘DyÑîour–d=masqueršèöading“machineÝv.“In“m˜uch“the“same“wÝvašºåy‘ÿ™,“pac•Ñîk“ets–d=coming“in“from“the“e˜xter9™nalŽ¡‘Dnetwèöor"‰k–a+will“look“likšÑîe“the˜y'ŒÌre“destined“fšºåor“the“e˜xter9™nal“interf˜ace'ŒÌs“IP‘a#addressÝv,“and“again“asŽ¡‘Ddestined–€}fºåor“the“nal“host“on“the“inter9™nal“netwèöor"‰k.Ž©‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (725) cvn H.B /DEST pdfmark endŽŸ!O\ÌClosed/Idle/Timed–]Out“Connectionsïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (5.14.5.2) cvn H.B /DEST pdfmark endŽŸ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (727) cvn H.B /DEST pdfmark endŸ ÙM‘0¾A–ATCP“connection–AÂentry“that“closes,“gets“rÑðeset,“or“stays“idle“too“long“normally“getsŽ¤ ‘0ršÑðeplaced–Äjwith“new“connections.“However‘ÿB,“if“ther˜e“ar˜e“too“many“of“these,“active“con-Ž¡‘0nections–€may“become“interspersed“among“closed,“rÑðeset,“or“idle“entries.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (728) cvn H.B /DEST pdfmark endŸ.‘0IPT‘ÿ raf–ecan“be“set“to“automatically“ršÑðemove“all“closed,“r˜eset,“and“idle“entries“with“theŽ¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (729) cvn H.B /DEST pdfmark endÅTCP›Ð^closed/idle–Ðspersistence...“¾conguration“option.“Y‘ÿou“can“also“prÑðess“the“F˜key“to“im-Ž¡‘0mediately–€clear“them“at“any“time.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (730) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (732) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–O#ÏThe“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (733) cvn H.B /DEST pdfmark endó8áÚŽ phvro8tãTCP‘Otimeout...“Ïoption“only“tells“IPT‘þëˆrèöaf“hoÝvw“long“it“should“takÑîe“befºåore“a“connec-Ž¤ æf‘Dtion–óshould“be“considered“idle“and“open“to“replacement“bšÑîy“ne˜w“connectionsÝv.“This“doesŽ¡‘Dnot–£šdeter9™mine“hošÝvw“long“it“remains“on-screen.“The“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (734) cvn H.B /DEST pdfmark endãTCP‘£‘closed/idle“persistence˜...“Ïparèöam-Ž¡‘Deter–jÕushes“entr"‰ies“that“haÑîvÆfe“been“idle“fºåor“the“nšèöumber“of“min˜utes“dened“bÑîy“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (735) cvn H.B /DEST pdfmark endãTCPŽ¡‘Dtimeout...‘€}Ïoption.Ž¦Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (736) cvn H.B /DEST pdfmark endŸ!O\ÌSor=ïting–]TCP“Entriesïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (5.14.6.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (738) cvn H.B /DEST pdfmark endŸNБ0¾The–àTCP›¾connection“entries“can“be“sorted“by“prÑðessing“the“S˜key‘þã×,“then“by“selecting“aŽ¤ ‘0sort–Æþcriterion.“PršÑðessing“S‘Æëwill“display“a“box“showing“the“available“sort“criteria.“Pr˜essŽ¡‘0P›¡Åto–¡Îsort“by“packet“count,“B˜to“sort“by“byte“count.“PrÑðessing“any“other“key“cancels“theŽ¡‘0sort.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (739) cvn H.B /DEST pdfmark endŸ Èø‘0The–.^sort“operation“comparšÑðes“the“lar˜ger“values“in“each“connection“entry“pair“and“sortsŽ¡‘0the–€counts“in“descending“orÑðder‘ÿB.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (740) cvn H.B /DEST pdfmark endŸ.‘0Over–_§time,“the“entries“will“go“out“of“oršÑðder“as“counts“pr˜oceed“at“varying“rates.“SortingŽ¡‘0is–€not“done“automatically“so“as“not“to“degrade“performance“and“accuracy‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (741) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (743) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï?PSfile="iptraf-iptmsort.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸ¦‘0ÄFigure–€3-2.“The“IP“trac“monitor“sort“criteriaŽŽŸ0‘`ïcolor push Black’šÅ25ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;`õ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.26) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (814) cvn H.B /DEST pdfmark endŸfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (LOWERWIN) cvn H.B /DEST pdfmark endŸ ÇLo•Ììwer‘³6Windo“wïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (5.15.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (746) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–ƒÔlower“window“displays“information“about“the“other“types“of“trac“on“your“net-ŽŸ ‘0work.–€The“following“pršÑðotocols“ar˜e“detected“internally:Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (747) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (748) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (749) cvn H.B /DEST pdfmark end¾User–€Datagram“PrÑðotocol“(UDP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (750) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (751) cvn H.B /DEST pdfmark end¾Internet–€ContršÑðol“Message“Pr˜otocol“(ICMP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (752) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (753) cvn H.B /DEST pdfmark end¾Open–€Shortest-Path“First“(OSPF)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (754) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (755) cvn H.B /DEST pdfmark end¾Interior–€Gateway“Routing“PrÑðotocol“(IGRP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (756) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (757) cvn H.B /DEST pdfmark end¾Interior–€Gateway“PrÑðotocol“(IGP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (758) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (759) cvn H.B /DEST pdfmark end¾Internet–€GršÑðoup“Management“Pr˜otocol“(IGMP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (760) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (761) cvn H.B /DEST pdfmark end¾General–€Routing“Encapsulation“(GRE)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (762) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (763) cvn H.B /DEST pdfmark end¾Layer–€2“T‘ÿ unneling“PrÑðotocol“(L2TP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (764) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (765) cvn H.B /DEST pdfmark end¾IPSec–€AH“and“ESP“prÑðotocols“(IPSec“AH“and“IPSec“ESP)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (766) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (767) cvn H.B /DEST pdfmark end¾AddršÑðess–€Resolution“Pr˜otocol“(ARP)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (768) cvn H.B /DEST pdfmark end¤ç°‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (769) cvn H.B /DEST pdfmark end¾Reverse–€AddršÑðess“Resolution“Pr˜otocol“(RARP)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (770) cvn H.B /DEST pdfmark end¡‘0Other–ÔIP‘ÃApršÑðotocols“ar˜e“looked“up“fr˜om“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (771) cvn H.B /DEST pdfmark endÈ/etc/services“¾le.“If“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (772) cvn H.B /DEST pdfmark endÈ/etc/servicesŽŸ ‘0¾doesn't–€contain“information“about“that“pršÑðotocol,“the“pr˜otocol“number“is“indicated.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (773) cvn H.B /DEST pdfmark end¦‘0Non-IP–€packets“arÑðe“indicated“as“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (774) cvn H.B /DEST pdfmark endÈNon-IP“¾in“the“lower“window‘ÿ.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (775) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (777) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–reÏThe“source“and“destination“addresses“fºåor“ARP›r'and“RARP˜entr"‰ies“are“MAºåC˜ad-Ž¤ æf‘DdressesÝv.ŽŸzïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (778) cvn H.B /DEST pdfmark endŸ Ëì‘DStr"‰ictly–@•speaking,“ARP›@dand“RARP˜pac•Ñîk“ets–@•aren't“IP˜pac•Ñîk“etsÝv,–@•since“theÑîy“are“not“encap-Ž¡‘Dsulated– ³in“an“IP‘ datag•èör“am.– ³ThešÑîy'ŒÌre“just“indicated“because“the˜y“are“integ•èör“al– ³to“proper“IPŽ¡‘Doperèöation–€}on“LANsÝv.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (779) cvn H.B /DEST pdfmark end¤ ‘0¾For–Aõall“packets“in“the“lower“window‘ÿ,“only“the“rst“IP‘Aåfragment“is“indicated“(since“thatŽ¡‘0contains–ithe“header“of“the“IP-encapsulated“prÑðotocol)“but“with“no“further“informationŽ¡‘0fršÑðom–€the“encapsulated“pr˜otocol.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (780) cvn H.B /DEST pdfmark end¦‘0UDP›¶úpackets–·JarÑðe“also“displayed“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (781) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (782) cvn H.B /DEST pdfmark endÉaddressÈ:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (783) cvn H.B /DEST pdfmark endÉport“¾format“while“ICMP˜entries“alsoŽ¡‘0contain–]?the“ICMP‘]message“type.“For“easier“location,“each“type“of“pršÑðotocol“is“color˜-Ž¡‘0coded–€(only“on“color“terminals“such“as“the“Linux“console).ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (784) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (786) cvn H.B /DEST pdfmark end¦‘0UDPŽ£7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (787) cvn H.B /DEST pdfmark end©Èø‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (788) cvn H.B /DEST pdfmark endRed–€on“WhiteŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (790) cvn H.B /DEST pdfmark endŸ Èø‘0ICMPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (791) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (792) cvn H.B /DEST pdfmark endY‘ÿellow–€on“BlueŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (794) cvn H.B /DEST pdfmark endŸ Èø‘0OSPFŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (795) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (796) cvn H.B /DEST pdfmark endBlack–€on“CyanŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (798) cvn H.B /DEST pdfmark endŸ.‘0IGRPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (799) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (800) cvn H.B /DEST pdfmark endBright–€white“on“CyanŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (802) cvn H.B /DEST pdfmark endŸ.‘0IGPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (803) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (804) cvn H.B /DEST pdfmark endRed–€on“CyanŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (806) cvn H.B /DEST pdfmark endŸ.‘0IGMPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (807) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (808) cvn H.B /DEST pdfmark endBright–€grÑðeen“on“BlueŽŽŸ0‘`ïcolor push BlackÅ26ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;yƒ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.27) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (862) cvn H.B /DEST pdfmark endŸfd’ZÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (810) cvn H.B /DEST pdfmark endŸ ‘0¾GREŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (811) cvn H.B /DEST pdfmark endŸÈø‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (812) cvn H.B /DEST pdfmark endBlue–€on“whiteŽŸ‘0ARPŽ£«ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (815) cvn H.B /DEST pdfmark end©øU‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (816) cvn H.B /DEST pdfmark endBright–€white“on“RedŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (818) cvn H.B /DEST pdfmark endŸ.‘0RARPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (819) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (820) cvn H.B /DEST pdfmark endBright–€white“on“RedŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (822) cvn H.B /DEST pdfmark endŸ.‘0Other‘€IPŽ£7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (823) cvn H.B /DEST pdfmark end©Èø‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (824) cvn H.B /DEST pdfmark endY‘ÿellow–€on“rÑðedŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (826) cvn H.B /DEST pdfmark endŸ Èø‘0Non-IPŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (827) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (828) cvn H.B /DEST pdfmark endY‘ÿellow–€on“RedŽ©7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (829) cvn H.B /DEST pdfmark endŸ Èø‘0The–‹lower“window“can“hold“up“to“512“entries.“Y‘ÿou“can“scrÑðoll“the“lower“window“by“us-Ž¤ ‘0ing–[ƒthe“W‘[zkey“to“move“the“Active“indicator“to“it,“and“by“using“the“Up“and“Down“curÑð-Ž¡‘0sor–ózkeys.“The“lower“window“automatically“scrÑðolls“every“time“a“new“entry“is“added,Ž¡‘0and–8ëeither“the“rst“entry“or“last“entry“is“visible.“Upon“rÑðeaching“512“entries,“old“entriesŽ¡‘0ar•Ñðe›€thr“own˜out˜as˜new˜entries˜ar“e˜added.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (830) cvn H.B /DEST pdfmark endŸ Èø‘0Some–‚entries“may“be“too“long“to“completely“t“in“a“scrÑðeen“line.“Y‘ÿou“can“use“theŽ¡‘0Left– Uand“Right“cursor“keys“to“vertically“scrÑðoll“the“lower“window“when“it“is“markedŽ¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (831) cvn H.B /DEST pdfmark endÈActive¾.–4]If“your“terminal“can“be“ršÑðesized“(e.g.“xterm),“you“may“do“so“befor˜e“startingŽ¡‘0IPT‘ÿ raf.ŽŸ«ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (832) cvn H.B /DEST pdfmark endŸ øU‘0Entries–| for“packets“ršÑðeceived“on“LAN‘|interfaces“also“include“the“sour˜ce“MAC‘|addr˜essŽ¡‘0of–Gthe“LAN‘*host“which“deliveršÑðed“it.“This“behavior“is“enabled“by“turning“on“the“Sour˜ceŽ¡‘0MAC–€addrs“in“trac“monitor“toggle“in“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (833) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongurÑðe...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘2¾menu.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (835) cvn H.B /DEST pdfmark endŸ§ÌEntrøy‘]Detailsïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (5.15.7.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (837) cvn H.B /DEST pdfmark endŸ~Б0¾In–kŸgeneral,“the“entries“in“the“lower“window“indicate“the“prÑðotocol,“the“IP‘kcdatagramŽ¡‘0size–]o(full“frame“size“for“non-IP‘þµÇ,“including“ARP‘]6and“RARP),“the“souršÑðce“addr˜ess,“theŽ¡‘0destination–: addrÑðess,“and“the“network“interface“the“packet“was“detected“on.“However‘ÿB,Ž¡‘0some–€pršÑðotocols“have“a“little“mor˜e“information.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (838) cvn H.B /DEST pdfmark endŸ‡²‘0ÍICMPïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (5.15.7.4.3) cvn H.B /DEST pdfmark endŽŸ£.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (840) cvn H.B /DEST pdfmark endŸ ÜÒ‘0¾ICMP–€entries“arÑðe“displayed“in“this“format:ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (841) cvn H.B /DEST pdfmark endŸ~‘0ÈICMP–ffïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (842) cvn H.B /DEST pdfmark endÉtype“È[(ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (843) cvn H.B /DEST pdfmark endÉsubtypeÈ)]“(ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (844) cvn H.B /DEST pdfmark endÉsize“Èbytes)“from“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (845) cvn H.B /DEST pdfmark endÉsource“Èto“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (846) cvn H.B /DEST pdfmark endÉdestinationŽŸ æf‘0È[(src–ffHWaddr“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (847) cvn H.B /DEST pdfmark endÉsrcMACaddressÈ)]“on“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (848) cvn H.B /DEST pdfmark endÉinterfaceŽŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (849) cvn H.B /DEST pdfmark endŸ òs‘0¾wherÑðe–€type“could“be“any“of“the“following:Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (850) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (852) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (853) cvn H.B /DEST pdfmark end©.‘0Èecho–ffreq,“echo“rplyŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (854) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (855) cvn H.B /DEST pdfmark end–ã¾ICMP‘€echo“ršÑðequest“and“r˜eply‘þã×.“Usually“used“by“the“ping“pr˜ogram“and“otherŽ¡‘Dnetwork–€monitoring“and“diagnostic“prÑðogram.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (857) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (858) cvn H.B /DEST pdfmark end¦‘0Èdest‘ffunrchŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (859) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (860) cvn H.B /DEST pdfmark end–(¡¾ICMP‘(‹destination“unršÑðeachable.“Something“failed“to“r˜each“its“tar˜get.“The“dest“un-Ž¡‘DršÑðeach–‡Étype“is“supplemented“with“a“further“indicator“of“the“pr˜oblem.“DestinationŽŽŸ0‘`ïcolor push Black’™úèÅ27ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;¤‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.28) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (939) cvn H.B /DEST pdfmark endŸfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¤¾unršÑðeachable–eÍmessages“for“TCP‘eÆtrac“causes“the“corr˜esponding“TCP‘eÆentry“in“theŽ¤ ’¤upper–€window“to“be“made“available“for“rÑðeuse“by“new“connections.ŽŸ’ÈredirctŽ‘`ž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (864) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (865) cvn H.B /DEST pdfmark end›gT¾ICMP‘gNr•Ñðedir“ect.˜Usually˜generated˜by˜a˜r“outer˜to˜tell˜a˜host˜that˜a˜better˜gatewayŽ¡‘Dis‘€available.Ž© 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (867) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (868) cvn H.B /DEST pdfmark endŸ Èø‘0Èsrc‘ffqnchŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (869) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (870) cvn H.B /DEST pdfmark end–g)¾The“ICMP‘físouršÑðce“quench“is“used“to“stop“a“host“fr˜om“transmitting.“It's“a“owŽ¡‘DcontrÑðol–€mechanism“for“IP‘þµÇ.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (872) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (873) cvn H.B /DEST pdfmark endŸ Èø‘0Ètime‘ffexcdŽ¨0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (874) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (875) cvn H.B /DEST pdfmark end–†¾Indicates“a“packet's“time-to-live“value“expiršÑðed“befor˜e“it“got“to“its“destination.Ž¡‘DMostly–k;happens“if“a“destination“is“too“far“away‘þã×.“Also“used“by“the“traceršÑðoute“pr˜o-Ž¡‘Dgram.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (877) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (878) cvn H.B /DEST pdfmark endŸ.‘0Èrouter‘ffadvŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (879) cvn H.B /DEST pdfmark end¤Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (880) cvn H.B /DEST pdfmark end–€¾ICMP“rÑðouter“advertisementŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (882) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (883) cvn H.B /DEST pdfmark endŸ Èø‘0Èrouter‘ffsolŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (884) cvn H.B /DEST pdfmark end¡‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (885) cvn H.B /DEST pdfmark end–€¾ICMP“rÑðouter“solicitationŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (887) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (888) cvn H.B /DEST pdfmark endŸ Èø‘0Ètimestmp‘ffreqŽ¤i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (889) cvn H.B /DEST pdfmark end©–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (890) cvn H.B /DEST pdfmark end–€¾ICMP“timestamp“rÑðequestŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (892) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (893) cvn H.B /DEST pdfmark endŸ.‘0Ètimestmp‘ffrepŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (894) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (895) cvn H.B /DEST pdfmark end–€¾ICMP“timestamp“rÑðeplyŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (897) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (898) cvn H.B /DEST pdfmark endŸ.‘0Èinfo‘ffreqŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (899) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (900) cvn H.B /DEST pdfmark end–€¾ICMP“information“rÑðequestŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (902) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (903) cvn H.B /DEST pdfmark endŸ.‘0Èinfo‘ffrepŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (904) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (905) cvn H.B /DEST pdfmark end–€¾ICMP“information“rÑðeplyŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (907) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (908) cvn H.B /DEST pdfmark endŸ.‘0Èaddr–ffmask“reqŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (909) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (910) cvn H.B /DEST pdfmark end–€¾ICMP“addršÑðess“mask“r˜equestŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (912) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (913) cvn H.B /DEST pdfmark endŸ.‘0Èaddr–ffmask“repŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (914) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (915) cvn H.B /DEST pdfmark end–€¾ICMP“addršÑðess“mask“r˜eplyŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (917) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (918) cvn H.B /DEST pdfmark endŸ.‘0Èparam‘ffprobŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (919) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (920) cvn H.B /DEST pdfmark end–€¾ICMP“parameter“prÑðoblemŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (922) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (923) cvn H.B /DEST pdfmark end¤.‘0Èbad/unknownŽŸµÿïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (924) cvn H.B /DEST pdfmark endŸJ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (925) cvn H.B /DEST pdfmark end–€¾An“unršÑðecognized“ICMP“packet“was“r˜eceived,“or“the“packet“is“corrëˆupted.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (926) cvn H.B /DEST pdfmark end¡‘0The–×%destination“unršÑðeachable“message“also“includes“information“on“the“type“of“err˜orŽŸ ‘0encounter•Ñðed.›€Her“e˜ar“e˜the˜destination˜unr“eachable˜codes:Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (927) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (929) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (930) cvn H.B /DEST pdfmark endŸ Èø‘0ÈntwkŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (931) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (932) cvn H.B /DEST pdfmark end–€¾network“unrÑðeachableŽŽŸ0‘`ïcolor push BlackÅ28ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;È‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.29) cvn H.B /DEST pdfmark endï color popŸüfd’ZÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (934) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (935) cvn H.B /DEST pdfmark endŸ ‘0ÈhostŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (936) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (937) cvn H.B /DEST pdfmark end–€¾host“unrÑðeachableŽŸ‘0ÈprotoŽ¤i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (941) cvn H.B /DEST pdfmark end©–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (942) cvn H.B /DEST pdfmark end–€¾pršÑðotocol“unr˜eachableŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (944) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (945) cvn H.B /DEST pdfmark endŸ.‘0ÈportŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (946) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (947) cvn H.B /DEST pdfmark end–€¾port“unrÑðeachableŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (949) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (950) cvn H.B /DEST pdfmark endŸ.‘0Èpkt‘fffltrdŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (951) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (952) cvn H.B /DEST pdfmark end–€¾packet“lteršÑðed“(normally“by“an“access“rëˆule“on“a“r˜outer“or“r˜ewall)ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (954) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (955) cvn H.B /DEST pdfmark endŸ.‘0ÈDF‘ffsetŽ£0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (956) cvn H.B /DEST pdfmark end©Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (957) cvn H.B /DEST pdfmark end–¾the“packet“has“to“be“fragmented“somewherÑðe,“but“its“don't“fragment“(DF)‘mbit“isŽŸ ‘Dset.ŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (959) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (960) cvn H.B /DEST pdfmark endŸ Èø‘0Èsrc–ffrte“failŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (961) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (962) cvn H.B /DEST pdfmark end–€¾souršÑðce“r˜oute“failedŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (964) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (965) cvn H.B /DEST pdfmark endŸ Èø‘0Èsrc‘ffisltdŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (966) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (967) cvn H.B /DEST pdfmark end–€¾sourÑðce“isolated“(obsolete)ŽŸ Pïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (969) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (970) cvn H.B /DEST pdfmark endŸç°‘0Ènet–ffcomm“deniedŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (971) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (972) cvn H.B /DEST pdfmark end–€¾network“communication“deniedŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (974) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (975) cvn H.B /DEST pdfmark endŸ Èø‘0Èhost–ffcomm“deniedŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (976) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (977) cvn H.B /DEST pdfmark end–€¾host“communication“deniedŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (979) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (980) cvn H.B /DEST pdfmark endŸ Èø‘0Ènet–ffunrch“for“TOSŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (981) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (982) cvn H.B /DEST pdfmark end–€¾network“unrÑðeachable“for“specied“IP“type-of-serviceŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (984) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (985) cvn H.B /DEST pdfmark endŸ.‘0Èhost–ffunrch“for“TOSŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (986) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (987) cvn H.B /DEST pdfmark end–€¾host“unrÑðeachable“for“specied“IP“type-of-serviceŽ¤ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (989) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (990) cvn H.B /DEST pdfmark end©.‘0Èprec‘ffvioltnŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (991) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (992) cvn H.B /DEST pdfmark end–€¾prÑðecedence“violationŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (994) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (995) cvn H.B /DEST pdfmark end¦‘0Èprec‘ffcutoffŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (996) cvn H.B /DEST pdfmark endŸ–I‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (997) cvn H.B /DEST pdfmark end–€¾prÑðecedence“cutoŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (999) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1000) cvn H.B /DEST pdfmark end¦‘0Èdest–ffnet“unknŽ£0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1001) cvn H.B /DEST pdfmark end©Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1002) cvn H.B /DEST pdfmark end–€¾destination“network“unknownŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1004) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1005) cvn H.B /DEST pdfmark endŸ Èø‘0Èdest–ffhost“unknŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1006) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1007) cvn H.B /DEST pdfmark end–€¾destination“network“unknownŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1008) cvn H.B /DEST pdfmark endŸ Èø‘0For–€morÑðe“information“on“ICMP‘þµÇ,“see“RFC“792.ŽŸ£Óïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1009) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’šÅ29ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;ï\‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.30) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’ÍOSPFïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (5.15.7.5.3) cvn H.B /DEST pdfmark endŽ‘`Ÿ£.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1011) cvn H.B /DEST pdfmark endŸ ÜÒ‘0¾OSPF›ëmessages–also“include“a“little“morÑðe“information.“The“format“of“an“OSPF˜mes-Ž¤ ‘0sage–€in“the“window“is:Ž© Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1012) cvn H.B /DEST pdfmark endŸ~‘0ÈOSPF–ffïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1013) cvn H.B /DEST pdfmark endÉtype“È(a=ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1014) cvn H.B /DEST pdfmark endÉarea“Èr=ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1015) cvn H.B /DEST pdfmark endÉrouterRñÈ)“(ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1016) cvn H.B /DEST pdfmark endÉsizeÈbytes)“from“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1017) cvn H.B /DEST pdfmark endÉsource“Èto“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1018) cvn H.B /DEST pdfmark endÉdestinationŽŸ æf‘0È[(src–ffHWaddr“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1019) cvn H.B /DEST pdfmark endÉsrcMACaddressÈ)]“on“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1020) cvn H.B /DEST pdfmark endÉinterfaceŽŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1021) cvn H.B /DEST pdfmark endŸ òs‘0¾The–€type“can“be“one“of“the“following:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1022) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1024) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1025) cvn H.B /DEST pdfmark endŸ.‘0ÈhloŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1026) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1027) cvn H.B /DEST pdfmark end– Û¾OSPF› ·hello.“Hello“messages“establish“OSPF˜communications“and“keep“rÑðoutersŽ¡‘Dinformed–€of“each“other‘½p's“prÑðesence.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1029) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1030) cvn H.B /DEST pdfmark end¤.‘0ÈDB‘ffdescŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1031) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1032) cvn H.B /DEST pdfmark end–€¾OSPF“Database“DescriptionŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1034) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1035) cvn H.B /DEST pdfmark end¡‘0ÈLSRŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1036) cvn H.B /DEST pdfmark endŸÏ ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1037) cvn H.B /DEST pdfmark end–€¾OSPF“Link“State“RequestŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1039) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1040) cvn H.B /DEST pdfmark end¡‘0ÈLSUŽ£0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1041) cvn H.B /DEST pdfmark end©Ï ‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1042) cvn H.B /DEST pdfmark end–M!¾OSPF›LìLink“State“Update.“Messages“indicating“the“states“of“the“OSPF˜networkŽŸ ‘DlinksŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1044) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1045) cvn H.B /DEST pdfmark endŸ Èø‘0ÈLSAŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1046) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1047) cvn H.B /DEST pdfmark end–€¾OSPF“Link“State“AcknowledgmentŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1048) cvn H.B /DEST pdfmark end¤.‘0The–€entries“in“parÑðentheses:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1049) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1051) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1052) cvn H.B /DEST pdfmark end¡‘0Èa=ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1053) cvn H.B /DEST pdfmark endÉareaŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1054) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1055) cvn H.B /DEST pdfmark end–€¾The“arÑðea“number“of“the“OSPF“messageŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1057) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1058) cvn H.B /DEST pdfmark end¡‘0Èr=ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1059) cvn H.B /DEST pdfmark endÉrouterŽž0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1060) cvn H.B /DEST pdfmark end¦‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1061) cvn H.B /DEST pdfmark end–_¥¾The“IP‘_addršÑðess“of“the“r˜outer“that“generated“the“message.“It“is“not“necessarily“theŽ© ‘Dsame–€as“the“souršÑðce“addr˜ess“of“the“encapsulating“IP“packet.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1062) cvn H.B /DEST pdfmark end¡‘0Many–¹„times,“the“destination“addršÑðesses“for“OSPF‘¹3packets“ar˜e“class“D‘¹3multicast“ad-Ž¦‘0dršÑðesses–sin“standar˜d“dotted“decimal“notation“or“(if“r˜everse“lookup“is“enabled),“hostsŽ¦‘0under–€the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1063) cvn H.B /DEST pdfmark endÈMCAST.NET“¾domain.“Such“multicast“addršÑðesses“ar˜e“dened“as“follows:Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1064) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1066) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1067) cvn H.B /DEST pdfmark end¤ Èø‘0È224.0.0.5‘ff(OSPF-ALL.MCAST.NET)Ž© ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1068) cvn H.B /DEST pdfmark endŸòs‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1069) cvn H.B /DEST pdfmark end¾OSPF–€all“rÑðoutersŽŸ 7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1071) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1072) cvn H.B /DEST pdfmark end¡‘0È224.0.0.6‘ff(OSPF-DSIG.MCAST.NET)Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1073) cvn H.B /DEST pdfmark endŸòs‘0ïcolor push Black‘€ï color popŽŽ‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1074) cvn H.B /DEST pdfmark end¾OSPF–€all“designated“rÑðoutersŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1075) cvn H.B /DEST pdfmark endŸ.‘0See–€RFC“1247“for“details“on“the“OSPF“prÑðotocol.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1076) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push BlackÅ30ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;~‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.31) cvn H.B /DEST pdfmark endï color popŸüfd’ZÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš‘`ÇAdÝîditional‘³6Inf»Þormationïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (5.16.1) cvn H.B /DEST pdfmark endŽ‘`ŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1078) cvn H.B /DEST pdfmark endŸ Õn‘0¾When–÷ started“frÑðom“the“main“menu“and“logging“is“enabled,“the“IP‘ö«trac“monitorŽ¤ ‘0prÑðompts–Àyou“for“a“log“le“name.“The“default“name“is“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1079) cvn H.B /DEST pdfmark endÈip_traffic-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1080) cvn H.B /DEST pdfmark endÉnÈ.log–ff(where“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1081) cvn H.B /DEST pdfmark endÉnŽ¡‘0¾is–wzwhat“instance“of“the“trac“monitor“this“is“(1,“2,“3,“and“so“on).“(e.g.“if“this“is“the“rstŽ¡‘0instance,–€the“default“le“name“will“be“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1082) cvn H.B /DEST pdfmark endÈip_traffic-1.log¾.)ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1083) cvn H.B /DEST pdfmark endŸç°‘0When–V3started“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1084) cvn H.B /DEST pdfmark endÈ-i“¾parameter‘ÿB,“the“log“lename“can“be“specied“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1085) cvn H.B /DEST pdfmark endÈ-LŽ¡‘0¾parameter‘ÿB.–€See“the“ïcolor push gray 0ïps:SDict begin H.S endCommand-line“Parametersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘|?²section“above“for“morÑðe“information.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1087) cvn H.B /DEST pdfmark endŸ.‘0On–gbusy“networks,“the“display“may“become“clutteršÑðed“with“trac“you'r˜e“not“inter˜-Ž¡‘0ested–}…in.“T‘ÿo“contrÑðol“the“trac“monitor‘½p's“output,“you“can“apply“a“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1088) cvn H.B /DEST pdfmark endÅlter¾.“See“Chapter“7,Ž¡‘0ïcolor push gray 0ïps:SDict begin H.S endFiltersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (FILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘N”for–€morÑðe“information“on“IPT‘ÿ raf‘ŒÈ's“lters.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1090) cvn H.B /DEST pdfmark endŸ Èø‘0At–©Éany“time,“you“can“prÑðess“X›©¿or“Q˜to“rÑðeturn“to“the“main“menu“(or“back“to“the“shell“ifŽ¡‘0the–€monitor“was“started“with“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1091) cvn H.B /DEST pdfmark endÄiptraf“-i¾).ŽŽŸ0‘`ïcolor push Black’šÅ31ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹ ;=­‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.32) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€3.“The“IP“T‘þã×rac“MonitorŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black32ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹!;Lk‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.33) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (NETSTATS) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï4.“Netwµork“Interface“Statisticsïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (6.0) cvn H.B /DEST pdfmark endŽŸWµïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1094) cvn H.B /DEST pdfmark endŸø*‘0¾Ther•Ñðe›×mar“e˜two˜network˜interface˜statistics˜facilities:˜the˜general˜interface˜statistics,Ž¤ ‘0which–%£displays“a“statistical“summary“of“all“attached“interfaces,“and“the“detailed“in-Ž¡‘0terface–X‰statistics,“which“shows“morÑðe“statistical“and“load“information“about“a“singleŽ¡‘0selected‘€interface.Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (GENSTATS) cvn H.B /DEST pdfmark endŸ"h·ÇGeneral–³6Interface“Statisticsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (6.17.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1097) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–кsecond“menu“option“displays“a“list“of“attached“network“interfaces,“and“someŽ¡‘0general–Ïrpacket“counts.“Specically‘þã×,“it“displays“counts“of“IP›þµÇ,“non-IP˜,“and“bad“IP‘Ï^pack-Ž¡‘0ets–”b(packets“with“IP‘”checksum“errÑðors).“It“also“includes“an“activity“indicator‘ÿB,“whichŽ¡‘0shows–%³the“number“of“kilobits“and“packets“the“interface“sees“per“second.“All“gurÑðesŽ¡‘0aršÑðe–%for“incoming“and“outgoing“packets.“(Again,“considering“pr˜omiscuous“mode“forŽ¡‘0LAN‘³interfaces,–ùwhich“simply“causes“the“machine“to“interÑðcept“all“packets).“This“isŽ¡‘0useful–q*for“general“monitoring“of“all“attached“interfaces.“If“byte“counts“and“additionalŽ¡‘0information–NŸarÑðe“needed“for“a“specic“interface,“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1098) cvn H.B /DEST pdfmark endÅDetailed“interface“statistics“¾option“isŽ¡‘0also‘€available.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1099) cvn H.B /DEST pdfmark endŸ Èø‘0The–)~activity“indicators“can“be“toggled“between“kbits/s“and“kbytes/s“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1100) cvn H.B /DEST pdfmark endÅActivityŽ¡‘0mode–€¾conguration“option.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1101) cvn H.B /DEST pdfmark endŸ.‘0The–(general“statistics“window“will“dynamically“add“new“entries“as“packets“frÑðomŽ¡‘0newly-cršÑðeated–üŸinterfaces“(e.g.“new“PPP‘üinterfaces)“ar˜e“inter˜cepted.“Long“lists“can“beŽ¡‘0scrÑðolled–€with“the“Up,“Down,“PgUp,“and“PgDn“keys.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1102) cvn H.B /DEST pdfmark end¤.‘0This–€monitor“is“aected“by“IPT‘ÿ raf‘ŒÈ's“ïcolor push gray 0ïps:SDict begin H.S endltersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (FILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘3as“described“in“Chapter“7.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1104) cvn H.B /DEST pdfmark end¡‘0Copies–jQof“the“statistics“aršÑðe“written“to“the“log“le“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1105) cvn H.B /DEST pdfmark endÈiface_stats_general.log“¾at“r˜egu-Ž¤ ‘0lar–intervals“if“logging“is“enabled.“See“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1106) cvn H.B /DEST pdfmark endÅLogging“¾option“int“the“ïcolor push gray 0ïps:SDict begin H.S endCongurationïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘C‚óchap-Ž¡‘0ter‘ÿB.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1108) cvn H.B /DEST pdfmark endŸ Èø‘0This–û%facility“can“be“started“diršÑðectly“fr˜om“the“command“line“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1109) cvn H.B /DEST pdfmark endÄ-g“¾option“toŽ¡‘0the–é¬ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1110) cvn H.B /DEST pdfmark endÄiptraf“¾command.“When“started“frÑðom“the“command“line,“the“log“lename“andŽ¡‘0log–Ïinterval“can“be“specied“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1111) cvn H.B /DEST pdfmark endÈ-L›g¾and“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1112) cvn H.B /DEST pdfmark endÈ-I˜¾parameters“rÑðespectively‘þã×.“See“theŽ¡‘0ïcolor push gray 0ïps:SDict begin H.S endCommand-line‘€Parametersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ’©¿²section–€above“for“morÑðe“information.Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1114) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1116) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï=PSfile="iptraf-gstat1.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€4-1.“The“general“interface“statistics“screenŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1117) cvn H.B /DEST pdfmark endŸp¨‘0¾Y‘ÿou–€can“pršÑðess“X“or“Q“to“r˜eturn“to“the“main“menu.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (DETSTATS) cvn H.B /DEST pdfmark endŸÒ1ÇDetailed–³6Interface“Statisticsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (6.18.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1120) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–mthiršÑðd“menu“option“displays“packet“statistics“for“any“selected“interface.“It“pr˜ovidesŽ¡‘0basically–÷¿the“same“information“as“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1121) cvn H.B /DEST pdfmark endÅGeneral“interface“statistics“¾option,“with“additionalŽŽŸ0‘`ïcolor push Black’šÅ33ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹";O‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.34) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1164) cvn H.B /DEST pdfmark endŸfdÅChapter–€4.“Network“Interface“StatisticsŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¾details.–€This“facility“prÑðovides“the“following“information:Ž‘`¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1122) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1123) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1124) cvn H.B /DEST pdfmark end–€¾T‘ÿotal“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1125) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1126) cvn H.B /DEST pdfmark end–€¾IP“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1127) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1128) cvn H.B /DEST pdfmark end–€¾TCP“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1129) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1130) cvn H.B /DEST pdfmark end–€¾UDP“packet“and“byte“countŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1131) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1132) cvn H.B /DEST pdfmark end–€¾ICMP“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1133) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1134) cvn H.B /DEST pdfmark end–€¾Other“IP-type“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1135) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1136) cvn H.B /DEST pdfmark end–€¾Non-IP“packet“and“byte“countsŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1137) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1138) cvn H.B /DEST pdfmark end–€¾Checksum“errÑðor“countŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1139) cvn H.B /DEST pdfmark endŸ Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1140) cvn H.B /DEST pdfmark end–€¾Interface“activityŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1141) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1142) cvn H.B /DEST pdfmark end–€¾BrÑðoadcast“packet“and“byte“countsŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1143) cvn H.B /DEST pdfmark end¦‘0All–håIP‘h©byte“counts“(IP›þµÇ,“TCP˜,“UDP˜,“ICMP˜,“other“IP)›h©include“IP˜header“data“and“pay-Ž¤ ‘0load.–fâThe“data“link“header“is“not“included.“The“full“frame“length“(including“data-linkŽ¡‘0header)–zÆis“included“in“the“non-IP‘zÅand“T‘ÿotal“byte“count.“All“data-link“headers“arÑðe“alsoŽ¡‘0included–€in“the“T‘ÿotal“byte“counts.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1144) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1146) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï=PSfile="iptraf-dstat1.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€4-2.“The“detailed“interface“statistics“screenŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1147) cvn H.B /DEST pdfmark endŸp¨‘0¾The–UAupper“portion“of“the“scrÑðeen“contains“the“packet“and“byte“counts“for“all“IP‘U andŽ¡‘0non-IP‘¸`packets–¸ninterÑðcepted“on“the“interface.“The“lower“portion“contains“the“total,“in-Ž¡‘0coming,–€and“outgoing“interface“data“rates.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1148) cvn H.B /DEST pdfmark end¦‘0This–Ø×facility“also“displays“incoming“and“outgoing“counts“and“data“rates.“The“packetŽ¡‘0size–<PSfile="iptraf-pktsize.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€5-1.“The“packet“size“statistical“breakdownŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1189) cvn H.B /DEST pdfmark endŸp¨‘0¾If–plogging“is“enabled,“copies“of“the“statistics“aršÑðe“written“at“r˜egular“intervals“to“a“logŽ¡‘0le.–«'The“default“log“le“name“is“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1190) cvn H.B /DEST pdfmark endÈpacket_size-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1191) cvn H.B /DEST pdfmark endÉifaceÈ.log“¾wherÑðe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1192) cvn H.B /DEST pdfmark endÊiface“¾is“the“se-Ž¡‘0lected–€interface“for“this“session“(for“example,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1193) cvn H.B /DEST pdfmark endÈpacket_size-eth0.log¾).Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1194) cvn H.B /DEST pdfmark end©.‘0IPT‘ÿ raf‘ŒÈ's–€lters“do“not“aect“this“facility‘þã×.Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1195) cvn H.B /DEST pdfmark end¦‘0The–îÀpacket“size“bršÑðeakdown“can“also“be“invoked“straight“fr˜om“the“command“line“byŽ¤ ‘0specifying–Сthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1196) cvn H.B /DEST pdfmark endÈ-z“¾iface“parameter‘ÿB.“The“interface“parameter“is“r•Ñðequir“ed.–СFor“example,Ž¡‘0this–€command“rëˆuns“the“facility“on“interface“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1197) cvn H.B /DEST pdfmark endÈeth0¾.ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1198) cvn H.B /DEST pdfmark endŸ~‘0Èiptraf–ff-z“eth0ŽŸ i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1199) cvn H.B /DEST pdfmark endŸ –I‘0¾When– started“frÑðom“the“command“line,“the“log“lename“and“log“interval“can“be“spec-Ž¡‘0ied–¶¥with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1200) cvn H.B /DEST pdfmark endÈ-L›¶—¾and“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1201) cvn H.B /DEST pdfmark endÈ-I˜¾parameters“rÑðespectively‘þã×.“See“the“ïcolor push gray 0ïps:SDict begin H.S endCommand-line‘€Parametersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡‘0section–€above“for“morÑðe“information.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1203) cvn H.B /DEST pdfmark endŸ Èø‘0T‘ÿo–€exit,“prÑðess“X“or“Ctrl+X.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (SERVMON) cvn H.B /DEST pdfmark endŸÒ1ÇTCP–³6and“UDP“T‘þïorac“Statisticsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (7.20.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1206) cvn H.B /DEST pdfmark endŸ Õn‘0¾IPT‘ÿ raf–)Üalso“includes“a“facility“that“generates“statistics“on“TCP›)°and“UDP˜trac.“ThisŽ¡‘0facility–šdisplays“counts“of“all“TCP›šand“UDP˜packets“with“sourÑðce“or“destination“portsŽ¡‘0numberšÑðed–¸jless“than“1024.“Ports“1“to“1023“ar˜e“r˜eserved“for“the“TCP/IP‘¸applicationŽ¡‘0prÑðotocols–€(well-known“ports).ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1207) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’™úèÅ37ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹&;¡G‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.38) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1230) cvn H.B /DEST pdfmark endŸfdÅChapter–€5.“Statistical“BrÑðeakdownsŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1209) cvn H.B /DEST pdfmark endŸHE‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï=PSfile="iptraf-tcpudp.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€5-2.“The“TCP/UDP“service“monitorŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1210) cvn H.B /DEST pdfmark endŸp¨‘0¾The–'Kstatistics“window“indicates“the“prÑðotocol“(TCP‘'4or“UDP),“the“port“number‘ÿB,“the“totalŽ¤ ‘0packets–Wïand“bytes“counted“for“this“particular“prÑðotocol/port“combination,“the“packetsŽ¡‘0and–"tbytes“destined“for“that“pršÑðotocol“and“port,“and“the“packets“and“bytes“coming“fr˜omŽ¡‘0that–€prÑðotocol“and“port.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1211) cvn H.B /DEST pdfmark endŸ.‘0Byte–ùïcounts“include“the“IP‘ùÐheader“and“payload“only‘þã×.“The“data“link“header“is“not“in-Ž¡‘0cluded.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1212) cvn H.B /DEST pdfmark endŸ Èø‘0The–›ÅpršÑðotocol/port“indicators“ar˜e“color˜-coded“for“easier“identication“on“color“termi-Ž¡‘0nals.–€TCP“indicators“aršÑðe“in“yellow‘ÿ,“UDP“in“bright“gr˜een.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1213) cvn H.B /DEST pdfmark endŸ.‘0Some–Ýânetwork“applications“or“prÑðotocols“may“use“port“numbers“higher“than“1023.Ž¡‘0Examples–jof“these“include“application“pršÑðoxy“servers“(HTTP‘Cpr˜oxy“servers“typicallyŽ¡‘0use–,àvalues“like“8000,“8080,“8888,“and“the“like),“and“IRC–,Ë(IRC“servers–,àcommonly“acceptŽ¡‘0connections–øon“ports“6660“to“6669).“These“ports“arÑðe“by“default“not“included“in“theŽ¡‘0counts.–)hIf“you“do“want“to“include“a“higher•Ñð-number“ed–)hport“in“the“statistics,“you“canŽ¡‘0add–Ö­them“yourself“fršÑðom“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1214) cvn H.B /DEST pdfmark endïcolor push gray 0ïps:SDict begin H.S endÅCongur˜e...ïps:SDict begin 11 H.L endïlps:SDict begin [ /Subtype /Link /Dest (CONFIG) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘/œ/Additional“ports...“¾menu“item.“See“the“sectionŽ¡‘0below‘ÿ.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1216) cvn H.B /DEST pdfmark endŸ Èø‘0If–¡[logging“is“enabled,“The“statistics“arÑðe“also“written“to“a“log“le“(the“default“nameŽ¡‘0is–•ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1217) cvn H.B /DEST pdfmark endÈtcp_udp_services-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1218) cvn H.B /DEST pdfmark endÉifaceÈ.log¾,“wherÑðe“iface“is“the“selected“interface“(for“example,Ž¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1219) cvn H.B /DEST pdfmark endÈtcp_udp_services-eth0.log¾).ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1220) cvn H.B /DEST pdfmark endŸç°‘0IPT‘ÿ raf–³computes“the“total,“incoming,“outgoing,“and“data“rates“of“the“pršÑðotocol“cur˜-Ž¡‘0ršÑðently–í0indicated“by“the“facility's“highlight“bar‘ÿB.“The“data“rates“ar˜e“indicated“at“theŽ¡‘0bottom–8¼of“the“scrÑðeen.“If“logging“is“enabled,“the“average“data“rates“since“the“start“ofŽ¡‘0the–€facility“arÑðe“placed“in“the“log“le.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1221) cvn H.B /DEST pdfmark endŸ.‘0The–1Up“and“Down“cursor“keys“move“the“highlight“bar‘ÿB.“PrÑðessing“X›0ýor“Ctrl+X˜exits“andŽ¡‘0ršÑðeturns–€to“the“main“menu“(or“the“shell“if“it“was“started“fr˜om“the“command“line).ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1222) cvn H.B /DEST pdfmark endŸJ?ÌSor=ïting–]TCP/UDP“Entriesïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (7.20.8.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1224) cvn H.B /DEST pdfmark endŸNБ0¾PrÑðessing–pthe“S‘p‰key“brings“up“a“window“which“allows“you“to“select“the“eld“by“whichŽ¡‘0the–äêentries“will“be“sorted.“Y‘ÿou“can“prÑðess“R›äÐto“sort“by“port,“P˜to“sort“by“total“packets,Ž¡‘0B›4@to–4osort“by“total“bytes,“T˜to“sort“by“incoming“packets“(packets“to),“O˜to“sort“by“in-Ž¡‘0coming–¹bytes“(bytes“to),“F›—to“sort“by“outgoing“packets“(packets“frÑðom)“and“M˜to“sortŽ¡‘0by–€outgoing“bytes“(bytes“fršÑðom).“Pr˜essing“any“other“key“cancels“the“sort.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1225) cvn H.B /DEST pdfmark endŸ.‘0Port–µnumbers“aršÑðe“sorted“in“ascending“or˜der“(least“rst)“but“statistics“ar˜e“sorted“inŽ¡‘0descending–€oršÑðder“(lar˜gest“counts“rst).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1226) cvn H.B /DEST pdfmark endŸ.‘0As–A®with“the“IP‘A|trac“monitor‘ÿB,“sorting“is“performed“only“with“this“sequence.“Auto-Ž¡‘0matic–€sorting“is“not“performed“so“as“not“to“aect“performance.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1227) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1229) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push BlackÅ38ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹';½‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.39) cvn H.B /DEST pdfmark endï color popŸüfd’Z ÅChapter–€5.“Statistical“BrÑðeakdownsŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýØE’ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateïAPSfile="iptraf-tcpudpsort.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ’ÄFigure–€5-3.“The“TCP/UDP“monitor‘ŒÈ'‘ÿs8s“sort“criteriaŽ‘`Ÿ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1230) cvn H.B /DEST pdfmark endŸÀÌAdáditional‘]InfÂormationïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (7.20.9.2) cvn H.B /DEST pdfmark endŽŸ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1232) cvn H.B /DEST pdfmark endŸ ÙM‘0¾IPT‘ÿ raf‘ŒÈ's–øõlters“aect“the“output“of“this“facility‘þã×.“See“Chapter“7,“ïcolor push gray 0ïps:SDict begin H.S endFiltersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (FILTERS) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽ‘!~for“moršÑðe“infor˜-Ž¤ ‘0mation–€about“lters.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1234) cvn H.B /DEST pdfmark endŸ Èø‘0If–E0you“wish“to“start“this“facility“frÑðom“the“command“line,“you“can“use“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1235) cvn H.B /DEST pdfmark endÈ-s“¾optionŽ¡‘0followed–€by“an“interface“to“monitor‘ÿB.“For“example,ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1236) cvn H.B /DEST pdfmark endŸ~‘0Èiptraf–ff-s“eth0ŽŸ i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1237) cvn H.B /DEST pdfmark endŸ –I‘0¾brings–ûRup“this“module“for“trac“on“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1238) cvn H.B /DEST pdfmark endÈeth0¾.“The“interface“must“be“specied,“or“IPT‘ÿ rafŽ¡‘0will–€drÑðop“back“to“the“shell.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1239) cvn H.B /DEST pdfmark endŸ.‘0When– started“frÑðom“the“command“line,“the“log“lename“and“log“interval“can“be“spec-Ž¡‘0ied–¶¥with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1240) cvn H.B /DEST pdfmark endÈ-L›¶—¾and“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1241) cvn H.B /DEST pdfmark endÈ-I˜¾parameters“rÑðespectively‘þã×.“See“the“ïcolor push gray 0ïps:SDict begin H.S endCommand-line‘€Parametersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡‘0section–€above“for“morÑðe“information.ŽŽŸ0‘`ïcolor push Black’šÅ39ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹(;× ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.40) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€5.“Statistical“BrÑðeakdownsŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black40ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹);å‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.41) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (HOSTMON) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï6.“LAN“Station“Statisticsïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (8.0) cvn H.B /DEST pdfmark endŽŸWµïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1245) cvn H.B /DEST pdfmark endŸø*‘0¾The–'\LAN‘'Estation“monitor“(Ethernet“station“monitor“on“versions“prior“to“1.3.0)“discov-Ž¤ ‘0ers–wMAC‘w‹addrÑðesses“and“displays“statistics“on“the“number“of“incoming,“and“outgoingŽ¡‘0packets.–x×It“also“includes“gurÑðes“for“incoming“and“outgoing“kilobits“per“second“forŽ¡‘0each–€discoverÑðed“station.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1246) cvn H.B /DEST pdfmark endŸ Èø‘0The–&entry“above“each“line“of“statistics“is“the“station's“LAN‘ type“(Ethernet,“PLIP‘þµÇ,“T‘ÿokenŽ¡‘0Ring,–c¾or“FDDI)›c„and“the“har•Ñðdwar“e‘c¾MAC˜addr“ess.–c¾Each“statistics“line“consists“of“theŽ¡‘0following‘€information:Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1247) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1248) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1249) cvn H.B /DEST pdfmark end¾T‘ÿotal–€packets“incomingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1250) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1251) cvn H.B /DEST pdfmark end¾IP–€packets“incomingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1252) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1253) cvn H.B /DEST pdfmark end¾T‘ÿotal–€bytes“incomingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1254) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1255) cvn H.B /DEST pdfmark end¾Incoming‘€rateŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1256) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1257) cvn H.B /DEST pdfmark end¾T‘ÿotal–€packets“outgoingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1258) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1259) cvn H.B /DEST pdfmark end¾IP–€packets“outgoingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1260) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1261) cvn H.B /DEST pdfmark end¾T‘ÿotal–€bytes“outgoingŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1262) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1263) cvn H.B /DEST pdfmark end¾Outgoing‘€rateŽ¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1264) cvn H.B /DEST pdfmark end¦‘0The– £byte“counts“include“the“data“link“header‘ÿB.“The“activity“indicators“can“be“set“toŽŸ ‘0display–€kbits/s“or“kbytes/s“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1265) cvn H.B /DEST pdfmark endÅActivity“mode“¾conguration“option.Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1266) cvn H.B /DEST pdfmark end¦‘0This–mfacility“works“only“for“Ethernet,“PLIP‘þµÇ,“T‘ÿoken“Ring,“and“FDDI‘mframes.“Loopback.Ž¤ ‘0ISDN,–€and“SLIP/PPP“networks“aršÑðe“not“monitor˜ed“her˜e.ŽŸ£Óïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1267) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1269) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï9PSfile="iptraf-hw.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€6-1.“The“LAN“station“monitorŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1270) cvn H.B /DEST pdfmark endŸp¨‘0¾Copies–^(of“the“statistics“aršÑðe“written“to“a“log“le“at“r˜egular“intervals“if“logging“is“en-Ž¡‘0abled.– §The“default“log“le“name“is“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1271) cvn H.B /DEST pdfmark endÈlan_statistics-ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1272) cvn H.B /DEST pdfmark endÉnÈ.log¾,“wherÑðe“n“is“the“instanceŽ¡‘0number–›´of“this“facility“(for“example,“if“this“is“the“rst“instance,“the“generated“defaultŽ¡‘0log–€le“name“is“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1273) cvn H.B /DEST pdfmark endÈlan_statistics-1.log¾).Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (SORTINGLAN) cvn H.B /DEST pdfmark endŸÍ×ÇSorD!ting–³6the“LAN“Station“Monitor“Entriesïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (8.21.1) cvn H.B /DEST pdfmark endŽŸ Éïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1276) cvn H.B /DEST pdfmark endŸ å‘0¾PrÑðess–ú¬S›úŒto“sort“the“entries.“A˜box“will“pop“up“and“display“the“keys“you“can“prÑðess“toŽ¡‘0select–éØthe“eld“by“which“the“entries“will“be“sorted.“PrÑðess“P‘é½to“sort“by“total“incomingŽ¡‘0packets,–³oI›³ato“sort“by“incoming“IP˜packets,“B˜to“sort“by“total“incoming“bytes,“K˜to“sortŽ¡‘0by–q¸total“outgoing“packets,“O›qyto“sort“by“outgoing“IP˜packets,“and“Y˜to“sort“by“totalŽ¡‘0outgoing–€bytes.“PrÑðessing“any“other“key“cancels“the“sort.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1277) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1279) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Blackïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1280) cvn H.B /DEST pdfmark endŸfd’šÅ41ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹*;çÀ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.42) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€6.“LAN“Station“StatisticsŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýØE’ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï=PSfile="iptraf-hwsort.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ’ÄFigure–€6-2.“The“LAN“station“monitor‘ŒÈ'‘ÿs8s“sort“criteriaŽŸ’¾When– started“frÑðom“the“command“line,“the“log“lename“and“log“interval“can“be“spec-Ž¤ ’ied–¶¥with“the“È-L›¶—¾and“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1282) cvn H.B /DEST pdfmark endÈ-I˜¾parameters“rÑðespectively‘þã×.“See“the“ïcolor push gray 0ïps:SDict begin H.S endCommand-line‘€Parametersïps:SDict begin 11 H.L endïmps:SDict begin [ /Subtype /Link /Dest (CMDLINE) cvn /H /I /Border [0 0 0] /Color [1 0 0] H.B /ANN pdfmark endï color popŽŽ¡’section–€above“for“morÑðe“information.Ž‘`Ÿ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïRps:SDict begin [ /View [/XYZ H.V] /Dest (MORELANMONINFO) cvn H.B /DEST pdfmark endŸ"mÇAdÝîditional‘³6Inf»Þormationïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (8.22.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1286) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–µ`window“can“be“scršÑðolled“with“the“Up“and“Down“cursor“keys.“Pr˜ess“X›µor“Q˜toŽ¡‘0rÑðeturn– ôto“the“main“menu“(or“the“shell“if“this“facility“was“started“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1287) cvn H.B /DEST pdfmark endÈ-l“¾command-Ž¡‘0line‘€option).ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1288) cvn H.B /DEST pdfmark endŸ.‘0The–€output“of“this“facility“is“aected“by“any“applied“IPT‘ÿ raf“lter‘ÿB.ŽŽŸ0‘`ïcolor push BlackÅ42ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹+;Ö‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.43) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (FILTERS) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï7.“FilterÇÑsïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïGps:SDict begin [ /View [/XYZ H.V] /Dest (9.0) cvn H.B /DEST pdfmark endŽŸWµïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1291) cvn H.B /DEST pdfmark endŸø*‘0¾Filters–ÅaršÑðe“used“to“contr˜ol“the“information“displayed“by“all“facilities.“Y‘ÿou“may“wantŽ¤ ‘0to–žview“statistics“only“on“particular“trac“so“you“must“rÑðestrict“the“information“dis-Ž¡‘0played.–€The“lters“also“apply“to“logging“activity‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1292) cvn H.B /DEST pdfmark endŸ.‘0The–€IPT‘ÿ raf“lter“management“system“is“accessible“thrÑðough“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1293) cvn H.B /DEST pdfmark endÅFilters...“¾submenu.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1294) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1296) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateïAPSfile="iptraf-filtermenu.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€7-1.“The“Filters“submenuŽŸXïps:SDict begin H.S endïps:SDict begin 11 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (IPFILTERS) cvn H.B /DEST pdfmark endŸ ÁÇIP‘³6FilterÌìsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1299) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–î*ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1300) cvn H.B /DEST pdfmark endÅFilters/IP‘þµÇ...“¾menu“option“allows“you“to“dene“a“set“of“rëˆules“that“determine“whatŽ¡‘0IP‘69trac–6hto“pass“to“the“monitors.“Selecting“this“option“pops“up“another“menu“withŽ¡‘0the–€tasks“used“to“dene“and“apply“custom“IP“lters.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1301) cvn H.B /DEST pdfmark end©ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1303) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï@PSfile="iptraf-ipfltmenu.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€7-2.“The“IP“lter“menuŽŸXïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1304) cvn H.B /DEST pdfmark endŸÀÌDening–]a“NeÑ‘w“Filterïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïMps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.10.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1306) cvn H.B /DEST pdfmark endŸNБ0¾A‘‡ÂfršÑðeshly–‡Äinstalled“pr˜ogram“will“have“no“lters“dened,“so“befor˜e“anything“else,“youŽ¡‘0will–€have“to“dene“a“lter›ÿB.“Y‘ÿou“can“do“this“by“selecting“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1307) cvn H.B /DEST pdfmark endÅDene“new“lter˜...“¾option.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1308) cvn H.B /DEST pdfmark endŸ.‘0Selecting–¨Ýthis“option“displays“a“box“asking“you“to“enter“a“short“description“of“theŽ¡‘0lter–þŒyou“aršÑðe“going“to“dene.“Just“enter“any“text“that“clearly“identies“the“natur˜e“ofŽ¡‘0the‘€lter‘ÿB.Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1309) cvn H.B /DEST pdfmark end¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1311) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Blackïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1312) cvn H.B /DEST pdfmark endŸfd’šÅ43ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹,;ô‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.44) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýØE’ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateïCPSfile="iptraf-ipfltnamedlg.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ’ÄFigure–€7-3.“The“IP“lter“name“dialogŽŸ’¾PršÑðess–gðEnter“when“you'r˜e“done“with“that“box.“As“an“alternative,“you“can“also“pr˜essŽ¤ ’Ctrl+X–€to“cancel“the“operation.Ž‘`©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1313) cvn H.B /DEST pdfmark endŸ‡²‘0ÍThe–ÒFilter“Rule“Selection“Screenïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.10.6.3) cvn H.B /DEST pdfmark endŽŸ£.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1315) cvn H.B /DEST pdfmark endŸ ÜÒ‘0¾After–!‹you“enter“the“lter‘½p's“description,“you“will“be“taken“to“a“blank“rëˆule“selection“box.Ž¡‘0At–º'this“scrÑðeen“you“manage“the“various“rëˆules“you“dene“for“this“lter‘ÿB.“Y‘ÿou“can“opt“toŽ¡‘0insert,–€append,“edit,“or“delete“rëˆules.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1316) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1318) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï@PSfile="iptraf-ipfltlist.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–äá7-4.“The“lter“rule“selection“screen.“Selecting“an“entry“displays“that“set“forŽ¡‘0editingŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1319) cvn H.B /DEST pdfmark endŸp¨‘0¾Any–èsrëˆules“dened“will“appear“heršÑðe.“Y‘ÿou“will“see“the“sour˜ce“and“destination“addr˜esses,Ž¡‘0masks–N and“ports“(long“addrÑðesses“and“masks“may“be“tršëˆuncated)“and“whether“this“r˜uleŽ¡‘0includes–€or“excludes“matching“packets.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1320) cvn H.B /DEST pdfmark endŸ.‘0Between–_Hthe“souršÑðce“and“destination“parameters“is“an“arr˜ow“that“indicates“whetherŽ¡‘0the–¥”rëˆule“matches“packets“(single-headed)“only“exactly“or“whether“it“matches“packetsŽ¡‘0owing–€in“the“opposite“dirÑðection“(double-headed).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1321) cvn H.B /DEST pdfmark endŸ.‘0At–!øthis“scršÑðeen,“pr˜ess“I‘!àto“insert“at“the“curr˜ent“position“of“the“selection“bar‘ÿB,“A‘!àto“appendŽ¡‘0a–ršëˆule“to“the“end“of“the“list,“Enter“to“edit“the“highlighted“r˜ule“and“D‘œÏto“delete“theŽ¡‘0selected–€ršëˆule.“W‘ÿs8ith“an“empty“list,“A“or“I“can“be“used“to“add“the“rst“r˜ule.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1322) cvn H.B /DEST pdfmark endŸ.‘0T›ÿo–á¡add“the“rst“rëˆule,“prÑðess“A‘áˆor“I.“Y˜ou“will“then“be“prÑðesented“with“a“dialog“box“thatŽ¡‘0allows–€you“to“enter“the“rëˆule's“parameters.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1323) cvn H.B /DEST pdfmark endŸG²‘0ÍEntering–ÒFilter“Rulesïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.10.7.3) cvn H.B /DEST pdfmark endŽŸò‰ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1325) cvn H.B /DEST pdfmark endŸw‘0¾Y‘ÿou–ªˆcan“enter“addršÑðesses“of“individual“hosts,“networks,“or“a“catch-all“addr˜ess.“TheŽ¡‘0naturšÑðe–€of“the“addr˜ess“will“be“determined“by“the“wildcar˜d“mask.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1326) cvn H.B /DEST pdfmark endŸ.‘0Y›ÿou'll–ñ±notice“two“sets“of“elds,“marked“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1327) cvn H.B /DEST pdfmark endÈSource“¾and“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1328) cvn H.B /DEST pdfmark endÈDestination¾.“Y˜ou“ll“these“outŽ¡‘0with–€the“information“about“your“souršÑðce“and“tar˜gets.ŽŽŸ0‘`ïcolor push BlackÅ44ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹-;$Þ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.45) cvn H.B /DEST pdfmark endï color popŸüfd’]):ÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ   þ¤½8¤ºk˜¡‘` ÿvk˜ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1329) cvn H.B /DEST pdfmark endŸ ‘0¾Fill–y½out“the“host“name“or“IP‘y»addrÑðess“of“the“hosts“or“networks“in“the“rst“eld“markedŽ¤ ‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1330) cvn H.B /DEST pdfmark endÈHost–ffname/IP“Address¾.–.~Enter“it“in“standarÑðd“dotted-decimal“notation.“When“done,Ž¡‘0pršÑðess–þ¯T‘ÿab“to“move“to“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1331) cvn H.B /DEST pdfmark endÈWildcard‘ffmask“¾eld.“The“wildcar˜d“mask“is“similar“butŽ¡‘0not–&exactly“identical“to“the“standaršÑðd“IP‘%ósubnet“mask.“The“wildcar˜d“mask“is“used“toŽ¡‘0determine–‚which“bits“to“ignoršÑðe“when“pr˜ocessing“the“lter‘ÿB.“In“most“cases,“it“will“workŽ¡‘0very–!„closely“like“a“subnet“mask.“Place“ones“(1)“under“the“bits“you“want“the“lter“toŽ¡‘0ršÑðecognize,–é5and“keep“zer˜os“(0)“under“the“bits“you“want“the“lter“to“ignor˜e.“For“example:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1332) cvn H.B /DEST pdfmark endŸ.‘0T‘ÿo–€rÑðecognize“the“host“207.0.115.44ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1333) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1334) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.2) cvn H.B /DEST pdfmark endŸ a@‘0IP‘€addrÑðessŽŽŽ’êÈ207.0.115.44ŽŽŽŽŸa@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’êÈ255.255.255.255ŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1346) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€rÑðecognize“all“hosts“belonging“to“network“202.47.132.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1347) cvn H.B /DEST pdfmark endÊxŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1348) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1349) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.3) cvn H.B /DEST pdfmark endŸ a@‘0¾IP‘€addrÑðessŽŽŽ’êÈ202.47.132.0ŽŽŽŽŸa@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’êÈ255.255.255.0ŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1361) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€ršÑðecognize“all“hosts“with“any“addr˜ess:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1362) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1363) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.4) cvn H.B /DEST pdfmark endŸ a@‘0IP‘€addrÑðessŽŽŽ’êÈ0.0.0.0ŽŽŽŽŸa@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’êÈ0.0.0.0ŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1375) cvn H.B /DEST pdfmark end¤ ‘0¾The›ÎJIP‘Î6addr•Ñðess/wildcar“d˜mask˜mechanism˜of˜the˜display˜lter˜doesn't˜r“ecognize˜IPŽ¡‘0addrÑðess–€class.“It“uses“a“simple“bit-“pattern“matching“algorithm.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1376) cvn H.B /DEST pdfmark endŸ.‘0The–hØwildcarÑðd“mask“also“does“not“have“to“end“on“a“byte“boundary;“you“may“maskŽ¡‘0right–!îinto“a“byte“itself.“For“example,“255.255.255.224“masks“27“bits“(255“is“11111111,Ž¡‘0224–€is“11100000“in“binary).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1377) cvn H.B /DEST pdfmark endŸ.‘0IPT›ÿ raf–y#also“accepts“host“names“in“place“of“the“IP‘xãaddrÑðesses.“IPT˜raf“will“rÑðesolve“theŽ¡‘0host–Cname“when“the“lter“is“loaded.“When“the“lter“is“interpršÑðeted,“the“wildcar˜d“maskŽ¡‘0will–%«also“be“applied.“This“can“be“useful“in“cases“wheršÑðe“a“single“host“name“may“r˜esolveŽ¡‘0to–€several“IP“addrÑðesses.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1378) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1380) cvn H.B /DEST pdfmark endŸ ¯^‘DÐTip:–ÜÏSee“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1381) cvn H.B /DEST pdfmark endãLinšèöux“Netw˜or"‰k“Administr˜ator'ŒÌs“Guide‘ÏcÏif“yÑîou“need“more“infºåor9™mation“on“IPŽ¤ æf‘Daddresses–€}and“subnet“masking.ŽŸæf‘ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1382) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1384) cvn H.B /DEST pdfmark end¡‘DÐTip:–Þ ÏIPT‘þëˆrèöaf“alloÝvws“yÑîou“to“specify“the“wildcard“mask“in“Classless“Interdomain“RoutingŽ¡‘D(CIDR)‘õÕfšºåor9™mat.–õóThis“f˜or9™mat“alloÝvws“yÑîou“to“specify“the“nèöumber“of“1-bits“that“mask“the“ad-Ž¡‘DdressÝv.–×(CIDR›×notation“is“the“fºåor9™m“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1385) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1386) cvn H.B /DEST pdfmark endÓaddress/bits“Ïwhere“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1387) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1388) cvn H.B /DEST pdfmark endÓaddress“Ïis“the“IP˜address“orŽ¡‘Dhost–—name“and“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1389) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1390) cvn H.B /DEST pdfmark endÓbits“Ïis“the“nèöumber“of“1-bits“in“the“mask.“Fšºåor“e˜xamplešÝv,“if“yÑîou“w˜ant“toŽ¡‘Dmask–"10.1.1.0“with“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1391) cvn H.B /DEST pdfmark endÑ255.255.255.0Ï,“note“that“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1392) cvn H.B /DEST pdfmark endÑ255.255.255.0“Ïhas“24“1-bitsÝv,“so“insteadŽ¡‘Dof–ŸMspecifying“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1393) cvn H.B /DEST pdfmark endÑ255.255.255.0“Ïin“the“wildcard“mask“eld,“yÑîou“can“just“enter“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1394) cvn H.B /DEST pdfmark endÑ10.1.1.0/24Ž¡‘DÏin–Àtthe“address“eld.“IPT‘þëˆršèöaf“will“tr˜anslate“the“mask“bits“into“an“appropr"‰iate“wildcard“maskŽ¡‘Dand–€}ll“in“the“mask“eld“the“neºåxt“time“yÑîou“edit“the“lter“r"‰uleÝv.ŽŸäùïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1395) cvn H.B /DEST pdfmark endŸm‘DIf–åˆyšÑîou“specify“the“mask“in“CIDR‘ånnotation,“lea˜vÆfe“the“wildcard“mask“elds“b˜lank.“If“y˜ou“llŽ¡‘Dthem–€}up¯],“the“wildcard“mask“elds“will“takÑîe“precedenceÝv.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1396) cvn H.B /DEST pdfmark end¤ ‘0¾The–!^ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1397) cvn H.B /DEST pdfmark endÈPort“¾elds“should“contain“a“port“number“or“range“of“any“TCP›!4or“UDP˜serviceŽ¡‘0you–Ʊmay“be“interÑðested“in.“If“you“want“to“match“only“a“single“port“number‘ÿB,“ll“in“theŽŽŸ0‘`ïcolor push Black’šÅ45ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹.;8ב·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.46) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1437) cvn H.B /DEST pdfmark endŸfdÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¾rst–¶Peld,“while“leaving“the“second“blank“or“set“to“zerÑðo.“Fill“in“the“second“eld“ifŽ¤ ’you–/!want“to“match“a“range“of“ports“(e.g.“80“to“90).“Leave“the“rst“eld“blank“or“setŽ¡’to–âèzeršÑðo“to“let“the“lter“ignor˜e“the“ports“altogether‘ÿB.“Y‘ÿou“will“most“likely“be“inter˜estedŽ¡’in–ÄÁtaršÑðget“ports“rather“than“sour˜ce“ports“(which“ar˜e“usually“unpr˜edictable“anyway‘þã×,Ž¡’perÑðhaps–€with“the“exception“of“FTP“data).Ž‘`©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1398) cvn H.B /DEST pdfmark endŸ.‘0Non-TCP– hand› Œnon-UDP“packets˜ar•Ñðe˜not˜aected˜by˜these˜elds,˜and˜these˜ar“e˜usedŽ¡‘0only–€when“ltering“TCP“or“UDP“packets.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1399) cvn H.B /DEST pdfmark endŸ.‘0Fill–àout“the“second“set“of“elds“with“the“parameters“of“the“opposite“end“of“the“con-Ž¡‘0nection.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1400) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1402) cvn H.B /DEST pdfmark endŸ ¯^‘DÐTip:–;PÏAnÝvy“address“or“mask“elds“left“bšÑîlank“defºåault“to“0.0.0.0“while“b˜lank“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1403) cvn H.B /DEST pdfmark endÑPort“Ïelds“defºåaultŽ¤ æf‘Dto–ÓÌ0.“This“makšÑîes“it“easy“to“dene“lter“r"‰ules“if“y˜ou'ŒÌre“interested“only“in“either“the“sourceŽ¡‘Dor–¯destination,“bÑîut“not“the“otherŒÌ.“Fšºåor“e˜xampleÝv,“yÑîou“ma˜y“be“interested“in“trèöac“or"‰iginatingŽ¡‘Dfrom–¼netwèöor"‰k“61.9.88.0,“in“which“case“yÑîou“just“enter“the“source“addressÝv,“mask“and“por\#tŽ¡‘Din–€}the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1404) cvn H.B /DEST pdfmark endÑSource“ÏeldsÝv,“while“leašÑîving“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1405) cvn H.B /DEST pdfmark endÑDestination“Ïelds“b˜lank.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1406) cvn H.B /DEST pdfmark end¤ ‘0¾The–Ÿ™next“elds“let“you“specify“which“IP-type“prÑðotocols“you“want“matched“by“thisŽ¡‘0lter–™çrëˆule.“Any“packet“whose“pršÑðotocol's“corr˜esponding“eld“is“marked“with“a“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1407) cvn H.B /DEST pdfmark endÈY‘™ž¾isŽ¡‘0matched–âagainst“the“lter‘½p's“dened“IP‘ÆaddrÑðesses“and“ports,“otherwise“they“don't“passŽ¡‘0thrÑðough–€this“lter“rëˆule.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1408) cvn H.B /DEST pdfmark end¤.‘0If–€you“want“to“evaluate“all“IP“packets“just“mark“with“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1409) cvn H.B /DEST pdfmark endÈY“¾the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1410) cvn H.B /DEST pdfmark endÈAll‘ffIP“¾eld.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1411) cvn H.B /DEST pdfmark end¡‘0For–€example,“if“you“want“to“see“only“all“TCP“trac,“mark“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1412) cvn H.B /DEST pdfmark endÈTCP“¾eld“with“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1413) cvn H.B /DEST pdfmark endÈY¾.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1414) cvn H.B /DEST pdfmark end¡‘0The–±}long“eld“marked“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1415) cvn H.B /DEST pdfmark endÈAdditional‘ffprotocols“¾allows“you“to“specify“other“prÑðoto-Ž¤ ‘0cols–:üby“their“IANA›:Ìnumber‘ÿB.“(Y‘ÿou“can“view“the“common“IP˜prÑðotocol“number“in“theŽ¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1416) cvn H.B /DEST pdfmark endÈ/etc/protocols–Vz¾le).“Y‘ÿou“can“specify“a“list“of“prÑðotocol“numbers“or“ranges“separatedŽ¡‘0by–Ùcommas,“Ranges“have“the“beginning“and“ending“prÑðotocol“numbers“separated“withŽ¡‘0a‘€hyphen.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1417) cvn H.B /DEST pdfmark endŸ.‘0For–u©example,“to“see“the“RSVP›u¦(46),“IP˜mobile“(55),“and“prÑðotocols“(101“to“104),“you“useŽ¡‘0an–€entry“that“looks“like“this:ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1418) cvn H.B /DEST pdfmark endŸ~‘0È46,–ff55,“101-104ŽŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1419) cvn H.B /DEST pdfmark endŸ òs‘0¾It's–ôÂcertainly“possible“to“specify“any“of“the“prÑðotocols“listed“above“in“this“eld.“EnteringŽ¡‘0ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1420) cvn H.B /DEST pdfmark endÈ1-255–€¾is“functionally“identical“to“marking“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1421) cvn H.B /DEST pdfmark endÈAll‘ffIP“¾with“a“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1422) cvn H.B /DEST pdfmark endÈY¾.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1423) cvn H.B /DEST pdfmark endŸ.‘0The–ªnext“eld“is“marked“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1424) cvn H.B /DEST pdfmark endÈInclude/Exclude¾.“This“eld“allows“you“to“decide“whetherŽ¡‘0to–.include“or“lter“out“matching“packets.“Setting“this“eld“to“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1425) cvn H.B /DEST pdfmark endÈI‘-í¾causes“the“lter“to“passŽ¡‘0matching–¦Ípackets,“while“setting“it“to“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1426) cvn H.B /DEST pdfmark endÈE‘¦Ã¾causes“the“lter“to“drÑðop“them.“This“eld“is“setŽ¡‘0to–€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1427) cvn H.B /DEST pdfmark endÈI“¾by“default.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1428) cvn H.B /DEST pdfmark endŸ.‘0The–þˆlast“eld“in“the“dialog“is“labeled“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1429) cvn H.B /DEST pdfmark endÈMatch‘ffopposite¾.“When“set“to“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1430) cvn H.B /DEST pdfmark endÈY¾,“the“lter“willŽ¡‘0match–É-packets“owing“in“the“opposite“diršÑðection.“Pr˜evious“versions“of“IPT‘ÿ raf“usedŽ¡‘0to–xmatch“TCP‘Spackets“owing“in“either“diršÑðection,“so“the“sour˜ce“and“destination“ad-Ž¡‘0dršÑðess/mask/port–H4combinations“wer˜e“actually“inter˜changeable.“Starting“with“IPT‘ÿ rafŽ¡‘03.0,–‘Pwhen“lters“extended“to“morÑðe“than“just“the“IP‘‘Ktrac“monitor‘ÿB,“this“behavior“is“noŽ¡‘0longer–€the“default“thrÑðoughout“IPT‘ÿ raf“except“in“the“IP“trac“monitor‘½p's“TCP“window‘ÿ.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1431) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1433) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–ó“ÏFšºåor“TCP‘ó4pac•Ñîk“etsÝv,–ó“this“eld“is“used“in“all“f˜acilities“e˜xcept“the“IP‘ó4trèöac“monitorŒÌ.Ž¤ æf‘DBecause–J®the“IP‘Jztršèöac“monitor“m˜ust“capture“TCP‘Jzpac•Ñîk“ets–J®in“both“directions“to“proper"‰lyŽ¡‘Ddeter9™mine–"óa“closed“connection,“the“lter“automatically“matches“pac•Ñîk“ets–"óin“the“oppositeŽ¡‘Ddirection,–4øregardless“of“this“eld'ŒÌs“setting.“HoÝvwèöešºåvÆfer“iin“all“other“f˜acilitiesÝv,“automatic“match-Ž¡‘Ding–€}of“the“rešºåvÆferse“pac•Ñîk“ets–€}is“not“perf˜or9™med“unless“yÑîou“set“this“eld“to“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1434) cvn H.B /DEST pdfmark endÑYÏ.ŽŸ¢ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1435) cvn H.B /DEST pdfmark endŸåÄ‘DFilters–m×fºåor“UDP›mÓand“other“IP˜protocols“do“not“automatically“match“pac•Ñîk“ets–m×in“the“oppositeŽ¡‘Ddirection–€}unless“yÑîou“set“the“eld“to“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1436) cvn H.B /DEST pdfmark endÑYÏ,“eºåvÆfen“in“the“IP“trèöac“monitorŒÌ.ŽŽŸ0‘`ïcolor push BlackÅ46ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹/;[W‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.47) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1522) cvn H.B /DEST pdfmark endŸfd’]):ÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ  ŸÞCt ÿx þ<;Ÿ’¾PrÑðess–ɱEnter“to“accept“all“parameters“when“done.“The“parameters“will“be“acceptedŽ¤ ’and–7éyou'll“be“taken“back“to“the“ršëˆule“selection“box.“Y‘ÿou“can“then“add“morÑðe“r˜ules“byŽ¡’pršÑðessing–ÃA‘à or“you“can“insert“new“rëˆules“at“any“point“by“pr˜essing“I.“Should“you“makeŽ¡’a–«mistake,“you“can“prÑðess“Enter“to“edit“the“selected“lter‘ÿB.“Y‘ÿou“may“enter“as“many“setsŽ¡’of–€parameters“as“you“wish.“PrÑðess“Ctrl+X“when“done.Ž‘`©Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1438) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1440) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–T[ÏBecause“of“the“major“changes“in“the“lter"‰ing“system“since“IPT‘þëˆrèöaf“2.7,“old“lters“willŽŸ æf‘Dno–€}longer“wèöor"‰k“and“will“haÑîvÆfe“to“be“redened.Ž¤‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1441) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1443) cvn H.B /DEST pdfmark endŸRE‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï?PSfile="iptraf-ipfltdlg.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸ¡‘0ÄFigure–€7-5.“The“IP“lter“parameters“dialogŽŸ Xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1444) cvn H.B /DEST pdfmark endŸŠB‘0ÍExamplesïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.10.8.3) cvn H.B /DEST pdfmark endŽŸÆåïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1446) cvn H.B /DEST pdfmark endŸ¹‘0¾T‘ÿo–‹vsee“all“trac“to/fršÑðom“host“202.47.132.1“fr˜om/to“207.0.115.44,“r˜egar˜dless“of“TCPŽŸ ‘0portŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1447) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1448) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.5) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È202.47.132.2ŽŽŽ’(207.0.115.44ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È255.255.255.255ŽŽŽ’(255.255.255.255ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(0ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈTCP:‘ffYŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1483) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€see“all“trac“frÑðom“host“207.0.115.44“to“all“hosts“on“network“202.47.132.xŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1484) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1485) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.6) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È207.0.115.44ŽŽŽ’(202.47.132.0ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È255.255.255.255ŽŽŽ’(255.255.255.0ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(0ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈAll–ffIP:“YŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈNŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1520) cvn H.B /DEST pdfmark endŸ ‘0¾T›ÿo–€see“all“W˜eb“trac“(to“and“fršÑðom“port“80)“r˜egar˜dless“of“sour˜ce“or“destinationŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1521) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’™úèÅ47ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹0;˜‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.48) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ„øØ¥ÿ|映ÿtx¡‘`Ÿœ¸€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.7) cvn H.B /DEST pdfmark endŸa@‘0¾Host–€name/IP“AddrÑðessŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È80ŽŽŽ’(0ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈTCP:‘ffYŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1557) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€see“all“IRC“trac“frÑðom“port“6666“to“6669ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1558) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1559) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.8) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(6666–€¾to“È6669ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈTCP:‘ffYŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1595) cvn H.B /DEST pdfmark end¤ ‘0¾T‘ÿo–¥—see“all“DNS›¥Ktrac,“(TCP˜and“UDP‘þµÇ,“destination“port“53)“r•Ñðegar“dless–¥—of“sourÑðce“orŽ¡‘0destinationŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1596) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1597) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (table.9) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È0.0.0.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(53ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈTCP:–ffY“UDP:“YŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1632) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€see“all“mail“(SMTP)“trac“to“a“single“host“(202.47.132.2)“fršÑðom“anywher˜eŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1633) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1634) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (table.10) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È0.0.0.0ŽŽŽ’(202.47.132.2ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È0.0.0.0ŽŽŽ’(255.255.255.255ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(25ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈTCP:‘ffYŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈNŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1669) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€see“trac“fršÑðom“fr˜om/to“host“sunsite.unc.edu“to/fr˜om“cebu.mozcom.comŽŸ4xïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1670) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1671) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (table.11) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬Èsunsite.unc.eduŽŽŽ’(cebu.mozcom.comŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È255.255.255.255ŽŽŽ’(255.255.255.255ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(0ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈAll–ffIP:“YŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈIŽŽŽŽŽŸ0‘`ïcolor push BlackÅ48ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹1;”Þ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.49) cvn H.B /DEST pdfmark endï color popŸüfd’]):ÅChapter–€7.“FiltersŽŽŽŽŽŽŽ’¤ï color popŽŽ   þ)z¨ ÿ|昒¾Match‘€oppositeŽŽŽ’ ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1706) cvn H.B /DEST pdfmark endŸ ‘0¾T‘ÿo–€omit“display“of“trac“to/fršÑðom“140.66.5.x“fr˜om/to“anywher˜eŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1707) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1708) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (table.12) cvn H.B /DEST pdfmark endŸ a@‘0Host–€name/IP“AddrÑðessŽŽŽ’¬È140.66.5.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¤a@‘0¾W‘ÿs8ildcarÑðd‘€maskŽŽŽ’¬È255.255.255.0ŽŽŽ’(0.0.0.0ŽŽŽŽ¡‘0¾PortŽŽŽ’¬È0ŽŽŽ’(0ŽŽŽŽ¡‘0¾PrÑðotocolsŽŽŽ’¬ÈAll–ffIP:“YŽŽŽŽ¡‘0¾Include/ExcludeŽŽŽ’¬ÈEŽŽŽŽ¡‘0¾Match‘€oppositeŽŽŽ’¬ÈYŽŽŽŽŽ‘`Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1743) cvn H.B /DEST pdfmark end¤ ‘0¾Y‘ÿou–¤Åcan“enter“as“many“parameters“as“you“wish.“All“of“them“will“be“interprÑðeted“untilŽ¡‘0the–€rst“match“is“found.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1744) cvn H.B /DEST pdfmark endŸâ’‘0ÍExcDZluding–ÒCer8Ntain“Sitesïps:SDict begin H.S endïps:SDict begin 12.1 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (9.23.10.9.3) cvn H.B /DEST pdfmark endŽŸò‰ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1746) cvn H.B /DEST pdfmark endŸw‘0¾Filters–jit“exits.“However‘ÿB,“if“pršÑðomiscuous“mode“was“alr˜eady“set“when“a“facility“wasŽ¡‘0started,–€it“rÑðemains“set“on“exit.ŽŸ£Óïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1967) cvn H.B /DEST pdfmark endŸ \-‘0If–`¼multiple“instances“of“IPT‘ÿ raf“aršÑðe“started,“the“pr˜omiscuous“setting“is“r˜estor˜ed“onlyŽ¡‘0upon–€exit“of“the“last“facility‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1968) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1970) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–ÊnÏDo“not“use“other“prog•èör“ams–Ênthat“change“the“interfºåace'ŒÌs“promiscuous“ag“at“theŽ¤ æf‘Dsame–˜)time“yÑîou'ŒÌre“using“IPT‘þëˆršèöafºå.“The“prog˜r˜ams“can“interfšºåere“with“each“other'ŒÌs“e˜xpectedŽ¡‘DoperšèöationsÝv.–íYWhile“IPT‘þëˆr˜af“tr"‰ies“to“obtain“the“initial“setting“of“anÝvy“promiscuous“ags“fºåorŽ¡‘Drestoršèöation–¢ªupon“eºåxit,“other“prog˜r˜ams“maºåy“not“be“as“w˜ell-behašÑîvÆfed,“and“the˜y“maºåy“tur9™n“oŽ¡‘Dthe–€}promiscuous“ags“while“IPT‘þëˆrèöaf“is“still“monitor"‰ing.ŽŸŸ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1971) cvn H.B /DEST pdfmark endŸ!O\ÌColorïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.25.18.2) cvn H.B /DEST pdfmark endŽŸ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1973) cvn H.B /DEST pdfmark endŸ ÙM‘0¾T›ÿ urn–¦Lthis“on“with“color“monitors.“T˜urn“it“o“with“black-and-“white“monitors“or“non-Ž¤ ‘0color–b×terminals“(like“xterms).“Changes“to“this“setting“will“take“eect“the“next“time“theŽ¡‘0prÑðogram–€is“started.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1974) cvn H.B /DEST pdfmark endŸ.‘0Color–þois“on“by“default“on“consoles“and“color“xterms,“o“on“non-color“terminals“likeŽ¡‘0xterms–€and“VT100s.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1975) cvn H.B /DEST pdfmark endŸ!TÌLogágingïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.25.19.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1977) cvn H.B /DEST pdfmark endŸNБ0¾When–}ƒthis“option“is“active,“IPT‘ÿ raf“will“log“information“to“a“disk“le,“which“can“beŽ¡‘0examined–T¾or“analyzed“later‘ÿB.“Since“IPT›ÿ raf“2.4.0,“IPT˜raf“prÑðompts“you“for“the“name“ofŽ¡‘0the–¬0le“to“which“to“write“the“logs.“It“will“pršÑðovide“a“default“name,“which“you“ar˜e“fr˜eeŽ¡‘0to–Òaccept“or“change.“The“IP›Òytrac“monitor“and“LAN˜station“monitor“will“generate“aŽ¡‘0log–Wle“name“that“is“based“on“what“instance“they“arÑðe“(rst,“second,“and“so“on).“TheŽ¡‘0general–*pinterface“statistics'“default“log“le“name“is“constant,“because“it“listens“to“allŽ¡‘0interfaces–€at“once,“and“only“one“instance“can“rëˆun“at“one“time.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1978) cvn H.B /DEST pdfmark endŸ.‘0The–=%other“facilities“generate“a“log“le“name“based“on“the“interface“they'rÑðe“listeningŽ¡‘0on.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1979) cvn H.B /DEST pdfmark endŸ Èø‘0See–€the“descriptions“on“the“facilities“above“for“the“default“log“le“names.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1980) cvn H.B /DEST pdfmark endŸ.‘0PrÑðess–ñiEnter“to“accept“the“log“le“name,“or“Ctrl+X‘ñLto“cancel.“Canceling“will“turn“log-Ž¡‘0ging–€o“for“that“session.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1981) cvn H.B /DEST pdfmark endŸ.‘0The–€IP“trac“monitor“will“write“the“following“pieces“of“information“to“its“log“le:ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1982) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1983) cvn H.B /DEST pdfmark endŸ.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1984) cvn H.B /DEST pdfmark end¾Start–€of“the“trac“monitorŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1985) cvn H.B /DEST pdfmark endŸ Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1986) cvn H.B /DEST pdfmark end¾Receipt–ƒéof“the“rst“TCP›ƒèpacket“for“a“connection.“If“that“packet“is“a“SYN,“(SYN)˜willŽ¡‘:be–Iùindicated“in“the“log“entry‘þã×.“(Of“course,“the“trac“monitor“may“start“in“the“middleŽ¡‘:of––îestablished“connections.“It“will“still“count“those“packets.“This“also“explains“whyŽ¡‘:some–¿äconnection“entries“may“become“idle“if“the“trac“monitor“is“started“in“theŽŽŸ0‘`ïcolor push BlackÅ54ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹7; ß‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.55) cvn H.B /DEST pdfmark endï color popŸüfd’($4ÅChapter–€8.“Conguring“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’š¾middle–yÜof“a“half-closed“connection,“and“miss“the“rst“FIN.“Such“entries“time“out“inŽŸ ’ša‘€while.)Ž‘`ŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1987) cvn H.B /DEST pdfmark endŸç°‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1988) cvn H.B /DEST pdfmark end¾Receipt–€of“a“FIN“(with“average“ow“rate)Ž¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1989) cvn H.B /DEST pdfmark end©.‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1990) cvn H.B /DEST pdfmark end¾ACK–€of“a“FINŽž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1991) cvn H.B /DEST pdfmark endŸ Èø‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1992) cvn H.B /DEST pdfmark end¾T‘ÿs8imeouts–€of“TCP“entries“(with“average“ow“rate)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1993) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1994) cvn H.B /DEST pdfmark end¾Reset–€connections“(with“average“ow“rate)Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1995) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1996) cvn H.B /DEST pdfmark end¾Everything–€that“appears“in“the“bottom“window“of“the“trac“monitorŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1997) cvn H.B /DEST pdfmark end¦‘0ïcolor push BlackË€ˆï color popŽŽ‘:ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1998) cvn H.B /DEST pdfmark end¾Stopping–€of“the“trac“monitorŽ¤Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (1999) cvn H.B /DEST pdfmark end¦‘0Each–ìTlog“entry“includes“the“date“and“time“the“entry“was“written.“Logging“is“alsoŽŸ ‘0aected–€by“the“dened“lters.Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2000) cvn H.B /DEST pdfmark end¦‘0Log–ÙSles“can“gršÑðow“very“fast,“so“be“pr˜epar˜ed“with“plenty“of“fr˜ee“space“and“deleteŽŸ ‘0unneeded–€logs.“Log“write“erršÑðors“ar˜e“not“indicated.Ž¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2001) cvn H.B /DEST pdfmark end¦‘0Copies–†*of“the“interface“statistics,“TCP/UDP‘†(statistics,“packet“size“statistics,“and“LANŽ¤ ‘0host–†fstatistics“aršÑðe“also“written“to“the“log“les“at“r˜egular“intervals.“See“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2002) cvn H.B /DEST pdfmark endÅLog“Interval...“¾inŽ¡‘0this‘€chapter‘ÿB.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2003) cvn H.B /DEST pdfmark end¦‘0IPT‘ÿ raf–n©closes“and“ršÑðeopens“the“active“log“le“when“it“r˜eceives“a“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2004) cvn H.B /DEST pdfmark endÈUSR1“¾signal.“This“isŽ¡‘0useful–[in“cases“wherÑðe“a“facility“is“rëˆun“for“long“periods“of“time“but“the“log“les“have“toŽ¡‘0be–€clearÑðed“or“moved.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2005) cvn H.B /DEST pdfmark endŸ Èø‘0T‘ÿo–ŠËclear“or“move“an“active“log“le,“rÑðename“it“rst.“IPT‘ÿ raf“will“continue“to“write“toŽ¡‘0the–rïle“despite“the“new“name.“Then“use“the“UNIX‘rìkill“command“to“send“the“rëˆunningŽ¡‘0IPT›ÿ raf–gÕprÑðocess“a“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2006) cvn H.B /DEST pdfmark endÈUSR1“¾signal.“IPT˜raf“will“then“close“the“log“le“and“open“another“withŽ¡‘0the–€original“name.“Y‘ÿou“can“then“safely“ršÑðemove“or“delete“the“r˜enamed“le.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2007) cvn H.B /DEST pdfmark end¦‘0Do–Gœnot“delete“an“open“log“le.“Doing“so“will“only“ršÑðesult“in“a“le“just“as“lar˜ge“but“lledŽ¡‘0with–€null“characters“(ASCII“code“0).ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2008) cvn H.B /DEST pdfmark endŸç°‘0Logging–ûRcomes“disabled“by“default.“The“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2009) cvn H.B /DEST pdfmark endÈUSR1“¾signal“is“caught“only“if“logging“is“en-Ž¡‘0abled,–€it“is“ignorÑðed“otherwise.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2010) cvn H.B /DEST pdfmark end¦‘0A›valid–:specication“of“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2011) cvn H.B /DEST pdfmark endÈ-L˜¾on“the“command“line“with“automatically“enable“loggingŽ¡‘0for–€that“particular“session.“The“saved“conguration“setting“is“not“aected.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2012) cvn H.B /DEST pdfmark endŸ}tÌActivity‘]modeïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.25.20.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2014) cvn H.B /DEST pdfmark endŸ~Б0¾T‘ÿoggles–§ìactivity“indicators“in“the“interface“and“LAN‘§âstatistics“facilities“between“kilo-Ž¡‘0bits–€per“second“(kbits/s)“or“kilobytes“per“second“(kbytes/s).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2015) cvn H.B /DEST pdfmark endŸ.‘0The–€default“setting“is“kilobits“per“second.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2016) cvn H.B /DEST pdfmark endŸ}tÌSourÂce–]MA„ C“adádrÑ‘s“in“trac“monitorïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.25.21.2) cvn H.B /DEST pdfmark endŽŸ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2018) cvn H.B /DEST pdfmark endŸ ÙM‘0¾When–·Çenabled,“the“IP‘·¹trac“monitor“ršÑðetrieves“the“packets'“sour˜ce“MAC‘·¹addr˜esses“ifŽ¡‘0they–Ocame“in“on“an“Ethernet,“FDDI,“or“PLIP‘NÞinterface.“The“addrÑðesses“appear“in“theŽ¡‘0lower–ªúwindow“for“non-TCP›ªïpackets,“while“for“TCP˜connections,“they“can“be“viewedŽ¡‘0by–€prÑðessing“M.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2019) cvn H.B /DEST pdfmark endŸ.‘0No–ô(such“information“is“displayed“if“the“network“interface“doesn't“use“MAC‘ôaddrÑðessesŽ¡‘0(such–€as“PPP“interfaces).ŽŸPïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2020) cvn H.B /DEST pdfmark endŸç°‘0This–€can“be“used“to“determine“the“actual“sourÑðce“of“the“packets“on“your“local“LAN.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2021) cvn H.B /DEST pdfmark endŸ.‘0The–óLtrac“monitor“also“logs“the“MAC‘ó(addrÑðesses“with“this“option“enabled.“The“defaultŽ¡‘0setting–€is“o.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (TIMERS) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’šÅ55ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹8; U‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.56) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€8.“Conguring“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš‘`ÇTimerÌìsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (10.26.1) cvn H.B /DEST pdfmark endŽ‘`ŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2024) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2025) cvn H.B /DEST pdfmark endÅT‘ÿs8imers...“¾submenu“allows“you“to“IPT‘ÿ raf‘ŒÈ's“interval“and“timeout“functions.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2026) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2028) cvn H.B /DEST pdfmark endŸME‘0ïMps: currentpoint currentpoint translate 1 1 scale neg exch neg exch translateï@PSfile="iptraf-timermenu.eps" llx=0 lly=0 urx=72 ury=72 rwi=720 ŽŽŽïYps: currentpoint currentpoint translate 1 1 div 1 1 div scale neg exch neg exch translateŽŽŸŸ‘0ÄFigure–€8-2.“The“T‘ÿs8imers“conguration“submenuŽŸXïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2029) cvn H.B /DEST pdfmark endŸÀÌTCP‘]Timeoutïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.26.22.2) cvn H.B /DEST pdfmark endŽŸ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2031) cvn H.B /DEST pdfmark endŸ ÙM‘0¾This–+›guršÑðe“determines“the“amount“of“time“(in“minutes)“a“connection“entry“may“r˜e-Ž¤ ‘0main–Ýidle“beforšÑðe“it“becomes“eligible“for“r˜eplacement“by“a“new“connection.“The“defaultŽ¡‘0is–ýª15“minutes.“Y‘ÿou“may“want“to“rÑðeduce“this“on“an“isolated“(not“connected“to“the“In-Ž¡‘0ternet)–·LAN›¶Äor“a“LAN˜connected“to“the“Internet“with“high-speed“links.“Just“enterŽ¡‘0the–new“value“and“pršÑðess“Enter‘ÿB.“Y‘ÿou“can“pr˜ess“Ctrl+X‘óto“leave“the“curr˜ent“value“un-Ž¡‘0changed.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2032) cvn H.B /DEST pdfmark endŸ}tÌLog‘]InterøvÂalïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.26.23.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2034) cvn H.B /DEST pdfmark endŸNБ0¾This–LtgurÑðe“determines“the“number“of“minutes“between“logging“of“interface“statistics,Ž¡‘0TCP/UDP›é‹gurÑðes,–é¦and“LAN˜host“statistics.“The“default“is“60“minutes.“This“gurÑðe“isŽ¡‘0meaningless–€if“logging“is“disabled.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2035) cvn H.B /DEST pdfmark endŸ.‘0This–ÞÐconguration“item“can“be“overridden“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2036) cvn H.B /DEST pdfmark endÈ-I‘Þ·¾when“a“facility“is“dirÑðectly“in-Ž¡‘0voked–¯ºfršÑðom“the“command“line“(not“accessed“via“the“main“menu),“and“r˜emains“eec-Ž¡‘0tive–€for“that“particular“session.“The“congurÑðed“value“is“not“aected.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2037) cvn H.B /DEST pdfmark endŸ}tÌScreen–]Update“InterøvÂalïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.26.24.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2039) cvn H.B /DEST pdfmark endŸ~Б0¾This–G7value“determines“the“rate“in“seconds“at“which“the“scrÑðeen“is“updated.“The“defaultŽ¡‘0is–0,“which“means“the“scršÑðeen“is“updated“as“fast“as“possible,“giving“close-to-r˜ealtimeŽ¡‘0ršÑðeection–¬'of“network“activity‘þã×.“However‘ÿB,“this“high-speed“update“can“cause“incr˜edibleŽ¡‘0amounts–öÉof“trac“if“IPT‘ÿ raf“is“rëˆun“on“a“ršÑðemote“terminal“(e.g.“a“T‘ÿelnet“or“Secur˜e“ShellŽ¡‘0session).–ÍY‘ÿou“can“set“this“to“a“higher“value,“such“as“1“or“2“seconds“to“slow“down“theŽ¡‘0updates.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2040) cvn H.B /DEST pdfmark endŸ.‘0This–AòguršÑðe“does“not“aect“the“rate“of“data“captur˜e.“Only“the“scr˜een“r˜efr˜esh“is“aected.Ž¡‘0The– ÿguršÑðes“ar˜e“still“updated“as“fast“as“possible,“although“the“gur˜e“display“will“noŽ¡‘0longer–€be“as“close“to“rÑðealtime.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2041) cvn H.B /DEST pdfmark endŸ.‘0The–ðdefault“setting“is“0,“which“shouldn't“be“a“prÑðoblem“on“the“console.“Set“it“to“aŽ¡‘0slightly–º0higher“value“on“rÑðemote“terminals“or“slow“links.“The“setting“aects“all“moni-Ž¡‘0toring‘€facilities.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2042) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2044) cvn H.B /DEST pdfmark endŸ~‘DÐNote:–¦ÏUpdating“the“screen“is“one“of“the“sloÝvwšèöest“oper˜ations“in“a“prog˜r˜am.“Older“vÆfersionsŽŸ æf‘Dof–'3IPT‘þëˆršèöaf“had“a“probÑîlem“once“netw˜or"‰k“activity“became“vÆferEy“high.“Because“each“pac•Ñîk“etŽŽŸ0‘`ïcolor push BlackÅ56ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹9; @ê‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.57) cvn H.B /DEST pdfmark endï color popŸüfd’($4ÅChapter–€8.“Conguring“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¤Ïcaused–ˆa“screen“updatešÝv,“IPT‘þëˆrèöaf“began“spending“more“time“with“the“screen“updates˜,“caus-Ž¤ æf’¤ing–€}a“loss“of“pac•Ñîk“ets–€}once“netwèöor"‰k“activity“reached“a“cer\#tain“point.Ž‘`Ÿ¢ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2045) cvn H.B /DEST pdfmark endŸåÄ‘DHošÝvwèöeºåvÆferŒÌ,–_ since“man˜y“users“likÑîe“rèöapid“counts“on“their“screen,“a“compromise“w˜as“incorEpo-Ž¡‘Drèöated.–xEvšÆfen“when“the“screen“update“interEv˜al“is“set“to“0,“there“is“still“a“50ms“delaºåy“betwèöeenŽ¡‘Dscreen–Óbupdates“(ešºåxcept“the“LAN‘ÓMstation“monitorŒÌ,“which“has“a“100“ms“dela˜y).“This“is“stillŽ¡‘Dvisually–Âfºåast,“bšÑîut“proÝvvides“more“time“to“the“pac˜k˜et“capture“routineÝv.“Higher“delašºåys“ma˜yŽ¡‘Dresult–€}in“better“accurèöacy“of“counts“and“activity‘ÿ™.ŽŸäùïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2046) cvn H.B /DEST pdfmark endŸm‘DIn–|ŒanšÝvy“case˜,“this“setting“only“aºåects“screen“updates˜.“Capture“still“proceeds“as“fºåast“asŽ¡‘DpossibÑîleÝv.Ž©Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2047) cvn H.B /DEST pdfmark endŸ!O\ÌTCP–]cÂlosed/idle“perÑ‘sistenceïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.26.25.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2049) cvn H.B /DEST pdfmark endŸ~Б0¾This–óparameter“determines“the“interval“(in“minutes)“at“which“the“IP‘òûT‘ÿ rac“MonitorŽ¤ ‘0clears–*frÑðom“the“TCP‘display“window“all“closed,“idle,“and“timed“out“entries.“Enter“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2050) cvn H.B /DEST pdfmark endÈ0Ž¡‘0¾to–ækeep“such“entries“on“the“scršÑðeen“indenitely‘þã×,“disappearing“only“when“r˜eplaced“byŽ¡‘0new‘€connections.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2051) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2053) cvn H.B /DEST pdfmark endŸ ¯^‘DÐNote:–FÀÏThe“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2054) cvn H.B /DEST pdfmark endãTCP‘Ftimeout...“Ïoption“only“tells“IPT‘þëˆrèöaf“hoÝvw“long“it“should“takÑîe“befºåore“a“con-Ž¤ æf‘Dnection–œÄshould“be“considered“idle“and“open“to“replacement“bšÑîy“ne˜w“connectionsÝv.“ThisŽ¡‘Ddoes–S°not“deter9™mine“hošÝvw“long“it“remains“onscreen.“The“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2055) cvn H.B /DEST pdfmark endãTCP‘S¥closed/idle“persistence˜...“Ïpa-Ž¡‘Dršèöameter–¶[ushes“entr"‰ies“that“haÑîvÆfe“been“closed“or“reset,“or“idle“fºåor“the“n˜umber“of“min˜utesŽ¡‘Ddened–€}bÑîy“the“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2056) cvn H.B /DEST pdfmark endãTCP“timeout...“Ïoption.Ž¦Ÿïps:SDict begin H.S endïps:SDict begin 11 H.A endïOps:SDict begin [ /View [/XYZ H.V] /Dest (CUSTOMPORTS) cvn H.B /DEST pdfmark endŸ"¤ÇCustom‘³6Inf»Þormationïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (10.27.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2059) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–nârÑðemaining“conguration“items“allow“you“to“enter“information“which“IPT‘ÿ raf“usesŽ¤ ‘0for–€its“displays“and“logs.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2060) cvn H.B /DEST pdfmark endŸ§ÌAdáditional‘]por=ïtsïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.27.26.2) cvn H.B /DEST pdfmark endŽŸýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2062) cvn H.B /DEST pdfmark endŸ~Б0¾Select–ªthis“item“to“enter“a“port“number“to“be“included“in“the“TCP/UDP‘©Écounts“inŽ¡‘0the–‡”TCP/UDP‘‡Pservice“statistics“main“menu“item“described“above.“By“default,“portŽ¡‘0numbers–ITabove“1023“aršÑðe“not“monitor˜ed.“If“you“do“have“a“higher˜-number˜ed“port“toŽ¡‘0monitor‘ÿB,–€enter“it“herÑðe.ŽŸ£Óïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2063) cvn H.B /DEST pdfmark endŸ \-‘0Y‘ÿou–}will“see“two“elds.“If“you“have“only“one“port“to“enter‘ÿB,“just“ll“up“the“rst“eld.Ž¡‘0T‘ÿo–ôspecify“a“range,“ll“both“elds,“the“rst“port“in“the“rst“eld,“the“last“port“in“theŽ¡‘0second‘€eld.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2064) cvn H.B /DEST pdfmark endŸ Èø‘0Y‘ÿou–€can“select“this“option“multiple“times“to“add“morÑðe“values“or“ranges.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2065) cvn H.B /DEST pdfmark endŸ}tÌDelete‘]por=ït/rangøeïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.27.27.2) cvn H.B /DEST pdfmark endŽŸ½ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2067) cvn H.B /DEST pdfmark endŸNБ0¾Select–±éthis“item“to“ršÑðemove“a“higher˜-number˜ed“port“number“or“port“range“you“en-Ž¡‘0terÑðed–L´earlier“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2068) cvn H.B /DEST pdfmark endÅAdditional“ports...“¾option.“A‘Lwindow“will“come“up“containingŽ¡‘0the–€enteršÑðed“ports“and“ranges.“Select“the“entry“you“want“delete“and“pr˜ess“Enter‘ÿB.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2069) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’™úèÅ57ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹:; X ‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.58) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€8.“Conguring“IPT‘þã×rafŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš‘`ÌLAN–]Station“IdentierÑ‘sïps:SDict begin H.S endïps:SDict begin 13.31 H.A endïNps:SDict begin [ /View [/XYZ H.V] /Dest (10.27.28.2) cvn H.B /DEST pdfmark endŽ‘`Ÿ3€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2071) cvn H.B /DEST pdfmark endŸ ÙM‘0¾The–8LAN‘station“statistics“facility“monitors“stations“based“on“their“rÑðespective“MACŽ¤ ‘0addršÑðesses.–¬‰The“hexadecimal“notation“of“these“addr˜esses“make“them“even“mor˜e“di-Ž¡‘0cult–* to“ršÑðemember“than“the“dotted-decimal“IP‘* addr˜esses,“so“these“facilities“wer˜e“addedŽ¡‘0to–€help“you“better“determine“which“station“is“which.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2072) cvn H.B /DEST pdfmark endŸ.‘0Selecting–Ááthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2073) cvn H.B /DEST pdfmark endÅEthernet/PLIP‘ÁŽhost“descriptions...“¾or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2074) cvn H.B /DEST pdfmark endÅFDDI/T‘þã×oken“Ring“host“descriptions...Ž¡‘0¾options–€brings“up“a“submenu“asking“you“to“add,“edit,“or“delete“descriptions.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2075) cvn H.B /DEST pdfmark endŸ.‘0T‘ÿo–ñÔadd“a“new“description,“select“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2076) cvn H.B /DEST pdfmark endÅAdd“description...“¾option.“A‘ñ°dialog“box“will“appear‘ÿB,Ž¡‘0asking–L®you“for“the“MAC‘L¡addršÑðess“and“an“appr˜opriate“description.“T‘ÿ ype“in“the“addr˜essŽ¡‘0in–Òhexadecimal“notation“with“no“punctuation“of“any“kind.“The“dialog“box“is“case-Ž¡‘0insensitive–€for“the“addršÑðess;“the“alphabetical“digits“A“to“F“will“be“stor˜ed“in“lower˜case.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2077) cvn H.B /DEST pdfmark endŸ.‘0Use–²˜the“T‘ÿab“key“to“move“between“elds“and“Enter“to“accept.“PršÑðess“Ctrl+X‘²‹to“discar˜dŽ¡‘0this–€dialog“and“rÑðeturn“to“the“main“menu.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2078) cvn H.B /DEST pdfmark endŸ.‘0The–Þ,description“may“be“anything:“the“IP‘ÞaddrÑðess,“a“fully-qualied“domain“name,“orŽ¡‘0a–€description“of“your“liking“as“long“as“the“eld“can“hold.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2079) cvn H.B /DEST pdfmark endŸ.‘0Enter–as“many“descriptions“as“you“need.“PrÑðess“Ctrl+X‘gat“a“blank“dialog“after“you“haveŽ¡‘0enterÑðed–€the“last“entryŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2080) cvn H.B /DEST pdfmark endŸ.‘0These–descriptions“will“be“displayed“alongside“the“MAC›÷addrÑðesses“in“the“LAN˜sta-Ž¡‘0tion–€monitor‘ÿB,“together“with“the“type“of“frame“(Ethernet,“PLIP‘þµÇ,“or“FDDI).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2081) cvn H.B /DEST pdfmark endŸ.‘0An–J existing“addrÑðess“or“description“may“be“edited“by“selecting“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2082) cvn H.B /DEST pdfmark endÅEdit“description...Ž¡‘0¾option–E5fršÑðom“the“submenu.“A‘E&panel“will“appear“with“a“list“of“existing“addr˜ess“descrip-Ž¡‘0tions.–èfSelect“the“one“you“wish“to“edit“and“prÑðess“Enter‘ÿB.“A‘èKdialog“box“identical“to“thatŽ¡‘0when–âyou“add“a“description“will“appear“with“prÑðelled“elds.“Just“backspace“over“andŽ¡‘0edit–€the“elds.“PrÑðess“Enter“to“accept“or“Ctrl+X“to“cancel.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2083) cvn H.B /DEST pdfmark endŸ.‘0Selecting–&Lthe“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2084) cvn H.B /DEST pdfmark endÅDelete“description...“¾submenu“item“brings“up“the“selection“panel.“SelectŽ¡‘0the–þFdescription“you“want“to“delete“and“pršÑðess“Enter‘ÿB.“Y‘ÿou“can“also“pr˜ess“Ctrl+X‘ýãtoŽ¡‘0cancel–€the“operation.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2085) cvn H.B /DEST pdfmark endŸ.‘0IPT‘ÿ raf–]µ2.4“and“later“also“ršÑðecognizes“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2086) cvn H.B /DEST pdfmark endÈ/etc/ethers“¾le.“Should“a“har˜dwar˜e“addr˜essŽ¡‘0be–KprÑðesent“in“the“IPT›ÿ raf“denition“les“and“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2087) cvn H.B /DEST pdfmark endÈ/etc/ethers¾,“the“IPT˜raf“denition“willŽ¡‘0be‘€used.Žž7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2088) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2090) cvn H.B /DEST pdfmark endŸ ¯^‘DÐNote:–ï4ÏThe“descr"‰iption“le“fºåor“Ether9™net“and“PLIP›ïis“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2091) cvn H.B /DEST pdfmark endÑethernet.descÏ,“while“the“FDDI˜andŽ¤ æf‘DT›þëˆokÑîen–\CRing“mappings“are“stored“in“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2092) cvn H.B /DEST pdfmark endÑfddi.desc“Ïin“the“IPT˜ršèöaf“w˜or"‰king“directorEy‘ÿ™.“These“lesŽ¡‘Dare–Ðin“colon-delimited“tešºåxt“f˜or9™mat.“Database“engines“or“custom“scr"‰ipts“can“be“told“toŽ¡‘Dappend–€}data“lines“to“those“lesšÝv.“Each“line“fºåollo˜ws“this“simple“fºåor9™mat:Ž¤ äùïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2093) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2094) cvn H.B /DEST pdfmark end©ý‘DÓaddressÑ:ïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2095) cvn H.B /DEST pdfmark endÓdescriptionŽŸ E‹ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2096) cvn H.B /DEST pdfmark endŸ Û‘DÏF•ºåor‘€}e“xampleŽ¡ïps:SDict begin H.S endïps:SDict begin 8.91 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2097) cvn H.B /DEST pdfmark end¦‘DÑ00201e457e:Cisco–Ü)3640“gatewayŽŸ E‹ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2098) cvn H.B /DEST pdfmark endŸ Û‘DÏDo–€}not“put“colonsšÝv,“per"‰iods˜,“or“an˜y“inÑîvÆfalid“charèöacters“in“the“MAºåC“address˜.ŽŸŽŸ0‘`ïcolor push BlackÅ58ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹;; rä‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.59) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (BACKOP) cvn H.B /DEST pdfmark endŸ ®;ÃChapter–ï9.“Bac•µkgr“ound‘ïOperationïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (11.0) cvn H.B /DEST pdfmark endŽŸ‘Êïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2101) cvn H.B /DEST pdfmark endŸ¾‘0¾IPT‘ÿ raf‘ŒÈ's–¾Ñfacilities“can“be“placed“in“the“backgrÑðound“solely“for“logging.“When“rëˆunningŽ¤ ‘0in–¥the“backgršÑðound,“it“doesn't“display“any“output“on“the“scr˜een,“and“doesn't“r˜eceiveŽ¡‘0input–€fršÑðom“the“keyboar˜d,“and“dr˜ops“you“back“to“the“shell.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2102) cvn H.B /DEST pdfmark endŸ.‘0BeforšÑðe–?ustarting“a“statistical“facility“in“the“backgr˜ound,“congur˜e“IPT‘ÿ raf“in“the“usualŽ¡‘0way–€(set“lters,“add“TCP/UDP“ports,“etc).Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2103) cvn H.B /DEST pdfmark endŸ.‘0Once–ݳthat's“done,“exit“all“instances“of“IPT›ÿ raf“on“the“system,“then“invoke“IPT˜raf“frÑðomŽ¡‘0the–¤command“line“with“the“parameter“to“start“the“facility“you“want,“the“timeout“(ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2104) cvn H.B /DEST pdfmark endÈ-t¾)Ž¡‘0parameter–Hif“you“wish,“and“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2105) cvn H.B /DEST pdfmark endÈ-B‘H¾parameter“to“actually“daemonize“the“prÑðogram.“ForŽ¡‘0example,–Àto“rëˆun“the“IP‘žtrac“monitor“in“the“backgrÑðound“for“all“interfaces,“issue“theŽ¡‘0commandŽŸ 7ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2106) cvn H.B /DEST pdfmark endŸ ¯^‘0Èiptraf–ff-i“all“-BŽ© i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2107) cvn H.B /DEST pdfmark endŸ –I‘0¾T‘ÿo–x rëˆun“the“detailed“interface“statistics“on“interface“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2108) cvn H.B /DEST pdfmark endÈeth0“¾for“5“minutes“in“the“back-Ž¡‘0grÑðound:ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2109) cvn H.B /DEST pdfmark endŸ~‘0Èiptraf–ff-d“eth0“-t“5“-BŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2110) cvn H.B /DEST pdfmark endŸ –I‘0¾If–úthe“timeout“parameter“is“not“specied,“the“facility“will“rëˆun“until“the“pršÑðocess“r˜eceivesŽ¡‘0a–€USR2“signal.“T‘ÿo“stop“a“facility“in“the“backgrÑðound,“do“aŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2111) cvn H.B /DEST pdfmark endŸ~‘0Èps‘ffxŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2112) cvn H.B /DEST pdfmark endŸ –I‘0¾at–ýthe“command“line,“and“nd“the“pršÑðocess“id“(pid)“of“the“iptraf“pr˜ocess“you'r˜e“lookingŽ¡‘0for‘ÿB.–€Then“send“that“prÑðocess“a“USR2“signal“with“the“kill“command:ŽŸ Ñèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2113) cvn H.B /DEST pdfmark endŸ~‘0Èkill–ff-USR2“pidŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2114) cvn H.B /DEST pdfmark endŸ –I‘0¾Since–è×IPT‘ÿ raf“cannot“send“erršÑðor“messages“to“the“terminal,“all“messages“ar˜e“written“toŽ¡‘0the–€le“daemon.log“in“the“IPT‘ÿ raf“logging“dirÑðectory‘þã×.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2115) cvn H.B /DEST pdfmark endŸ.‘0The–«£ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2116) cvn H.B /DEST pdfmark endÈ-B‘«˜¾parameter“automatically“enables“logging“r•Ñðegar“dless–«£of“its“congurÑðed“setting.Ž¡‘0The–‘§parameter“is“ignorÑðed“if“not“used“with“one“of“the“parameters“to“start“a“facilityŽ¡‘0frÑðom–€the“command“line.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2117) cvn H.B /DEST pdfmark endŸ Èø‘0The–ã¼log“le“can“be“specied“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2118) cvn H.B /DEST pdfmark endÈ-L‘㢾command-line“parameter‘ÿB.“If“this“parameterŽ¡‘0is–l>not“specied,“the“default“log“le“name“for“the“facility“will“be“used“(see“the“descrip-Ž¡‘0tions–qëof“the“facilities“above“for“the“default“log“name“patterns).“If“you“don't“specify“anŽ¡‘0path,–€the“log“le“will“be“placed“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2119) cvn H.B /DEST pdfmark endÈ/var/log/iptraf¾.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2120) cvn H.B /DEST pdfmark endŸ.‘0The–i›logging“interval“for“all“facilities“(except“the“IP‘i•trac“monitor)“can“also“be“overri-Ž¡‘0den–€with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2121) cvn H.B /DEST pdfmark endÈ-I“¾command-line“parameter‘ÿB.ŽŽŸ0‘`ïcolor push Black’šÅ59ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹<; 2‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.60) cvn H.B /DEST pdfmark endï color popŸüfdÅChapter–€9.“BackgrÑðound“OperationŽŽŽŽŽŽŽ’¤ï color popŽŽ  Ÿ0‘`ïcolor push Black60ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹=; §½‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.61) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïLps:SDict begin [ /View [/XYZ H.V] /Dest (MESSAGES) cvn H.B /DEST pdfmark endŸ ®;ÃAppendix–ïA.“MessaÚ†g%yesïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (12.0) cvn H.B /DEST pdfmark endŽŸ‘Êïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2124) cvn H.B /DEST pdfmark endŸ¾‘0¾IPT‘ÿ raf‘ŒÈ's–¥imessages“aršÑðe“pr˜esented“in“two“ways.“In“interactive“mode,“messages“ar˜e“dis-Ž¤ ‘0played–H´in“a“distictive“message“box.“In“daemon“(backgršÑðound)“mode,“appr˜opriate“mes-Ž¡‘0sages–æharšÑðe“written“to“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2125) cvn H.B /DEST pdfmark endÈiptraf.log“¾le“in“the“IPT‘ÿ raf“log“dir˜ectory“(normally“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2126) cvn H.B /DEST pdfmark endÈ/var/log/iptraf¾.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïRps:SDict begin [ /View [/XYZ H.V] /Dest (IPTRAFMESSAGES) cvn H.B /DEST pdfmark endŸÍ×ÇIPT‘þïoraf‘³6MessaÝîg"esïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (12.28.1) cvn H.B /DEST pdfmark endŽŸöïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2130) cvn H.B /DEST pdfmark endŸ§®ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2132) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2133) cvn H.B /DEST pdfmark endŸ å‘0ÈUnable–ffto“create“config“fileŽ©i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2134) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2135) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–>‚cannot“crÑðeate“the“conguration“le.“The“most“likely“cause“of“this“is“thatŽ¡‘Dyou–æhdidn't“pršÑðoperly“install“the“pr˜ogram,“and“the“necessary“dir˜ectory“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2136) cvn H.B /DEST pdfmark endÈ/var/local/iptrafŽ¡‘D¾does–Çlnot“exist.“Can“also“be“generated“if“you“have“a“disk“prÑðoblem“or“if“you“haveŽ¡‘Dtoo–€many“les“open.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2137) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2139) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2140) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“read“config“fileŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2141) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2142) cvn H.B /DEST pdfmark endŸ –I‘D¾The–€conguration“r•Ñðecor“d–€cannot“be“ršÑðead.“Y‘ÿou“most“likely“have“a“disk“pr˜oblem.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2143) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2145) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2146) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“write“config“fileŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2147) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2148) cvn H.B /DEST pdfmark endŸ –I‘D¾The–%lconguration“le“cannot“be“written.“Y‘ÿou“either“have“a“disk“prÑðoblem,“orŽ¡‘D(morÑðe–€likely),“your“disk“is“full.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2149) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2151) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2152) cvn H.B /DEST pdfmark end¡‘0ÈEnter–ffan“appropriate“description“for“this“filterŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2153) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2154) cvn H.B /DEST pdfmark endŸ –I‘D¾Enter–€something“to“clearly“describe“the“lter“you“arÑðe“dening.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2155) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2157) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2158) cvn H.B /DEST pdfmark end¡‘0ÈError–ffloading“filter“list“fileŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2159) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2160) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–Ú³cannot“access“the“list“of“dened“TCP›Ú›or“UDP˜lters.“Can“also“be“an“indi-Ž¡‘Dcator–€of“a“bad“disk.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2161) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2163) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2164) cvn H.B /DEST pdfmark end¡‘0ÈError–ffwriting“filter“list“fileŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2165) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2166) cvn H.B /DEST pdfmark endŸ –I‘D¾The–õÙlter“list“le“cannot“be“written“to.“Y‘ÿou“may“have“trÑðouble“accessing“yourŽ¡‘Dlters.Ž©‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2167) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2169) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2170) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“read“TCP/UDP/misc“IP“filter“fileŽŸµÿïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2171) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2172) cvn H.B /DEST pdfmark endŸ J‘D¾IPT‘ÿ raf–€cannot“rÑðead“the“lter“data“o“the“le.“Could“be“caused“by“a“bad“disk.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2173) cvn H.B /DEST pdfmark endŽŽŸ0‘`ïcolor push Blackïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2177) cvn H.B /DEST pdfmark endŸfd’šÅ61ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹>; ª_‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.62) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2228) cvn H.B /DEST pdfmark endŸfdÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2175) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2176) cvn H.B /DEST pdfmark endŸ ‘0ÈError–ffopening“filter“data“fileŽ¤‘D¾IPT‘ÿ raf–÷Mcannot“open“the“lter“le.“Could“be“caused“by“a“shortage“of“le“descriptorsŽ© ‘Dor–€a“bad“disk.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2179) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2181) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2182) cvn H.B /DEST pdfmark end¦‘0ÈUnable–ffto“write“filter“dataŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2183) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2184) cvn H.B /DEST pdfmark endŸ Ï ‘D¾IPT‘ÿ raf–µcannot“add“the“newly“dened“lter“to“the“lter“list.“This“may“be“due“to“aŽ¦‘Dbad‘€disk.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2185) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2187) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2188) cvn H.B /DEST pdfmark end¦‘0ÈCannot–ffcreate“filter“data“fileŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2189) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2190) cvn H.B /DEST pdfmark endŸ Ï ‘D¾IPT‘ÿ raf–€cannot“cršÑðeate“the“lter“r˜ecor˜d“le.“The“dened“lter“is“lost.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2191) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2193) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2194) cvn H.B /DEST pdfmark end¦‘0ÈUnable–ffto“save“filter“changesŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2195) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2196) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–¢rcannot“save“the“changes“you“made“to“the“lter‘ÿB.“Y‘ÿou“prÑðobably“have“a“diskŽ¦‘DerrÑðor‘ÿB.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2197) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2199) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2200) cvn H.B /DEST pdfmark end¦‘0ÈUnable–ffto“write“filter“state“informationŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2201) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2202) cvn H.B /DEST pdfmark endŸ Ï ‘D¾The–zjcurršÑðent“state“of“the“lters“cannot“be“saved.“IPT‘ÿ raf“will“be“unable“to“corr˜ectlyŽ¦‘DrÑðeload–wthe“lters“the“next“time“it's“started.“This“can“be“caused“by“a“bad“disk“orŽ¦‘DimprÑðoper‘€installation.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2203) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2205) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2206) cvn H.B /DEST pdfmark end¦‘0ÈUnable–ffto“save“interface“flagsŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2207) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2208) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–VTwas“unable“to“save“the“ags“of“the“network“interfaces.“This“is“prÑðobablyŽ¦‘Ddue–€to“a“bad“installation“or“full“lesystem.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2209) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2211) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2212) cvn H.B /DEST pdfmark end¦‘0ÈUnable–ffto“retrieve“saved“interface“flagsŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2213) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2214) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–râwas“unable“to“ršÑðetrieve“the“save“interface“ags.“Pr˜obably“again“due“to“aŽ¦‘Dbad–€installation“or“full“lesystem.Ž¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2215) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2217) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2218) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2219) cvn H.B /DEST pdfmark end¦‘0Éprotocol–ffÈfilter“data“file“in“use;“try“again“laterŽ¤i·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2220) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2221) cvn H.B /DEST pdfmark end© –I‘0Filter–ffstate“file“in“use;“try“again“laterŽ¡ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2222) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2223) cvn H.B /DEST pdfmark end¦‘D¾Another–õëIPT‘ÿ raf“prÑðocess“is“modifying“the“TCP‘þµÇ,“UDP›õ‹or“miscellaneous“IP˜lterŽ¤ ‘Ddata–E£or“the“lter“state“le“and“has“locked“the“les“or“le.“T‘ÿ ry“again“once“the“otherŽ¡‘DIPT‘ÿ raf–óÐprÑðocess“has“terminated“or“completed“its“modications“and“unlocked“theŽ¡‘Dles.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2224) cvn H.B /DEST pdfmark endŽŽŸ0‘`ïcolor push BlackÅ62ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹?; Ê‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.63) cvn H.B /DEST pdfmark endï color popŸüfd’G€AÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2226) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2227) cvn H.B /DEST pdfmark endŸ ‘0ÈUnable–ffto“resolve“hostnameŽ©‘D¾The–ðŠindicated“host“name“in“the“lter“cannot“be“ršÑðesolved“into“an“IP‘ðfaddr˜ess.“CheckŽ¤ ‘Dthe–˜nlocal“hosts“database“È/etc/hosts“¾or“your“machine's“DNS‘˜&conguration“orŽ¡‘DDNS–€server‘ÿB.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2231) cvn H.B /DEST pdfmark end“The“lter“parameters“will“not“be“used.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2232) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2234) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2235) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“open“host“description“fileŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2236) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2237) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–¥Úcannot“open“the“le“containing“the“descriptions“for“Ethernet“or“FDDI‘¥Ðad-Ž¡‘DdrÑðesses.–€Could“be“due“to“a“bad“disk“or“a“hit“on“the“le“descriptor“limit.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2238) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2240) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2241) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“write“host“descriptionŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2242) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2243) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–òwas“unable“to“write“the“description“r•Ñðecor“d–òfor“this“Ethernet“or“FDDI‘òbad-Ž¡‘DdrÑðess.–€Could“be“due“to“a“bad“disk“or“corrëˆupted“lesystem.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2244) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2246) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2247) cvn H.B /DEST pdfmark end¡‘0ÈNo‘ffdescriptionsŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2248) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2249) cvn H.B /DEST pdfmark endŸ –I‘D¾Y‘ÿou–€tried“to“edit“or“delete“a“description“with“no“prÑðevious“descriptions“dened.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2250) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2252) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2253) cvn H.B /DEST pdfmark end¡‘0ÈCannot–ffopen“log“fileŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2254) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2255) cvn H.B /DEST pdfmark endŸ –I‘D¾TheršÑðe–Ã}is“a“pr˜oblem“opening“the“log“le.“Ther˜e“is“most“likely“a“pr˜oblem“with“theŽ¡‘Ddisk,–€or“theršÑðe“ar˜e“too“many“open“les.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2256) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2258) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2259) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“obtain“interface“listŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2260) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2261) cvn H.B /DEST pdfmark endŸ Ï ‘D¾IPT‘ÿ raf–ú‘was“unable“to“ršÑðetrieve“the“list“of“network“interfaces“fr˜om“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2262) cvn H.B /DEST pdfmark endÈ/proc“¾lesys-Ž¡‘Dtem.–óxThis“may“be“due“to“a“badly“congurÑðed“kernel.“IPT‘ÿ raf“needs“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2263) cvn H.B /DEST pdfmark endÈ/proc“¾lesystemŽ¡‘Dsupport.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2264) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2266) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2267) cvn H.B /DEST pdfmark end¡‘0ÈNo–ffactive“interfaces.“Check“their“status“or“the“/proc“filesystem.ŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2268) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2269) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–æhfound“no“active“interfaces.“Either“all“interfaces“arÑðe“down“or“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2270) cvn H.B /DEST pdfmark endÈ/proc/net/devŽ¡‘D¾le–æhwas“empty“or“unavailable.“Activate“at“least“one“interface“or“check“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2271) cvn H.B /DEST pdfmark endÈ/proc/net/devŽ¡‘D¾le.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2272) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2274) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2275) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“obtain“interface“parameters“for“interfaceŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2276) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2277) cvn H.B /DEST pdfmark endŸ –I‘D¾The–‰{system“call“to“rÑðetrieve“the“interface's“ags“failed.“Check“your“interface“orŽ¡‘Dkernel‘€driver‘ÿB.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2278) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2280) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2281) cvn H.B /DEST pdfmark end¡‘0ÈPromisc–ffchange“failed“for“interfaceŽŽŸ0‘`ïcolor push Black’šÅ63ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹@; è^‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.64) cvn H.B /DEST pdfmark endï color popŸüfdÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2282) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2283) cvn H.B /DEST pdfmark endŸ ‘D¾The–}system“call“to“change“the“prÑðomiscuous“ag“failed.“Check“your“interface“orŽ¤ ‘Dits–€kernel“driver‘ÿB.Ž©‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2284) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2286) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2287) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“open“raw“socket“for“flag“changeŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2288) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2289) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–¨Õwas“unable“to“open“the“necessary“socket“for“the“prÑðomiscuous“change“op-Ž¡‘Deration.–€May“be“due“to“a“shortage“of“le“descriptors.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2290) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2292) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2293) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“open“socket“for“MTU“determinationŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2294) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2295) cvn H.B /DEST pdfmark endŸ –I‘D¾Returned–Àõby“the“facility“for“detailed“interface“statistics“if“the“raw“socket's“open-Ž¡‘Ding–€sequence“failed.“The“facility“will“abort.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2296) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2298) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2299) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“open“raw“socketŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2300) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2301) cvn H.B /DEST pdfmark endŸ|¯‘D¾IPT‘ÿ raf–Fawas“unable“to“open“the“raw“socket“for“packet“capturÑðe.“May“be“due“to“aŽŸ  ‘Dshortage–€of“le“descriptors.“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2302) cvn H.B /DEST pdfmark endŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2304) cvn H.B /DEST pdfmark endŸ~‘XÐReminder:–m ÏIPT‘þëˆršèöaf“2.x.x“requires“Lin˜ux“kšÑîer9™nel“2.2.x,“with“the“P£Üac˜k˜et“Soc˜k˜et“optionŽ¤ æf‘Xcompiled–‘ in“or“installed“as“a“moduleÝv.“IPT‘þëˆrèöaf“2.x“will“retur9™n“this“error“on“a“pre-2.2Ž¡‘XkšÑîer9™nel–€}or“on“a“2.2“k˜er9™nel“without“P£Üac˜k˜et“Soc˜k˜et.Ž¦Ÿ¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2305) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2307) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2308) cvn H.B /DEST pdfmark end¤ ‘0ÈUnable–ffto“obtain“interface“MTUŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2309) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2310) cvn H.B /DEST pdfmark endŸ Ï ‘D¾The–˜detailed“statistics“facility“was“unable“to“obtain“the“maximum“transmissionŽ¡‘Dunit–€(MTU)“for“the“selected“interface.“The“facility“will“abort.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2311) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2313) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2314) cvn H.B /DEST pdfmark end¡‘0ÈSpecified–ffinterface“not“supportedŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2315) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2316) cvn H.B /DEST pdfmark endŸ –I‘D¾The–ÿinterface“specied“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2317) cvn H.B /DEST pdfmark endÈ-i¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2318) cvn H.B /DEST pdfmark endÈ-d¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2319) cvn H.B /DEST pdfmark endÈ-s¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2320) cvn H.B /DEST pdfmark endÈ-l¾,“or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2321) cvn H.B /DEST pdfmark endÈ-z“¾command-line“parametersŽ¡‘Dis–€not“supported“by“IPT‘ÿ raf.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2322) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2324) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2325) cvn H.B /DEST pdfmark end¡‘0ÈSpecified–ffinterface“not“activeŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2326) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2327) cvn H.B /DEST pdfmark endŸ –I‘D¾The–ÿinterface“specied“with“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2328) cvn H.B /DEST pdfmark endÈ-i¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2329) cvn H.B /DEST pdfmark endÈ-d¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2330) cvn H.B /DEST pdfmark endÈ-s¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2331) cvn H.B /DEST pdfmark endÈ-l¾,“or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2332) cvn H.B /DEST pdfmark endÈ-z“¾command-line“parametersŽ¡‘Dis–€supported,“but“not“currÑðently“activated.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2333) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2335) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2336) cvn H.B /DEST pdfmark end¡‘0ÈFatal:–ffmemory“allocation“errorŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2337) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2338) cvn H.B /DEST pdfmark endŸ|¯‘D¾May–Žãoccur“if“you“have“too“little“memory“to“allocate“for“windows,“the“menu“sys-ŽŸ  ‘Dtem,– or“dialog“boxes.“IPT‘ÿ raf“tries“to“prÑðevent“further“allocations“if“memory“rëˆunsŽŽŸ0‘`ïcolor push BlackÅ64ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹A; °‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.65) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2393) cvn H.B /DEST pdfmark endŸfd’G€AÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¤¾out–Ähduring“a“monitor›ÿB.“However˜,“this“could“also“mean“a“bug“if“you'ršÑðe“r˜eason-Ž¤  ’¤ably–ªUsuršÑðe“you'r˜e“not“out“of“memory‘þã×.“An“instrëˆuctional“message“on“bug“r˜eportingŽ¡’¤follows–€this“message.“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2339) cvn H.B /DEST pdfmark endŽ‘`ŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2341) cvn H.B /DEST pdfmark endŸ~‘XÐT‘ÿuÃecèöhnical–èrnote:“ÏThis“is“actually“a“response“to“the“segmentation“fºåault“error“(SIGSEGV).Ž¤Ÿ¡‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2342) cvn H.B /DEST pdfmark endŽ©ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2344) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2345) cvn H.B /DEST pdfmark end¤ ‘0ÈThis–ffprogram“can“be“run“only“by“the“system“administratorŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2346) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2347) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–º•normally“does“not“allow“anybody“but“uid“0“(rÑðoot)“to“rëˆun“it.“This“mea-Ž¡‘DsuršÑðe–óIis“included“for“safety“r˜easons.“See“the“section“on“r˜ecompiling“the“pr˜ogramŽ¡‘Dbelow–L;if“you“want“to“override“this.“This“featurÑðe“is“built“in,“and“not“part“of“theŽ¡‘DcongurationŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2348) cvn H.B /DEST pdfmark endŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2350) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2351) cvn H.B /DEST pdfmark end¡‘0ÈYour–ffTERM“variable“is“not“setŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2352) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2353) cvn H.B /DEST pdfmark endŸ Ï ‘D¾The–¥ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2354) cvn H.B /DEST pdfmark endTERM‘¤ù(terminal“type)“envirÑðonment“variable“must“be“set“to“a“valid“terminalŽ¡‘Dtype–¹2so“that“the“scršÑðeen“management“r˜outines“can“function“pr˜operly‘þã×.“Set“it“to“theŽ¡‘DapprÑðopriate–äterminal“type.“Linux“consoles“typically“have“their“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2355) cvn H.B /DEST pdfmark endTERM‘¼variablesŽ¡‘Dset–€to“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2356) cvn H.B /DEST pdfmark endÈlinux¾.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2357) cvn H.B /DEST pdfmark endŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2359) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2360) cvn H.B /DEST pdfmark end¡‘0ÈReceived–ffTERM“signalŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2361) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2362) cvn H.B /DEST pdfmark endŸ –I‘D¾Not–ÁIršÑðelated“to“the“pr˜evious“message.“The“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2363) cvn H.B /DEST pdfmark endÈTERM‘Àö¾(terminate)“signal“is“normallyŽ¡‘Dused–eÙto“gracefully“shut“down“a“prÑðogram.“This“message“simply“indicates“that“theŽ¡‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2364) cvn H.B /DEST pdfmark endÈTERM‘â¾signal–was“caught“and“IPT‘ÿ raf“is“attempting“to“shut“down“as“gracefully“asŽ¡‘Dpossible.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2365) cvn H.B /DEST pdfmark endŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2367) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2368) cvn H.B /DEST pdfmark end¡‘0ÈInvalid–ffoption“or“missing“parameter,“use“iptraf“-h“for“helpŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2369) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2370) cvn H.B /DEST pdfmark endŸ –I‘D¾The–O›ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2371) cvn H.B /DEST pdfmark endÈ-i¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2372) cvn H.B /DEST pdfmark endÈ-d¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2373) cvn H.B /DEST pdfmark endÈ-s¾,“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2374) cvn H.B /DEST pdfmark endÈ-l¾,“or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2375) cvn H.B /DEST pdfmark endÈ-z“¾options“werÑðe“specied“but“no“interface“was“speciedŽ¡‘Don–ëthe“command“line.“These“parameters“r•Ñðequir“e–ëa“valid“interface“name“(or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2376) cvn H.B /DEST pdfmark endÈallŽ¡‘D¾for–ôïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2377) cvn H.B /DEST pdfmark endÈ-i“¾or“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2378) cvn H.B /DEST pdfmark endÈ-l¾).ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2379) cvn H.B /DEST pdfmark end“This“message“also“appears“if“an“unknown“option“is“passed“to“theŽ¡‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2380) cvn H.B /DEST pdfmark endÄiptraf‘€¾command.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2381) cvn H.B /DEST pdfmark endŽ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2383) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2384) cvn H.B /DEST pdfmark end¡‘0ÈWarning:–ffunable“to“tag“this“processŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2385) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2386) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–¬Ënormally“tags“itself“when“it“rëˆuns“to“prÑðevent“multiple“instances“of“the“sta-Ž¡‘Dtistical–öfacilities“fršÑðom“rëˆunning.“This“message“means“the“pr˜ogram“was“unable“toŽ¡‘DcršÑðeate–Úhthe“necessary“tag“le.“This“may“be“due“to“a“bad“or“impr˜oper“installation.Ž¡‘DT‘ÿ ry–5¢rëˆunning“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2387) cvn H.B /DEST pdfmark endÄmake“install“¾pr•Ñðocedur“e–5¢or“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2388) cvn H.B /DEST pdfmark endÄSetup“¾in“the“distribution's“top-Ž¡‘Dlevel‘€dirÑðectory‘þã×.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2389) cvn H.B /DEST pdfmark endŽŽŸ0‘`ïcolor push Black’šÅ65ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹B; *ò‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.66) cvn H.B /DEST pdfmark endï color popŸüfdÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2391) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2392) cvn H.B /DEST pdfmark endŸ ‘0ÈWarning:–ffunable“to“tag“facilityŽ©‘D¾IPT‘ÿ raf–\›was“unable“to“crÑðeate“the“tag“le“for“the“facility“you“started.“The“facilityŽ¤ ‘Dwill–ð½still“ršëˆun,“but“other“instances“of“IPT‘ÿ raf“that“may“be“r˜unning“simultaneouslyŽ¡‘Dwill–×allow“the“same“facility“to“rëˆun.“This“may“cause“both“instances“of“the“facilityŽ¡‘Dto–€malfunction.“This“could“be“due“to“a“bad“disk“or“bad“installation.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2395) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2397) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2398) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2399) cvn H.B /DEST pdfmark end¡‘0Éfacility‘%ŸÈalready–ffrunning/listening“on“interfaceŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2400) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2401) cvn H.B /DEST pdfmark endŸ –I‘D¾The–/Žfacility“you“tried“to“start“is“currÑðently“rëˆunning“on“the“indicated“interface“inŽ¡‘Danother–Œ­IPT‘ÿ raf“pršÑðocess“on“the“machine.“This“r˜estriction“is“placed“to“pr˜event“con-Ž¡‘Dicts–€involving“internal“sockets“or“the“log“les.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2402) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2404) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2405) cvn H.B /DEST pdfmark end¡‘0ÈGeneral–ffinterface“statistics“already“active“in“another“processŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2406) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2407) cvn H.B /DEST pdfmark endŸ –I‘D¾Only–€one“instance“of“the“general“interface“statistics“can“rëˆun“at“a“time.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2408) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2410) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2411) cvn H.B /DEST pdfmark end¡‘0ÈDuplicate–ffport/range“entryŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2412) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2413) cvn H.B /DEST pdfmark endŸ –I‘D¾Y‘ÿou–íÍenteršÑðed“a“port“number“or“range“that“was“alr˜eady“added“to“the“list“of“addi-Ž¡‘Dtional–€ports“to“be“monitorÑðed“by“the“TCP/UDP“service“monitorŽ¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2414) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2416) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2417) cvn H.B /DEST pdfmark end¡‘0ÈNo–ffcustom“portsŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2418) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2419) cvn H.B /DEST pdfmark endŸ –I‘D¾Ther•Ñðe›€ar“e˜no˜ports˜or˜port˜ranges˜earlier˜added.˜Ther“e's˜nothing˜to˜delete.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2420) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2422) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2423) cvn H.B /DEST pdfmark end¡‘0ÈCan't–ffstart“rvnamed;“lookups“will“blockŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2424) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2425) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–öcannot“start“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2426) cvn H.B /DEST pdfmark endÄrvnamed“¾daemon;“prÑðobably“due“to“a“bad“installation.Ž¡‘DIPT‘ÿ raf–€will“fall“back“to“blocking“lookups.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2427) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2429) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2430) cvn H.B /DEST pdfmark end¡‘0ÈCan't–ffspawn“new“process;“lookups“will“blockŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2431) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2432) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT›ÿ raf–ÔŒcannot“start“a“new“prÑðocess.“This“may“be“due“to“memory“shortage.“IPT˜rafŽ¡‘Dwill–€fall“back“to“blocking“lookups.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2433) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2435) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2436) cvn H.B /DEST pdfmark end¡‘0ÈFork–fferror,“IPTraf“cannot“run“in“backgroundŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2437) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2438) cvn H.B /DEST pdfmark endŸ –I‘D¾IPT‘ÿ raf–¥Œcannot“start“a“new“pršÑðocess,“and“can“go“into“the“backgr˜ound.“This“may“beŽ¡‘Ddue–€to“memory“shortage.“IPT‘ÿ raf“aborts.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2439) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2441) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2442) cvn H.B /DEST pdfmark end¡‘0ÈNo–ffmemory“for“new“filter“entryŽŽŸ0‘`ïcolor push BlackÅ66ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹C; M`‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.67) cvn H.B /DEST pdfmark endï color popŸüfd’G€AÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2443) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2444) cvn H.B /DEST pdfmark endŸ ‘D¾IPT‘ÿ raf–was“unable“to“allocate“memory“for“a“new“lter“entry‘þã×.“Most“likely“due“toŽ¤ ‘Dmemory‘€shortage.Ž©‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2445) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2447) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2448) cvn H.B /DEST pdfmark end¡‘0ÈMemory‘ffLowŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2449) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2450) cvn H.B /DEST pdfmark endŸ|¯‘D¾This–mûindicator“appears“if“memory“rëˆuns“low“due“to“a“lot“of“entries“in“a“facility‘þã×.Ž¤  ‘DShould–T›critical“functions“fail“(window“cršÑðeation,“internal“allocation),“the“pr˜ogramŽ¡‘Dcould–€terminate“with“a“segmentation“violation.“ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2451) cvn H.B /DEST pdfmark endŽŸÑèïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2453) cvn H.B /DEST pdfmark endŸ~‘XÐNote:–BÏAnšÝvy“message“or“indicator“about“lo˜w“memorEy“means“that“yÑîour“system“doesŽ¤ æf‘Xnot–9‹haÑîvÆfe“enough“memorEy“to“handle“the“entr"‰iesÝv.“It“is“almost“cer\#tain“that“sooner“orŽ¡‘XlaterŒÌ,–•IPT‘þëˆrèöaf“or“other“applications“will“aborš\#t“due“to“the“fºåailure“of“impor˜tant“systemŽ¡‘Xcalls–€}or“librèöaršEy“functionsÝv.“Memor˜y“mèöust“be“added“r"‰ight“aÑîwÝvaºåy‘ÿ™.Ž¦Ÿ¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2454) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2456) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2457) cvn H.B /DEST pdfmark end¤ ‘0ÈIPC‘ffErrorŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2458) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2459) cvn H.B /DEST pdfmark endŸ Ï ‘D¾This–7indicator“appears“if“an“erršÑðor“occurs“r˜eceiving“data“fr˜om“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2460) cvn H.B /DEST pdfmark endÄrvnamed“¾pr˜o-Ž¡‘Dgram–øº(IPC‘ø›stands“for“InterprÑðocess“Communication).“This“indication“should“notŽ¡‘Doccur–úunder“normal“cirÑðcumstances.“Report“instances“of“this“condition“and“theŽ¡‘DciršÑðcumstances–Runder“which“it“happens.“Y‘ÿou“may“also“include“data“fr˜om“theŽ¡‘Dïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2461) cvn H.B /DEST pdfmark endÈrvnamed.log‘€¾le.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2462) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2464) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2465) cvn H.B /DEST pdfmark end¡‘0ÈError–ffopening“terminal:“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2466) cvn H.B /DEST pdfmark endÉterminalŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2467) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2468) cvn H.B /DEST pdfmark endŸ –I‘D¾The–7µscršÑðeen“management“r˜outines“cannot“nd“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2469) cvn H.B /DEST pdfmark endÈterminfo“¾entry“for“your“termi-Ž¡‘Dnal.–<IPT‘ÿ raf“expects“the“terminfo“database“located“in“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2470) cvn H.B /DEST pdfmark endÈ/usr/share/terminfo¾.“ThisŽ¡‘DerršÑðor–‹could“occur“when“your“terminfo“database“is“located“somewher˜e“else.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2471) cvn H.B /DEST pdfmark end“SeeŽ¡‘Dthe–€section“on“contršÑðolling“the“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2472) cvn H.B /DEST pdfmark endÈterminfo“¾sear˜ch“path.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2473) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2475) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2476) cvn H.B /DEST pdfmark end¡‘0ÈThis–ffwill“end“your“IPTraf“sessionŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2477) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2478) cvn H.B /DEST pdfmark endŸ –I‘D¾In–Éwinteractive“mode“IPT‘ÿ raf“asks“you“to“conrm“your“exit“command.“PrÑðess“EnterŽ¡‘Dto–jÉršÑðeturn“to“the“shell“or“any“other“key“to“cancel“your“command“and“r˜eturn“to“theŽ¡‘Dmain‘€menu.Ž¦Ÿ ïps:SDict begin H.S endïps:SDict begin 11 H.A endïSps:SDict begin [ /View [/XYZ H.V] /Dest (RVNAMEDMESSAGES) cvn H.B /DEST pdfmark endŸ"¤Çr•"vnamed‘³6MessaÝîg“esïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (12.29.1) cvn H.B /DEST pdfmark endŽŸ Éïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2481) cvn H.B /DEST pdfmark endŸ å‘0¾As–Ïùa“daemon,“rvnamed“does“not“send“messages“to“the“scrÑðeen.“It“writes“its“messagesŽ¡‘0to–€the“le“ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2482) cvn H.B /DEST pdfmark endÈrvnamed.log“¾in“the“IPT‘ÿ raf“log“dirÑðectory‘þã×.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2484) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2486) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2487) cvn H.B /DEST pdfmark endŸ.‘0ÈUnable–ffto“open“child“communication“socketŽŽŸ0‘`ïcolor push Black’™úèÅ67ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹D; lS‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.68) cvn H.B /DEST pdfmark endï color popŸüfdÅAppendix–€A.“MessagesŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2488) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2489) cvn H.B /DEST pdfmark endŸ ‘D¾rvnamed–­jwas“unable“to“open“the“communication“endpoint“for“data“rÑðeceptionŽ¤ ‘DfršÑðom–$the“childr˜en“it“cr˜eates.“This“is“highly“unusual,“and“should“it“occur‘ÿB,“r˜eportŽ¡‘Dthe‘€cirÑðcumstances.Ž©‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2490) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2492) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2493) cvn H.B /DEST pdfmark end¡‘0ÈUnable–ffto“open“client“communication“socketŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2494) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2495) cvn H.B /DEST pdfmark endŸ –I‘D¾rvnamed–ªwas“unable“to“open“the“communication“endpoint“for“data“exchangeŽ¡‘Dwith–¼%the“IPT‘ÿ raf“pršÑðogram.“This“is“highly“unusual,“and“should“it“occur‘ÿB,“r˜eport“theŽ¡‘DcirÑðcumstances.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2496) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2498) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2499) cvn H.B /DEST pdfmark end¡‘0ÈError–ffbinding“client“communication“socket“Error“binding“child“communicationŽ¡‘0socketŽŸ0`ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2500) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2501) cvn H.B /DEST pdfmark endŸ Ï ‘D¾rvnamed–+`was“unable“to“assign“a“name“to“the“indicated“communication“socket.Ž¡‘DThis–€may“be“due“to“a“bad,“full,“or“corrëˆupted“lesystem.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2502) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2504) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2505) cvn H.B /DEST pdfmark end¡‘0ÈFatal–fferror:“no“memory“for“descriptor“monitoringŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2506) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2507) cvn H.B /DEST pdfmark endŸ –I‘D¾rvnamed–€ran“out“of“memory‘þã×.“IPT‘ÿ raf“will“ršÑðesort“to“blocking,“and“may“fr˜eeze.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2508) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2510) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2511) cvn H.B /DEST pdfmark end¡‘0ÈError–ffon“fork,“returning“IP“addressŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2512) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2513) cvn H.B /DEST pdfmark endŸ –I‘D¾rvnamed–ÇÀhad“a“pršÑðoblem“spawning“a“copy“of“itself“to“r˜esolve“the“IP‘Ç®addr˜ess.“rv-Ž¡‘Dnamed–%will“simply“ršÑðeturn“the“IP‘$ôaddr˜ess“in“its“literal,“dotted-decimal“notation.Ž¡‘DIPT‘ÿ raf–ÁDwill“still“function“normally‘þã×.“This“may“be“due“to“lack“of“memory“or“a“prÑðo-Ž¡‘Dcess–€limit“hit.Ž¦‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2514) cvn H.B /DEST pdfmark endŽŸïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2516) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2517) cvn H.B /DEST pdfmark end¡‘0ÈMaximum–ffchild“process“limit“reachedŽŸi·ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2518) cvn H.B /DEST pdfmark endïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2519) cvn H.B /DEST pdfmark endŸ –I‘D¾rvnamed–µhas“ršÑðeached“its“maximum“number“of“child“pr˜ocesses.“This“is“intendedŽ¡‘Das–ɬa“"brake"“to“pršÑðevent“too“many“rvnamed“childr˜en“fr˜om“hogging“your“com-Ž¡‘Dputer‘½p's›¯’r•Ñðesour“ces˜and˜possibly˜crashing˜it.ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2520) cvn H.B /DEST pdfmark end˜Unless˜IPT‘ÿ raf˜is˜monitoring˜an˜ex-Ž¡‘DtrÑðemely–“1busy“network“without“lters,“this“shouldn't“happen,“at“least,“not“thatŽ¡‘Doften.–ТIf“you“notice“this“message,“try“applying“lters“or“check“your“DNS‘Ðserver‘ÿB.Ž¡‘DMany–V!times,“this“can“happen“when“the“DNS‘Vserver“goes“down“for“whatever“rÑðea-Ž¡‘Dson,–€and“you“have“rvnamed“childršÑðen“taking“too“long“to“r˜esolve.Ž¦ŽŸ0‘`ïcolor push BlackÅ68ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹E; Šg‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.69) cvn H.B /DEST pdfmark endï color popŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL) cvn H.B /DEST pdfmark endŸ ®;ÃAppendix–ïB.“GNU“Free“Documentation“Licenseïps:SDict begin H.S endïps:SDict begin 16.105 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (13.0) cvn H.B /DEST pdfmark endŽŸWµïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2523) cvn H.B /DEST pdfmark endŸø*‘0¾V‘þã×ersion–€1.1,“MarÑðch“2000ŽŸ£Óïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2524) cvn H.B /DEST pdfmark endŸïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2525) cvn H.B /DEST pdfmark endŸB“‘:ó9ŒEÕ( pplr8täCopyright–5(C)‘4Û2000“FršÖ‹ee“Softwar˜e“Foundation,“Inc.“59“T‘ÿ, emple“Place,“Suite“330,“Boston,Ž¤ æf‘:MA–û¢02111-1307›û³USA“Everyone˜is˜permitted˜to˜copy˜and˜distribute˜verbatim˜copies˜of˜thisŽ¡‘:license–@document,“but“changing“it“is“not“allowed.ŽŸ‘ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-0) cvn H.B /DEST pdfmark endŽŸ"Ÿ¿ÇPREAMBLEïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.30.1) cvn H.B /DEST pdfmark endŽŸ§®ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2528) cvn H.B /DEST pdfmark end¤ ‘0¾The–p[purpose“of“this“License“is“to“make“a“manual,“textbook,“or“other“written“docu-Ž¡‘0ment–vð"fršÑðee"“in“the“sense“of“fr˜eedom:“to“assur˜e“everyone“the“eective“fr˜eedom“to“copyŽ¡‘0and–#óršÑðedistribute“it,“with“or“without“modifying“it,“either“commer˜cially“or“noncommer˜-Ž¡‘0cially–þã×.›´Secondarily“,˜this˜License˜prÑðeserves˜for˜the˜author˜and˜publisher˜a˜way˜to˜getŽ¡‘0cršÑðedit–lRfor“their“work,“while“not“being“consider˜ed“r˜esponsible“for“modications“madeŽ¡‘0by‘€others.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2529) cvn H.B /DEST pdfmark endŸ.‘0This–ÆLicense“is“a“kind“of“"copyleft",“which“means“that“derivative“works“of“the“docu-Ž¡‘0ment–must“themselves“be“frÑðee“in“the“same“sense.“It“complements“the“GNU‘YGeneralŽ¡‘0Public–€License,“which“is“a“copyleft“license“designed“for“fršÑðee“softwar˜e.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2530) cvn H.B /DEST pdfmark endŸ.‘0W‘ÿe–î&have“designed“this“License“in“oršÑðder“to“use“it“for“manuals“for“fr˜ee“softwar˜e,“becauseŽ¡‘0fr•Ñðee›ôssoftwar“e˜needs˜fr“ee˜documentation:˜a˜fr“ee˜pr“ogram˜should˜come˜with˜manualsŽ¡‘0pršÑðoviding–@the“same“fr˜eedoms“that“the“softwar˜e“does.“But“this“License“is“not“limitedŽ¡‘0to–XsoftwaršÑðe“manuals;“it“can“be“used“for“any“textual“work,“r˜egar˜dless“of“subject“matterŽ¡‘0or–wÒwhether“it“is“published“as“a“printed“book.“W‘ÿe“rÑðecommend“this“License“principallyŽ¡‘0for–€works“whose“purpose“is“instrëˆuction“or“r•Ñðefer“ence.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-1) cvn H.B /DEST pdfmark endŸÒ1ÇAPPLICABILITY–³6AND“DEFINITIONSïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.31.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2533) cvn H.B /DEST pdfmark endŸ Õn‘0¾This–Z License“applies“to“any“manual“or“other“work“that“contains“a“notice“placed“byŽ¡‘0the–^Ïcopyright“holder“saying“it“can“be“distributed“under“the“terms“of“this“License.“TheŽ¡‘0"Document",–rºbelow‘ÿ,“rÑðefers“to“any“such“manual“or“work.“Any“member“of“the“public“isŽ¡‘0a–€licensee,“and“is“addrÑðessed“as“"you".Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2534) cvn H.B /DEST pdfmark endŸ.‘0A‘aÃ"Modied–aËV‘þã×ersion"“of“the“Document“means“any“work“containing“the“Document“orŽ¡‘0a–âportion“of“it,“either“copied“verbatim,“or“with“modications“and/or“translated“intoŽ¡‘0another‘€language.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2535) cvn H.B /DEST pdfmark endŸ.‘0A‘÷K"Secondary–÷nSection"“is“a“named“appendix“or“a“frÑðont-matter“section“of“the“DocumentŽ¡‘0that–âdeals“exclusively“with“the“rÑðelationship“of“the“publishers“or“authors“of“the“Docu-Ž¡‘0ment–å8to“the“Document's“overall“subject“(or“to“rÑðelated“matters)“and“contains“nothingŽ¡‘0that– °could“fall“dirÑðectly“within“that“overall“subject.“(For“example,“if“the“Document“isŽ¡‘0in–ÑÎpart“a“textbook“of“mathematics,“a“Secondary“Section“may“not“explain“any“mathe-Ž¡‘0matics.)–úÆThe“rÑðelationship“could“be“a“matter“of“historical“connection“with“the“subjectŽ¡‘0or–`with“ršÑðelated“matters,“or“of“legal,“commer˜cial,“philosophical,“ethical“or“political“po-Ž¡‘0sition›€r•Ñðegar“ding˜them.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2536) cvn H.B /DEST pdfmark endŸ.‘0The–þ“"Invariant“Sections"“aršÑðe“certain“Secondary“Sections“whose“titles“ar˜e“designated,Ž¡‘0as–ÿ*being“those“of“Invariant“Sections,“in“the“notice“that“says“that“the“Document“isŽ¡‘0rÑðeleased–€under“this“License.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2537) cvn H.B /DEST pdfmark endŸ Èø‘0The–’˜"Cover“T‘ÿexts"“aršÑðe“certain“short“passages“of“text“that“ar˜e“listed,“as“Fr˜ont-CoverŽ¡‘0T›ÿexts–"Óor“Back-Cover“T˜exts,“in“the“notice“that“says“that“the“Document“is“rÑðeleased“underŽ¡‘0this‘€License.ŽŽŸ0‘`ïcolor push Black’šÅ69ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹F; ¢¢‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.70) cvn H.B /DEST pdfmark endï color popŸüfdÅAppendix–€B.“GNU“FrÑðee“Documentation“LicenseŽŽŽŽŽŽŽ’¤ï color popŽŽ  ‘` ýïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2538) cvn H.B /DEST pdfmark endŸ ‘0¾A‘–Ü"T‘ÿ ransparšÑðent"––âcopy“of“the“Document“means“a“machine-r˜eadable“copy‘þã×,“r˜epr˜esentedŽ¤ ‘0in–Ø4a“format“whose“specication“is“available“to“the“general“public,“whose“contentsŽ¡‘0can–£ñbe“viewed“and“edited“diršÑðectly“and“straightforwar˜dly“with“generic“text“editorsŽ¡‘0or–L>(for“images“composed“of“pixels)“generic“paint“prÑðograms“or“(for“drawings)“someŽ¡‘0widely–?available“drawing“editor‘ÿB,“and“that“is“suitable“for“input“to“text“formatters“orŽ¡‘0for–ékautomatic“translation“to“a“variety“of“formats“suitable“for“input“to“text“formatters.“AŽ¡‘0copy–'úmade“in“an“otherwise“T‘ÿ ransparÑðent“le“format“whose“markup“has“been“designedŽ¡‘0to–°Ethwart“or“discourage“subsequent“modication“by“ršÑðeaders“is“not“T‘ÿ ranspar˜ent.“AŽ¡‘0copy–€that“is“not“"T‘ÿ ransparÑðent"“is“called“"Opaque".Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2539) cvn H.B /DEST pdfmark endŸ.‘0Examples–Ûof“suitable“formats“for“T‘ÿ ransparÑðent“copies“include“plain“ASCII‘uwithoutŽ¡‘0markup,–ê\T›ÿexinfo“input“format,“LaT˜eX›ê@input“format,“SGML˜or“XML˜using“a“publiclyŽ¡‘0available–9ÜDTD,“and“standarÑðd-conforming“simple“HTML‘9¬designed“for“human“mod-Ž¡‘0ication.–‰×Opaque“formats“include“PostScript,“PDF‘ÿ,“prÑðoprietary“formats“that“can“beŽ¡‘0ršÑðead–and“edited“only“by“pr˜oprietary“wor˜d“pr˜ocessors,“SGML›îor“XML˜for“which“theŽ¡‘0DTD‘3Àand/or–3ÓpršÑðocessing“tools“ar˜e“not“generally“available,“and“the“machine-generatedŽ¡‘0HTML–€pršÑðoduced“by“some“wor˜d“pr˜ocessors“for“output“purposes“only‘þã×.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2540) cvn H.B /DEST pdfmark endŸ.‘0The–"T‘ÿs8itle“Page"“means,“for“a“printed“book,“the“title“page“itself,“plus“such“followingŽ¡‘0pages–Ûas“aršÑðe“needed“to“hold,“legibly‘þã×,“the“material“this“License“r˜equir˜es“to“appear“in“theŽ¡‘0title–9ƒpage.“For“works“in“formats“which“do“not“have“any“title“page“as“such,“"T‘ÿs8itle“Page"Ž¡‘0means–FÊthe“text“near“the“most“pršÑðominent“appearance“of“the“work's“title,“pr˜eceding“theŽ¡‘0beginning–€of“the“body“of“the“text.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-2) cvn H.B /DEST pdfmark endŸÒ1ÇVERB™ÍA‘þÍ_TIM‘³6COPYINGïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.32.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2543) cvn H.B /DEST pdfmark endŸ Õn‘0¾Y‘ÿou–Ò9may“copy“and“distribute“the“Document“in“any“medium,“either“commerÑðcially“orŽ¡‘0noncommer•Ñðcially‘þã×,›EÀpr“ovided˜that˜this˜License,˜the˜copyright˜notices,˜and˜the˜licenseŽ¡‘0notice–¥saying“this“License“applies“to“the“Document“aršÑðe“r˜epr˜oduced“in“all“copies,“andŽ¡‘0that–%you“add“no“other“conditions“whatsoever“to“those“of“this“License.“Y‘ÿou“may“notŽ¡‘0use–]\)ïcolor push BlackF‘ÿ.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2566) cvn H.B /DEST pdfmark endInclude,–+ immediately“after“the“copyright“notices,“a“license“notice“giving“theŽ¤ ‘Hpublic–¾špermission“to“use“the“Modied“V‘þã×ersion“under“the“terms“of“this“License,Ž¡‘Hin–€the“form“shown“in“the“Addendum“below‘ÿ.Žž7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2567) cvn H.B /DEST pdfmark endŸÈø‘;^Áïcolor push BlackG.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2568) cvn H.B /DEST pdfmark endPršÑðeserve–[gin“that“license“notice“the“full“lists“of“Invariant“Sections“and“r˜equir˜edŽ¡‘HCover–€T‘ÿexts“given“in“the“Document's“license“notice.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2569) cvn H.B /DEST pdfmark end¤ .‘:®ïcolor push BlackH.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2570) cvn H.B /DEST pdfmark endInclude–€an“unalterÑðed“copy“of“this“License.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2571) cvn H.B /DEST pdfmark end¡‘?¡Hïcolor push BlackI.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2572) cvn H.B /DEST pdfmark endPrÑðeserve–7Ûthe“section“entitled“"History",“and“its“title,“and“add“to“it“an“item“statingŽ¤ ‘Hat–möleast“the“title,“year‘ÿB,“new“authors,“and“publisher“of“the“Modied“V‘þã×ersion“asŽ¡‘Hgiven–"on“the“T‘ÿs8itle“Page.“If“therÑðe“is“no“section“entitled“"History"“in“the“Document,Ž¡‘HcrÑðeate–÷ûone“stating“the“title,“year‘ÿB,“authors,“and“publisher“of“the“Document“asŽ¡‘Hgiven–¡)on“its“T‘ÿs8itle“Page,“then“add“an“item“describing“the“Modied“V‘þã×ersion“asŽ¡‘Hstated–€in“the“prÑðevious“sentence.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2573) cvn H.B /DEST pdfmark endŸ .‘?«ˆïcolor push BlackJ.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2574) cvn H.B /DEST pdfmark endPrÑðeserve–-the“network“location,“if“any‘þã×,“given“in“the“Document“for“public“access“toŽ¡‘Ha––4T‘ÿ ransparÑðent“copy“of“the“Document,“and“likewise“the“network“locations“givenŽ¡‘Hin–hMthe“Document“for“prÑðevious“versions“it“was“based“on.“These“may“be“placed“inŽŽŸ0‘`ïcolor push Black’šÅ71ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹H; Ô·‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.72) cvn H.B /DEST pdfmark endï color popŸüfdŸ÷™œïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-6) cvn H.B /DEST pdfmark endŸfdÅAppendix–€B.“GNU“FrÑðee“Documentation“LicenseŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¨¾the–Œ"History"“section.“Y‘ÿou“may“omit“a“network“location“for“a“work“that“was“pub-Ž¤ ’¨lished–}‰at“least“four“years“beforÑðe“the“Document“itself,“or“if“the“original“publisherŽ¡’¨of–€the“version“it“rÑðefers“to“gives“permission.Ž‘`©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2575) cvn H.B /DEST pdfmark endŸ .‘;½xïcolor push BlackK.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2576) cvn H.B /DEST pdfmark endIn–Wrany“section“entitled“"Acknowledgements"“or“"Dedications",“prÑðeserve“the“sec-Ž¡‘Htion's–¤ñtitle,“and“prÑðeserve“in“the“section“all“the“substance“and“tone“of“each“of“theŽ¡‘Hcontributor–€acknowledgements“and/or“dedications“given“therÑðein.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2577) cvn H.B /DEST pdfmark endŸ .‘<ãØïcolor push BlackL.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2578) cvn H.B /DEST pdfmark endPršÑðeserve–Ÿtall“the“Invariant“Sections“of“the“Document,“unalter˜ed“in“their“text“andŽ¡‘Hin–ÆÉtheir“titles.“Section“numbers“or“the“equivalent“aršÑðe“not“consider˜ed“part“of“theŽ¡‘Hsection‘€titles.Ž¨7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2579) cvn H.B /DEST pdfmark endŸÈø‘9Š@ïcolor push BlackM.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2580) cvn H.B /DEST pdfmark endDelete–7ôany“section“entitled“"Endorsements".“Such“a“section“may“not“be“includedŽ¡‘Hin–€the“Modied“V‘þã×ersion.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2581) cvn H.B /DEST pdfmark endŸÈø‘:°¨ïcolor push BlackN.‘€ï color popŽŽ‘Hïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2582) cvn H.B /DEST pdfmark endDo–ÁFnot“rÑðetitle“any“existing“section“as“"Endorsements"“or“to“conict“in“title“withŽ¡‘Hany–€Invariant“Section.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2583) cvn H.B /DEST pdfmark endŸ.‘0If–& the“Modied“V‘þã×ersion“includes“new“frÑðont-matter“sections“or“appendices“that“qualifyŽ¡‘0as–²7Secondary“Sections“and“contain“no“material“copied“frÑðom“the“Document,“you“mayŽ¡‘0at–a.your“option“designate“some“or“all“of“these“sections“as“invariant.“T‘ÿo“do“this,“addŽ¡‘0their–}½titles“to“the“list“of“Invariant“Sections“in“the“Modied“V‘þã×ersion's“license“notice.Ž¡‘0These–€titles“must“be“distinct“frÑðom“any“other“section“titles.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2584) cvn H.B /DEST pdfmark endŸ.‘0Y‘ÿou–Omay“add“a“section“entitled“"Endorsements",“prÑðovided“it“contains“nothing“but“en-Ž¡‘0dorsements–£²of“your“Modied“V‘þã×ersion“by“various“parties--for“example,“statements“ofŽ¡‘0peer–ÒršÑðeview“or“that“the“text“has“been“appr˜oved“by“an“or˜ganization“as“the“authoritativeŽ¡‘0denition–€of“a“standarÑðd.ŽŸ7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2585) cvn H.B /DEST pdfmark endŸ Èø‘0Y‘ÿou–¤‡may“add“a“passage“of“up“to“ve“woršÑðds“as“a“Fr˜ont-Cover“T‘ÿext,“and“a“passageŽ¡‘0of–?„up“to“25“worÑðds“as“a“Back-Cover“T›ÿext,“to“the“end“of“the“list“of“Cover“T˜exts“in“theŽ¡‘0Modied–qÊV‘þã×ersion.“Only“one“passage“of“FrÑðont-Cover“T›ÿext“and“one“of“Back-Cover“T˜extŽ¡‘0may–c¹be“added“by“(or“thrÑðough“arrangements“made“by)“any“one“entity‘þã×.“If“the“Docu-Ž¡‘0ment–<~alršÑðeady“includes“a“cover“text“for“the“same“cover‘ÿB,“pr˜eviously“added“by“you“or“byŽ¡‘0arrangement–Ánmade“by“the“same“entity“you“arÑðe“acting“on“behalf“of,“you“may“not“addŽ¡‘0another;–÷mbut“you“may“ršÑðeplace“the“old“one,“on“explicit“permission“fr˜om“the“pr˜eviousŽ¡‘0publisher–€that“added“the“old“one.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2586) cvn H.B /DEST pdfmark endŸ.‘0The–ʹauthor(s)“and“publisher(s)“of“the“Document“do“not“by“this“License“give“permis-Ž¡‘0sion–‰Îto“use“their“names“for“publicity“for“or“to“assert“or“imply“endorsement“of“anyŽ¡‘0Modied‘€V‘þã×ersion.Ž©7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-5) cvn H.B /DEST pdfmark endŸ"mÇCOMBINING‘³6DOCUMENTSïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.35.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2589) cvn H.B /DEST pdfmark endŸ Õn‘0¾Y‘ÿou–¶Smay“combine“the“Document“with“other“documents“rÑðeleased“under“this“License,Ž¡‘0under–š«the“terms“dened“in“section“4“above“for“modied“versions,“prÑðovided“that“youŽ¡‘0include–tbin“the“combination“all“of“the“Invariant“Sections“of“all“of“the“original“docu-Ž¡‘0ments,–{unmodied,“and“list“them“all“as“Invariant“Sections“of“your“combined“work“inŽ¡‘0its–€license“notice.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2590) cvn H.B /DEST pdfmark endŸ Èø‘0The–z”combined“work“need“only“contain“one“copy“of“this“License,“and“multiple“identi-Ž¡‘0cal–+šInvariant“Sections“may“be“ršÑðeplaced“with“a“single“copy‘þã×.“If“ther˜e“ar˜e“multiple“Invari-Ž¡‘0ant–óSections“with“the“same“name“but“dierÑðent“contents,“make“the“title“of“each“suchŽ¡‘0section–sunique“by“adding“at“the“end“of“it,“in“parÑðentheses,“the“name“of“the“originalŽ¡‘0author–<'or“publisher“of“that“section“if“known,“or“else“a“unique“number‘ÿB.“Make“the“sameŽ¡‘0adjustment–…bto“the“section“titles“in“the“list“of“Invariant“Sections“in“the“license“notice“ofŽ¡‘0the–€combined“work.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2591) cvn H.B /DEST pdfmark endŸ Èø‘0In–Ÿ@the“combination,“you“must“combine“any“sections“entitled“"History"“in“the“variousŽ¡‘0original–å®documents,“forming“one“section“entitled“"History";“likewise“combine“anyŽŽŸ0‘`ïcolor push BlackÅ72ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹I; ô·‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.73) cvn H.B /DEST pdfmark endï color popŸüfd’ã/ÅAppendix–€B.“GNU“FrÑðee“Documentation“LicenseŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš’¾sections–ÍDentitled“"Acknowledgements",“and“any“sections“entitled“"Dedications".“Y‘ÿouŽ¤ ’must–€delete“all“sections“entitled“"Endorsements."Ž‘`©7ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-6) cvn H.B /DEST pdfmark endŸ"mÇCOLLECTIONS–³6OF“DOCUMENTSïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.36.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2594) cvn H.B /DEST pdfmark endŸ Õn‘0¾Y‘ÿou– ømay“make“a“collection“consisting“of“the“Document“and“other“documents“rÑðeleasedŽ¡‘0under–Jºthis“License,“and“rÑðeplace“the“individual“copies“of“this“License“in“the“variousŽ¡‘0documents–\Awith“a“single“copy“that“is“included“in“the“collection,“prÑðovided“that“youŽ¡‘0follow–Áthe“rëˆules“of“this“License“for“verbatim“copying“of“each“of“the“documents“in“allŽ¡‘0other‘€rÑðespects.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2595) cvn H.B /DEST pdfmark endŸ.‘0Y‘ÿou–Kèmay“extract“a“single“document“frÑðom“such“a“collection,“and“distribute“it“individu-Ž¡‘0ally–¯runder“this“License,“prÑðovided“you“insert“a“copy“of“this“License“into“the“extractedŽ¡‘0document,–úIand“follow“this“License“in“all“other“ršÑðespects“r˜egar˜ding“verbatim“copyingŽ¡‘0of–€that“document.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-7) cvn H.B /DEST pdfmark endŸ"mÇA‘ÿU¡GGREGA‘þÍ_TION–³6WITH“INDEPENDENT“W»ÞORKSïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.37.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2598) cvn H.B /DEST pdfmark endŸ Õn‘0¾A‘þ´compilation–þÕof“the“Document“or“its“derivatives“with“other“separate“and“indepen-Ž¡‘0dent–g5documents“or“works,“in“or“on“a“volume“of“a“storage“or“distribution“medium,Ž¡‘0does–iànot“as“a“whole“count“as“a“Modied“V‘þã×ersion“of“the“Document,“prÑðovided“no“com-Ž¡‘0pilation–æ¶copyright“is“claimed“for“the“compilation.“Such“a“compilation“is“called“anŽ¡‘0"aggrÑðegate",–¸and“this“License“does“not“apply“to“the“other“self-contained“works“thusŽ¡‘0compiled–.Zwith“the“Document,“on“account“of“their“being“thus“compiled,“if“they“arÑðe“notŽ¡‘0themselves–€derivative“works“of“the“Document.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2599) cvn H.B /DEST pdfmark endŸ Èø‘0If–ªthe“Cover“T‘ÿext“r•Ñðequir“ement–ªof“section“3“is“applicable“to“these“copies“of“the“Docu-Ž¡‘0ment,–Eáthen“if“the“Document“is“less“than“one“quarter“of“the“entiršÑðe“aggr˜egate,“the“Docu-Ž¡‘0ment's–Cover“T‘ÿexts“may“be“placed“on“covers“that“surrÑðound“only“the“Document“withinŽ¡‘0the–€aggršÑðegate.“Otherwise“they“must“appear“on“covers“ar˜ound“the“whole“aggr˜egate.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-8) cvn H.B /DEST pdfmark endŸÒ1ÇTRANSLA‘þÍ_TIONïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.38.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2602) cvn H.B /DEST pdfmark endŸ Õn‘0¾T‘ÿ ranslation–Ìis“considerÑðed“a“kind“of“modication,“so“you“may“distribute“translations“ofŽ¡‘0the–Document“under“the“terms“of“section“4.“Replacing“Invariant“Sections“with“transla-Ž¡‘0tions›µßr•Ñðequir“es˜special˜permission˜fr“om˜their˜copyright˜holders,˜but˜you˜may˜includeŽ¡‘0translations–2³of“some“or“all“Invariant“Sections“in“addition“to“the“original“versions“ofŽ¡‘0these–—ÆInvariant“Sections.“Y‘ÿou“may“include“a“translation“of“this“License“prÑðovided“thatŽ¡‘0you–ü›also“include“the“original“English“version“of“this“License.“In“case“of“a“disagrÑðeementŽ¡‘0between–¸Úthe“translation“and“the“original“English“version“of“this“License,“the“originalŽ¡‘0English–€version“will“prÑðevail.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïJps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-9) cvn H.B /DEST pdfmark endŸÒ1ÇTERMINA‘þÍ_TIONïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.39.1) cvn H.B /DEST pdfmark endŽŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2605) cvn H.B /DEST pdfmark endŸ Õn‘0¾Y‘ÿou–5may“not“copy›þã×,“modify˜,“sublicense,“or“distribute“the“Document“except“as“exprÑðesslyŽ¡‘0prÑðovided–ófor“under“this“License.“Any“other“attempt“to“copy›þã×,“modify˜,“sublicense“orŽ¡‘0distribute–”]the“Document“is“void,“and“will“automatically“terminate“your“rights“underŽ¡‘0this–ùDLicense.“However‘ÿB,“parties“who“have“ršÑðeceived“copies,“or“rights,“fr˜om“you“underŽ¡‘0this–¤KLicense“will“not“have“their“licenses“terminated“so“long“as“such“parties“rÑðemain“inŽ¡‘0full‘€compliance.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-10) cvn H.B /DEST pdfmark endŽŸ0‘`ïcolor push Black’šÅ73ŽŽŽŽŽŽŽ’¤ï color popŽŽŒ‹J; ³‘·ºâŸ·ºâïþps:SDict begin /product where{pop product(Distiller)search{pop pop pop version(.)search{exch pop exch pop(3011)eq{gsave newpath 0 0 moveto closepath clip/Courier findfont 10 scalefont setfont 72 72 moveto(.)show grestore}if}{pop}ifelse}{pop}ifelse}if end   ý0‘`ïcolor push Blackïcolor push gray 0ïps:SDict begin H.S endïcolor push gray 0ï color popŽïps:SDict begin H.R endïKps:SDict begin [ /View [/XYZ H.V] /Dest (page.74) cvn H.B /DEST pdfmark endï color popŸüfdÅAppendix–€B.“GNU“FrÑðee“Documentation“LicenseŽŽŽŽŽŽŽ’¤ï color popŽŽ   ýš‘`ÇFUTURE–³6REVISIONS“OF“THIS“LICENSEïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.40.1) cvn H.B /DEST pdfmark endŽ‘`ŸÒ@ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2608) cvn H.B /DEST pdfmark endŸ Õn‘0¾The–%9FršÑðee“Softwar˜e“Foundation“may“publish“new‘ÿ,“r˜evised“versions“of“the“GNU‘%Fr˜eeŽ¤ ‘0Documentation–R›License“frÑðom“time“to“time.“Such“new“versions“will“be“similar“in“spiritŽ¡‘0to–~othe“pršÑðesent“version,“but“may“dier“in“detail“to“addr˜ess“new“pr˜oblems“or“concerns.Ž¡‘0See‘€ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2609) cvn H.B /DEST pdfmark endhttp://www‘ÿ.gnu.orÑðg/copyleft/ŸüÎ1Ž‘¾.Ž©Ñèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2610) cvn H.B /DEST pdfmark endŸ.‘0Each–aõversion“of“the“License“is“given“a“distinguishing“version“number‘ÿB.“If“the“Docu-Ž¡‘0ment–Dlspecies“that“a“particular“numberšÑðed“version“of“this“License“"or“any“later“ver˜-Ž¡‘0sion"–Þþapplies“to“it,“you“have“the“option“of“following“the“terms“and“conditions“eitherŽ¡‘0of–Æ8that“specied“version“or“of“any“later“version“that“has“been“published“(not“as“aŽ¡‘0draft)–üîby“the“FršÑðee“Softwar˜e“Foundation.“If“the“Document“does“not“specify“a“versionŽ¡‘0number–ÚÆof“this“License,“you“may“choose“any“version“ever“published“(not“as“a“draft)Ž¡‘0by–€the“FršÑðee“Softwar˜e“Foundation.Ž¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (GFDL-11) cvn H.B /DEST pdfmark endŸÒ1ÇHoÌìw–³6to“use“this“License“f»Þor“yªÑour“documentsïps:SDict begin H.S endïps:SDict begin 14.641 H.A endïKps:SDict begin [ /View [/XYZ H.V] /Dest (13.41.1) cvn H.B /DEST pdfmark endŽŸ hüïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2613) cvn H.B /DEST pdfmark endŸ>²‘0¾T‘ÿo–•Õuse“this“License“in“a“document“you“have“written,“include“a“copy“of“the“License“inŽ¡‘0the–Ò8document“and“put“the“following“copyright“and“license“notices“just“after“the“titleŽ¡‘0page:Ž¦ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2614) cvn H.B /DEST pdfmark end©ïps:SDict begin H.S endïps:SDict begin 9.9 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2615) cvn H.B /DEST pdfmark endŸ~‘:äCopyright–ÇÝ(c)“YEAR–ÇyYOUR“NAME.–ÇÝPermission“is“granted“to“copy‘ÿB,“distribute“and/orŽ¤ æf‘:modify–2Ýthis“document“under“the“terms“of“the“GNU‘2ÙFrÖ‹ee“Documentation“License,“V‘ÿBersionŽ¡‘:1.1–©or“any“later“version“published“by“the“FršÖ‹ee“Softwar˜e“Foundation;“with“the“InvariantŽ¡‘:Sections–Xêbeing“LIST–XäTHEIR“TITLES,–Xêwith“the“FrÖ‹ont-Cover“T‘ÿ, exts“being“LIST‘ÿU,“and“with“theŽ¡‘:Back-Cover–:T‘ÿ, exts“being“LIST‘ÿU.“A‘~ècopy“of“the“license“is“included“in“the“section“entitledŽ¡‘:"GNU–@FrÖ‹ee“Documentation“License".ŽŸ¦ïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2616) cvn H.B /DEST pdfmark end¤ ‘0¾If–,you“have“no“Invariant“Sections,“write“"with“no“Invariant“Sections"“instead“of“sayingŽ¡‘0which–U¢ones“aršÑðe“invariant.“If“you“have“no“Fr˜ont-Cover“T‘ÿexts,“write“"no“Fr˜ont-CoverŽ¡‘0T›ÿexts"–€instead“of“"FrÑðont-Cover“T˜exts“being“LIST";“likewise“for“Back-Cover“T˜exts.ŽŸÑèïps:SDict begin H.S endïps:SDict begin 11 H.A endïHps:SDict begin [ /View [/XYZ H.V] /Dest (2617) cvn H.B /DEST pdfmark endŸ.‘0If–›your“document“contains“nontrivial“examples“of“pršÑðogram“code,“we“r˜ecommend“r˜e-Ž¡‘0leasing–€àthese“examples“in“parallel“under“your“choice“of“fršÑðee“softwar˜e“license,“such“asŽ¡‘0the–€GNU“General“Public“License,“to“permit“their“use“in“fršÑðee“softwar˜e.ŽŸ¤ÇNotesŽŸ§®‘0ïcolor push Black¾1.‘€ï color popŽŽ‘@http://www‘ÿ.gnu.orÑðg/copyleft/ŽŽŸ0‘`ïcolor push BlackÅ74ŽŽŽŽŽŽŽ’¤ï color popŽŽŒø (ƒ’À;èϺ⻺â Jó9ŒEÕ( pplr8tó8áÚŽ phvro8tó(‰šš pcrro8tó&‰šš pcrr8tó%ú phvb8tó$áÚŽ phvr8tó#ŒEÕ( pplr8tó"ú phvb8tó!ú š phvb8tó Ý#òZ pplr8có‰š pcrro8tó‰š pcrro8tó‰š pcrr8tóú O\ phvb8tóŽY‡× pplri8tó,  pplb8tóú¤ phvb8tóŒEÕ( pplr8tóÝ#òZ pplr8cóú phvb8tóúá phvb8tóŒEÕ( pplr8tó?Á|‰ ptmr8tó  b> cmmi10ù :Nßßßßßßiptraf-ng-1.1.4/Documentation/manual.html0000664000076400007640000001552212173477702020661 0ustar npajkovsnpajkovs IPTraf User's Manual

IPTraf User's Manual

Copyright © 1997, 2003 by Gerard Paul Java

Version 3.0.0
Table of Contents
About This Document
For Additional Information
Document Conventions
Getting Started
About IPTraf
Installation
System Requirements
Availability
Installing Downloaded Packages
Installing a Floppy Distribution
Upgrading from Earlier Versions
Starting and Stopping IPTraf
Command-line Options
Using the Menus
Exiting IPTraf
Preparing to Use IPTraf
Number Display Notations
Instances and Logging
Screen Update Delays
Supported Network Interfaces
The IP Traffic Monitor
The Upper Window
Closed/Idle/Timed Out Connections
Sorting TCP Entries
Lower Window
Entry Details
Additional Information
Network Interface Statistics
General Interface Statistics
Detailed Interface Statistics
Statistical Breakdowns
Packet Sizes
TCP and UDP Traffic Statistics
Sorting TCP/UDP Entries
Additional Information
LAN Station Statistics
Sorting the LAN Station Monitor Entries
Additional Information
Filters
IP Filters
Defining a New Filter
Applying a Filter
Editing a Defined Filter
Deleting a Defined Filter
Detaching a Filter
ARP, RARP, and other Non-IP Packet Filters
Configuring IPTraf
Toggles
Reverse DNS Lookups
TCP/UDP Service Names
Force promiscuous
Color
Logging
Activity mode
Source MAC addrs in traffic monitor
Timers
TCP Timeout
Log Interval
Screen Update Interval
TCP closed/idle persistence
Custom Information
Additional ports
Delete port/range
LAN Station Identifiers
Background Operation
Messages
IPTraf Messages
rvnamed Messages
GNU Free Documentation License
PREAMBLE
APPLICABILITY AND DEFINITIONS
VERBATIM COPYING
COPYING IN QUANTITY
MODIFICATIONS
COMBINING DOCUMENTS
COLLECTIONS OF DOCUMENTS
AGGREGATION WITH INDEPENDENT WORKS
TRANSLATION
TERMINATION
FUTURE REVISIONS OF THIS LICENSE
How to use this License for your documents
  Next >>>
  About This Document
iptraf-ng-1.1.4/Documentation/manual.rtf0000664000076400007640000070112712173477702020513 0ustar npajkovsnpajkovs{\rtf1\ansi\deff0 {\fonttbl{\f3\fnil\fcharset0 Courier New;} {\f2\fnil\fcharset0 Helvetica;} {\f4\fnil\fcharset0 Arial;} {\f1\fnil\fcharset0 Palatino;} {\f0\fnil\fcharset0 Times New Roman;} } {\colortbl;}{\stylesheet{\s1 Heading 1;}{\s2 Heading 2;}{\s3 Heading 3;}{\s4 Heading 4;}{\s5 Heading 5;}{\s6 Heading 6;}{\s7 Heading 7;}{\s8 Heading 8;}{\s9 Heading 9;}} \deflang1024\notabind\facingp\hyphauto1\widowctrl \sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}\pard\sl20 {\*\bkmkstart ID_MANUAL}{\*\bkmkend ID_MANUAL}\fs20\f1 \hyphpar0\par\pard\sb242\sl354\qc \b\fs32\f2 IPTraf User's Manual\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}\pard\sl20 \fs20\f1 \keepn\hyphpar0\par\pard\sl-240 \b\f2 IPTraf User's Manual\hyphpar0\par\pard\sl220 \b0\f1 Copyright\~\'a9\~1997, 2003 by Gerard Paul Java\hyphpar0\par\pard\sb200\sl220 \fs16 This manual is released under the terms of the GNU Free Documentation License of March, 2000 as published by the Free Software Foundation, reproduced in this manual as Appendix B.\hyphpar0\par\pard\sl220 IPTraf is open-source software released under the terms of the GNU General Public License version 2 or any later version as published by the Free Software Foundation, reproduced in the LICENSE file in the distribution's top-level directory.\hyphpar0\par\pard\sl220 The accomanying software and the information contained in this document are provided "AS IS" without warranty of any kind, express or implied, including, without limitation, the implied warranties of mercantability or fitness for any particular purpose.\hyphpar0\par\pard\sl220 In no event shall the author be liable for any indirect, special, consequential, or incidental damages arising from the use of this manual or the accompanying software even if the author has been advised of the possibility of such damages.\hyphpar0\par\pard\sl220 Linux is a registered trademark of Linus Torvalds. Pentium is a registered trademark of Intel Corporation. All other trademarks are property of their respective owners.\hyphpar0\par\pard\sl220 Some structure declarations were based on code copyrighted by the Regents of the University of California.\hyphpar0\par\pard\sl220 Token Ring parsing code based on the Token Ring packet construction code in the Linux 2.2 kernel.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgnlcrm\pgnrestart\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 \b\fs29\f2 Table of Contents\keepn\hyphpar0\par\pard\sb146\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_PREFACE}{\fldrslt \fs20\f1 About This Document}}\fs20\f1 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_PREFACE}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_PREFACE}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_ADDINFO}{\fldrslt \b0 For Additional Information}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_ADDINFO}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_ADDINFO}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_CONVENTIONS}{\fldrslt Document Conventions}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_CONVENTIONS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_CONVENTIONS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GETTINGSTARTED}{\fldrslt \b 1. Getting Started}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GETTINGSTARTED}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GETTINGSTARTED}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _65 }{\fldrslt \b0 About IPTraf}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _65 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _65}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_INSTALLATION}{\fldrslt Installation}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_INSTALLATION}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_INSTALLATION}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _96 }{\fldrslt System Requirements}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _96 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _96}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _134 }{\fldrslt Availability}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _134 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _134}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _149 }{\fldrslt Installing Downloaded Packages}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _149 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _149}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _186 }{\fldrslt Installing a Floppy Distribution}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _186 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _186}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_UPGRADING}{\fldrslt Upgrading from Earlier Versions}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_UPGRADING}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_UPGRADING}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_STARTSTOP}{\fldrslt Starting and Stopping IPTraf}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_STARTSTOP}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_STARTSTOP}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Options}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_CMDLINE}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_MENUS}{\fldrslt Using the Menus}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_MENUS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_MENUS}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_EXITING}{\fldrslt Exiting IPTraf}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_EXITING}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_EXITING}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_PREPARINGTOUSE}{\fldrslt \b 2. Preparing to Use IPTraf}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_PREPARINGTOUSE}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_PREPARINGTOUSE}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_NUMBERS}{\fldrslt \b0 Number Display Notations}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_NUMBERS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_NUMBERS}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_INSTANCES}{\fldrslt Instances and Logging}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_INSTANCES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_INSTANCES}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_UPDATES}{\fldrslt Screen Update Delays}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_UPDATES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_UPDATES}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_IFACES}{\fldrslt Supported Network Interfaces}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_IFACES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_IFACES}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_ITRAFMON}{\fldrslt \b 3. The IP Traffic Monitor}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_ITRAFMON}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_ITRAFMON}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_UPPERWIN}{\fldrslt \b0 The Upper Window}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_UPPERWIN}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_UPPERWIN}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _725 }{\fldrslt Closed/Idle/Timed Out Connections}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _725 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _725}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _736 }{\fldrslt Sorting TCP Entries}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _736 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _736}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_LOWERWIN}{\fldrslt Lower Window}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_LOWERWIN}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_LOWERWIN}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _835 }{\fldrslt Entry Details}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _835 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _835}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1076 }{\fldrslt Additional Information}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1076 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1076}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_NETSTATS}{\fldrslt \b 4. Network Interface Statistics}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_NETSTATS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_NETSTATS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GENSTATS}{\fldrslt \b0 General Interface Statistics}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GENSTATS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GENSTATS}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_DETSTATS}{\fldrslt Detailed Interface Statistics}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_DETSTATS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_DETSTATS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_STATBREAKDOWNS}{\fldrslt \b 5. Statistical Breakdowns}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_STATBREAKDOWNS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_STATBREAKDOWNS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_PKTSIZE}{\fldrslt \b0 Packet Sizes}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_PKTSIZE}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_PKTSIZE}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_SERVMON}{\fldrslt TCP and UDP Traffic Statistics}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_SERVMON}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_SERVMON}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1222 }{\fldrslt Sorting TCP/UDP Entries}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1222 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1222}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1230 }{\fldrslt Additional Information}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1230 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1230}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_HOSTMON}{\fldrslt \b 6. LAN Station Statistics}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_HOSTMON}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_HOSTMON}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_SORTINGLAN}{\fldrslt \b0 Sorting the LAN Station Monitor Entries}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_SORTINGLAN}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_SORTINGLAN}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_MORELANMONINFO}{\fldrslt Additional Information}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_MORELANMONINFO}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_MORELANMONINFO}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt \b 7. Filters}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_FILTERS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_IPFILTERS}{\fldrslt \b0 IP Filters}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_IPFILTERS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_IPFILTERS}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1304 }{\fldrslt Defining a New Filter}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1304 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1304}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1902 }{\fldrslt Applying a Filter}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1902 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1902}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1907 }{\fldrslt Editing a Defined Filter}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1907 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1907}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1922 }{\fldrslt Deleting a Defined Filter}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1922 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1922}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1926 }{\fldrslt Detaching a Filter}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1926 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1926}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_NONIPFILTERS}{\fldrslt ARP, RARP, and other Non-IP Packet Filters}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_NONIPFILTERS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_NONIPFILTERS}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \b 8. Configuring IPTraf}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_CONFIG}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_TOGGLES}{\fldrslt \b0 Toggles}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_TOGGLES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_TOGGLES}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1946 }{\fldrslt Reverse DNS Lookups}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1946 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1946}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1950 }{\fldrslt TCP/UDP Service Names}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1950 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1950}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1961 }{\fldrslt Force promiscuous}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1961 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1961}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1971 }{\fldrslt Color}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1971 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1971}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _1975 }{\fldrslt Logging}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _1975 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _1975}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2012 }{\fldrslt Activity mode}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2012 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2012}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2016 }{\fldrslt Source MAC addrs in traffic monitor}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2016 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2016}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_TIMERS}{\fldrslt Timers}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_TIMERS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_TIMERS}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2029 }{\fldrslt TCP Timeout}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2029 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2029}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2032 }{\fldrslt Log Interval}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2032 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2032}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2037 }{\fldrslt Screen Update Interval}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2037 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2037}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2047 }{\fldrslt TCP closed/idle persistence}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2047 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2047}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_CUSTOMPORTS}{\fldrslt Custom Information}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_CUSTOMPORTS}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_CUSTOMPORTS}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2060 }{\fldrslt Additional ports}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2060 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2060}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2065 }{\fldrslt Delete port/range}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2065 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2065}{\fldrslt 000}}}}\hyphpar0\par\pard\li2400\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l _2069 }{\fldrslt LAN Station Identifiers}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l _2069 }{\fldrslt {\field\flddirty{\*\fldinst PAGEREF _2069}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_BACKOP}{\fldrslt \b 9. Background Operation}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_BACKOP}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_BACKOP}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_MESSAGES}{\fldrslt A. Messages}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_MESSAGES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_MESSAGES}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_IPTRAFMESSAGES}{\fldrslt \b0 IPTraf Messages}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_IPTRAFMESSAGES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_IPTRAFMESSAGES}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_RVNAMEDMESSAGES}{\fldrslt rvnamed Messages}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_RVNAMEDMESSAGES}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_RVNAMEDMESSAGES}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1440\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL}{\fldrslt \b B. GNU Free Documentation License}}\b \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL}{\fldrslt 000}}}}\hyphpar0\par\pard\sb48\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_0}{\fldrslt \b0 PREAMBLE}}\b0 \tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_0}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_0}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_1}{\fldrslt APPLICABILITY AND DEFINITIONS}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_1}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_1}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_2}{\fldrslt VERBATIM COPYING}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_2}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_2}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_3}{\fldrslt COPYING IN QUANTITY}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_3}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_3}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_4}{\fldrslt MODIFICATIONS}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_4}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_4}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_5}{\fldrslt COMBINING DOCUMENTS}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_5}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_5}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_6}{\fldrslt COLLECTIONS OF DOCUMENTS}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_6}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_6}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_7}{\fldrslt AGGREGATION WITH INDEPENDENT WORKS}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_7}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_7}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_8}{\fldrslt TRANSLATION}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_8}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_8}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_9}{\fldrslt TERMINATION}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_9}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_9}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_10}{\fldrslt FUTURE REVISIONS OF THIS LICENSE}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_10}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_10}{\fldrslt 000}}}}\hyphpar0\par\pard\li1920\sl220\fi-480 {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_11}{\fldrslt How to use this License for your documents}}\tqr\tldot\tx8400\tab {\field{\*\fldinst HYPERLINK \\l ID_GFDL_45_11}{\fldrslt {\field\flddirty{\*\fldinst PAGEREF ID_GFDL_45_11}{\fldrslt 000}}}}\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgnlcrm\pgnrestart\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 About This Document}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 About This Document}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_PREFACE}{\*\bkmkend ID_PREFACE}\b\fs29\f2 About This Document\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 This document contains the instructions on how to use the IPTraf network monitoring software version 3.0. This manual details the different statistical facilities, the user interface, and the important features of the software.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_ADDINFO}{\*\bkmkend ID_ADDINFO}\b\fs26\lang1024\f2 For Additional Information\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 See the included README file for summarized and late-breaking information. Also read the RELEASE-NOTES file for important new information about this new version. The CHANGES file contains a record of the changes made to the software since 1.0.0. README.rvnamed contains information on the rvnamed reverse resolution program. See the other README files for support and development information.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_CONVENTIONS}{\*\bkmkend ID_CONVENTIONS}\b\fs26\lang1024\f2 Document Conventions\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The following symbols and typefaces are used throughout this manual:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 [ ]\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab items in brackets are optional. Brackets also denote items that may or may not be displayed onscreen depending on settings or conditions.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 \{ \}\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab curly braces enclose items you choose from\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 |\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab the vertical bar separates choices in curly braces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 normal monospace\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab normal monospace text in syntax specifications should be typed in exactly as presented. Because UNIX and variants are case-sensitive, case must be preserved. Monospace is also used in presenting items that appear on the screen.\hyphpar0\par\pard\sb200\li960\sl220\qj \i\fs18\f3 monospace italics\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab italics in syntax specifications indicate items that are to be replaced with an actual item (e.g. \i\f3 interface\i0\f1 should be replaced with an actual interface name, like \fs18\f3 eth0\fs20\f1 ). \hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Additional information appears distinctively set apart from the main text. This information includes Notes, Tips, or Technical Notes.\hyphpar0\par\pard\sb100\li960\sl220\qj \i Notes\i0 are additional pieces of information that may be useful or may clarify the preceeding paragraphs of the manual.\hyphpar0\par\pard\sb100\li960\sl220\qj \i Tips\i0 provide shortcuts, clarify tasks that may not be immediately obvious, or provide references to additional sources of information.\hyphpar0\par\pard\sb100\li960\sl220\qj \i Technical notes\i0 are explanations of a more technical nature and may be of more use to programmers and advanced users.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\pgnrestart\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 1. Getting Started}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 1. Getting Started}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_GETTINGSTARTED}{\*\bkmkend ID_GETTINGSTARTED}\b\fs29\f2 Chapter 1. Getting Started\keepn\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart _65}{\*\bkmkend _65}\fs26 About IPTraf\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf is a network monitoring utility and traffic analyzer for IP networks. It intercepts packets and returns data about captured the network traffic in various statistical facilities.\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf comes with these major features:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 An IP traffic monitor that shows TCP connection information (hosts, packet/byte counts, flags, window sizes), and color-coded information about other IP packets\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Statistics (counts and load rates) for network interfaces in general and detailed views\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Statistics per TCP/UDP port\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Statistical breakdown according to packet sizes\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 A LAN host monitor that returns counts and loads per detected MAC address\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 A powerful filtering system for users to view only interesting traffic\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Logging\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 An asynchronous DNS resolver for the IP traffic monitor\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 A text-based, full-color, menu-driven user interface suitable for use on all Linux systems with terminals, especially Linux consoles and color xterms\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Easy configuration\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Fully software-based. No additional hardware required\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Basic knowledge of the important TCP/IP protocols (IP, TCP, UDP, ICMP, etc.) is necessary for you to best understand the information generated by the program.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_INSTALLATION}{\*\bkmkend ID_INSTALLATION}\b\fs26\lang1024\f2 Installation\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf is most readily available on the Internet, but some may receive it on a diskette. Here are the instructions for both types of distributions.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _96}{\*\bkmkend _96}\b\fs24\lang1024\f2 System Requirements\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf requires:\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 Hardware Requirements\keepn\hyphpar0\par\pard\sb110\li1160\sl220\fi-200\qj \tx1160 \b0\fs16\f1 \'95\tab \fs20 16 megabytes of physical RAM (more recommended, at least 64 MB for very busy networks)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 2 megabytes of free disk space for installation (more will be needed if you log high amounts of traffic over time)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Pentium-class processor or higher (Pentium-II 200 MHz or higher recommended) or equivalent.\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 One or more of the supported network interfaces.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\f2 Operating System Requirements\keepn\hyphpar0\par\pard\sb110\li1160\sl220\fi-200\qj \tx1160 \b0\fs16\f1 \'95\tab \fs20 Linux kernel 2.2.0 or higher\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 GNU C Library 2.1 or later\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 ncurses 4.2 or later with the complete terminfo database in \fs18\f3 /usr/share/terminfo\fs20\f1 . Support for \fs18\f3 linux\fs20\f1 , \fs18\f3 vt100\fs20\f1 , \fs18\f3 xterm\fs20\f1 , \fs18\f3 xterm-color\fs20\f1 recommended. \hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\f2 Compilation Requirements\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 The following components are required when compiling IPTraf from the source code.\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 gcc 2.7.2.3 or later\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 GNU C (glibc) development library 2.1 or later\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 ncurses development libraries 4.2 or later\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _134}{\*\bkmkend _134}\b\fs24\f2 Availability\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf can be downloaded from the Internet from the official FTP site at ftp://iptraf.seul.org/pub/iptraf/\up8\fs12 1\up0\fs20 .\hyphpar0\par\pard\sb100\li960\sl220\qj The software is available in source form in compressed \fs18\f3 .tar.gz\fs20\f1 files named \fs18\f3 iptraf-\i x.y.z\i0 .tar.gz\fs20\f1 where \i\fs18\f3 x.y.z\i0\fs20\f1 is the version number. Precompiled ready-to-run software is available in the \fs18\f3 iptraf-\i x.y.z.machinetype\i0 .bin.tar.gz\fs20\f1 files. (\i\fs18\f3 machinetype\i0\fs20\f1 indicates what platform the precompiled binaries run on. The official distribution will only be for the Intel x86 architecture indicated as \fs18\f3 i386\fs20\f1 .)\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _149}{\*\bkmkend _149}\b\fs24\lang1024\f2 Installing Downloaded Packages\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 You will need to have GNU tar and GNU zip installed. All modern Linux installations already have these utilities ready.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 1.\tab Decompress the \fs18\f3 .tar.gz\fs20\f1 file by entering\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\f3 tar zxvf iptraf-\i x.y.z\i0 .tar.gz\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 for the source code or\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\lang1024\f3 tar zxvf iptraf-\i x.y.z\i0 .i386.bin.tar.gz\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 for the precompiled x86 programs.\hyphpar0\par\pard\sb100\li1440\sl220\qj If your tar doesn't support the z option, you can separately decompress the \fs18\f3 .tar.gz\fs20\f1 file then extract the resulting \fs18\f3 .tar\fs20\f1 archive.\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\lang1024\f3 gunzip iptraf-\i x.y.z\i0 .tar.gz\sa0\par\fi0\sb0 tar xvf iptraf-\i x.y.z\i0 .tar\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 This will decompress the sources into a directory called \fs18\f3 iptraf-\i x.y.z\i0\fs20\f1 (source code) or \fs18\f3 iptraf-\i x.y.z\i0 .bin\fs20\f1 (precompiled). (\i\f3 x.y.z\i0\f1 here should be the IPTraf version number you're installing, like \fs18\f3 3.0.0\fs20\f1 ).\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 2.\tab Change to the created top level directory.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab 3.\tab To compile and install the software, run the Setup program by entering\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\f3 ./Setup\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 while you are logged in as root. The Setup script will recognize the source distribution and compile the software before installing. It will immediately install a precompiled distribution.\hyphpar0\par\pard\sb100\li960\sl220\qj The resulting binaries will be placed in the \fs18\f3 /usr/local/bin\fs20\f1 directory. All needed directories will also be created.\hyphpar0\par\pard\sb100\li960\sl220\qj After installation, you will be asked if you want to read the \fs18\f3 RELEASE-NOTES\fs20\f1 file. It is recommended that you do so at that point, since the \fs18\f3 RELEASE-NOTES\fs20\f1 file contains important information about the new version.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _186}{\*\bkmkend _186}\b\fs24\lang1024\f2 Installing a Floppy Distribution\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 If you received IPTraf on a diskette, the sources are already decompressed. The diskette is in Second Extended filesystem format. Perform the following steps to install the software. \hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 1.\tab Insert the floppy in the drive.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab 2.\tab Mount the floppy on an empty directory. For example, to mount the floppy in the first floppy drive under a directory called \fs18\f3 /mnt\fs20\f1 , enter\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\f3 mount -t ext2 /dev/fd0 /mnt\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 This assumes your floppy is in \fs18\f3 /dev/fd0\fs20\f1 . You can use any empty directory in place of \fs18\f3 /mnt\fs20\f1 . With most Linux installations, this will work fine.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 3.\tab After mounting, change to the \fs18\f3 /mnt\fs20\f1 (or whatever) directory.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab 4.\tab Enter\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\f3 ./Setup\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 while logged in as root. Setup will determine whether the diskette contains a source code distribution or ready-to-run precompiled software. This will copy the binaries to \fs18\f3 /usr/local/bin\fs20\f1 , and create the necessary working directories.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 5.\tab Unmount the diskette by typing\hyphpar0\par\pard\sb100\li1440\sl198\qj \fs18\f3 umount /mnt\hyphpar0\par\pard\sb100\li1440\sl220\qj \fs20\lang1033\f1 (That's \i u\i0 mount, not \i un\i0 mount.)\hyphpar0\par\pard\sb100\li1440\sl220\qj You can then eject the diskette. Store it in a safe place.\hyphpar0\par\pard\sb100\li1440\sl220\qj You will also be asked if you want to view the \fs18\f3 RELEASE-NOTES\fs20\f1 file. It is recommended that you do so at that point.\hyphpar0\par\pard\sb100\li1440\sl220\qj In both cases (downloaded and floppy), the installation will store the program in \fs18\f3 /usr/local/bin\fs20\f1 with the binaries owned by user root, readable, writable, and executable by the owner, no permissions for the group, no permissions for all others. (700 octal, or \fs18\f3 -rwx------\fs20\f1 ).\hyphpar0\par\pard\sb200\li1840\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 You must be \fs16\f3 root\fs18\f4 to do the installation. The old style of installation (\b cd src;make install\b0 ) is still supported.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 Be sure \fs18\f3 /usr/local/bin\fs20\f1 is included in your environment's PATH variable. You can edit the appropriate command in your login customization file (\fs18\f3 .profile\fs20\f1 for the Bourne-type shells, \fs18\f3 .cshrc\fs20\f1 for the C shell and its relatives).\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_UPGRADING}{\*\bkmkend ID_UPGRADING}\b\fs26\lang1024\f2 Upgrading from Earlier Versions\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf 3.0 is a major revision from IPTraf 2.7. The filter subsystem has been completely redesigned and as such, is incompatible with previous filter formats. Therefore old IPTraf filters can no longer be used. The installation procedure for IPTraf 3.0 will rename the filter list files but not delete them.\hyphpar0\par\pard\sb100\li960\sl220\qj If you install a distribution package (e.g. RPM, dpkg), old filters may still appear in the filter selection list but the new IPTraf version will be unable to load them.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_STARTSTOP}{\*\bkmkend ID_STARTSTOP}\b\fs26\lang1024\f2 Starting and Stopping IPTraf\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 After installation, you can start the program by simply entering\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 at the shell prompt. You will see a copyright notice, with an instruction to press any key to get started. Just press any character key, and you will be immediately taken to the main menu. All major functions of the program are found there.\hyphpar0\par\pard\sb100\li960\sl220\qj Entering the IPTraf command without any command-line parameters brings up the program's main menu. From there, you can select the facilities you want.\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf determines and makes use of the maximum number of lines and columns on the terminal.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 IPTraf does not have a SIGWINCH handler; it does not adjust itself when an xterm or some other X terminal is resized.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\f2 Technical note: \b0\f4 IPTraf needs to refer to the terminfo database in \fs16\f3 /usr/share/terminfo\fs18\f4 . If the supplied executable program fails with \fs16\f3 Error opening terminal\fs18\f4 , your terminfo database may be located somewhere else. You can control the terminfo search path by using the TERMINFO environment variable. For example, if you're using the \b sh\b0 or \b bash\b0 shell, and your terminfo database is in \fs16\f3 /usr/lib/terminfo\fs18\f4 (typical for Slackware distributions), you can use the commands:\hyphpar0\par\pard\sb200\li1360\sl178\qj \fs16\f3 TERMINFO=/usr/lib/terminfo\sa0\par\fi0\sb0 export TERMINFO\hyphpar0\par\pard\sb200\li1360\sl198\qj \fs18\f4 You can place these commands in your \fs16\f3 ~/.profile\fs18\f4 or the systemwide \fs16\f3 /etc/profile\fs18\f4 startup files.\hyphpar0\par\pard\sb100\li1360\sl198\qj You can also create a symbolic link named \fs16\f3 /usr/share/terminfo\fs18\f4 to let it point to your existing terminfo (assuming again your terminfo is in \fs16\f3 /usr/lib/terminfo\fs18\f4 ):\hyphpar0\par\pard\sb200\li1360\sl178\qj \fs16\f3 ln -s /usr/lib/terminfo /usr/share/terminfo\hyphpar0\par\pard\sb200\li1360\sl198\qj \fs18\f4 Or you can recompile your program to use your existing ncurses library installation. If you do this, make sure you have ncurses 4.2 or later.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_CMDLINE}{\*\bkmkend ID_CMDLINE}\b\fs26\f2 Command-line Options\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf has a few optional command-line parameters. As with most UNIX commands, IPTraf command-line parameters are case-sensitive (\fs18\f3 -l\fs20\f1 is NOT the same as \fs18\f3 -L\fs20\f1 ).\hyphpar0\par\pard\sb100\li960\sl220\qj The following command-line parameters can be supplied to the \b iptraf\b0 command:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 -i \i iface\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab causes the IP traffic monitor to start immediately on the specified interface. If -i all is specified, all interfaces are monitored.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -g\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab starts the general interface statistics\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -d \i iface\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab shows detailed statistics for the specified interface\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -s \i iface\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab starts the TCP/UDP traffic monitor for the specified interface\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -z \i iface\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab starts the packet size breakdown for the specified interface\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -l \i iface\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab starts the LAN station monitor on the specified interface. If \fs18\f3 -l all\fs20\f1 is specified, all LAN interfaces are monitored.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -t \i timeout\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab The \fs18\f3 -t\fs20\f1 parameter, when used with one of the other parameters that specify a facility to start, tells IPTraf to run the indicated facility for only timeout minutes, after which the facility exits. The \fs18\f3 -t\fs20\f1 parameter is ignored in menu mode.\hyphpar0\par\pard\sb100\li1360\sl220\qj \lang1033 If this parameter is not specified, the facility runs until the exit keystroke is pressed.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 -B\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab Redirects all terminal output to the "bit bucket" \fs18\f3 /dev/null\fs20\f1 , closes standard input, and places the program in the background. This parameter can be used only with one of the \fs18\f3 -i\fs20\f1 , \fs18\f3 -g\fs20\f1 , \fs18\f3 -d\fs20\f1 , \fs18\f3 -s\fs20\f1 , \fs18\f3 -z\fs20\f1 , or \fs18\f3 -l\fs20\f1 parameters. See {\field{\*\fldinst HYPERLINK \\l ID_BACKOP}{\fldrslt Background Operation}} in Chapter 9. \fs18\f3 -B\fs20\f1 is ignored in menu mode.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -L \i filename\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab Allows you to specify an alternate log file name when the any facility is directly started from the command line, whether in foreground or background mode. If specified in foreground mode, the log filename prompt is bypassed, even when logging is turned on in the \i Configure...\i0 menu. If this parameter is omitted in background mode, the default log filename is used.\hyphpar0\par\pard\sb100\li1360\sl220\qj \lang1033 This parameter always turns on logging.\hyphpar0\par\pard\sb100\li1360\sl220\qj If an absolute path is not specified, the log file will be created in the default log file directory\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 -I \i interval\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab Sets the logging interval (in minutes) when the \fs18\f3 -L\fs20\f1 parameter is used. This overrides the \i Log interval...\i0 setting in the \i Configure...\i0 menu. If omitted, the configured value is used. This parameter is ignored when the \fs18\f3 -L\fs20\f1 parameter is omitted and logging is disabled.\hyphpar0\par\pard\sb100\li1360\sl220\qj \lang1033 The value specified here will affect all facilities except for the IP traffic monitor.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 -q\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab Previously used to suppress the warning screen when IPTraf is run on kernels with IP masquerading. Since the masquerading code now processes packets in a way better suited to raw capture, this parameter is no longer needed and is retained only for compatibility.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 -f\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab Forces IPTraf to clear all lock files and reset all instance counters to zero before running any facilities. IPTraf will then think it's the first instance of itself.\hyphpar0\par\pard\sb100\li1360\sl220\qj \lang1033 The \fs18\f3 -f\fs20\f1 parameter overrides the existing locks and counters imposed by the IPTraf process and by the various facilities, causing this instance to think it is the first and that there are no other facilities running. Use this parameter with great caution. A common use for this parameter is to recover from abrupt or abnormal terminations which may leave stale locks and counters still lying around.\hyphpar0\par\pard\sb100\li1360\sl220\qj The \fs18\f3 -f\fs20\f1 parameter may be used together with the others.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 iptraf -h\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab displays a short help screen\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 While the command-line options are case-sensitive, interactive keystroke at the IPTraf full-screen interface are not.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_MENUS}{\*\bkmkend ID_MENUS}\b\fs26\lang1024\f2 Using the Menus\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 Menu items with a trailing ellipsis (\fs18\f3 ...\fs20\f1 ) either pop up a submenu with further items, or require additional information before it can complete the task and return to the menu. Menu items without an ellipsis execute immediately.\hyphpar0\par\pard\sb100\li960\sl220\qj Use the Up and Down arrow keys on your keyboard to move the selection bar. Press Enter to execute the selected item. Alternatively, you can also directly press the highlighted letter of the item you want. This will immediately execute the option.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-mmenu.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 1-1. The IPTraf Main Menu\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_EXITING}{\*\bkmkend ID_EXITING}\fs26\f2 Exiting IPTraf\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You can exit IPTraf with the Exit command in the main menu.\hyphpar0\par\pard\sb100\li960\sl220\qj When started with one of the command-line options to directly start a statistical facility, pressing X or Q will exit the facility directly, without any confirmation. The \fs18\f3 -t\fs20\f1 command-line parameter will automatically exit the facility after the specified length of time without any confirmation as well. Daemon facilities started with the \fs18\f3 -B\fs20\f1 parameter will immediately terminate after being sent a USR2 signal. See {\field{\*\fldinst HYPERLINK \\l ID_BACKOP}{\fldrslt background operation}} in chapter 9 for more information.\hyphpar0\par\pard\sb200\sl293 \b\fs26\lang1024\f2 Notes\keepn\hyphpar0\par\pard\sb133\li1280\sl220\fi-320\qj \tx1280 \b0\fs20\f1 1. \tab ftp://iptraf.seul.org/pub/iptraf/\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 2. Preparing to Use IPTraf}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 2. Preparing to Use IPTraf}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_PREPARINGTOUSE}{\*\bkmkend ID_PREPARINGTOUSE}\b\fs29\f2 Chapter 2. Preparing to Use IPTraf\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 This chapter provides information applicable to all of IPTraf's statistical monitors.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_NUMBERS}{\*\bkmkend ID_NUMBERS}\b\fs26\lang1024\f2 Number Display Notations\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf initially returns exact counts of bytes and packets. However, as they grow larger, IPTraf begins displaying them in increasingly higher denominations.\hyphpar0\par\pard\sb100\li960\sl220\qj A number standing alone with no suffix represents an exact count. A number with a K following is a kilo (thousand) figure. An M, G, and T suffix represents mega (million), giga (billion), and tera (trillion) respectively. The following table shows examples.\hyphpar0\par\pard\sb200\li960\sl220\qj \b\lang1024 Table 2-1. Numeric Display Notations\sa100\keepn\par\trowd\trleft960 \clvertalt\clbrdrt\brdrs\brdrw20\clbrdrl\brdrs\brdrw20\cellx4680\clvertalt\clbrdrt\brdrs\brdrw20\clbrdrr\brdrs\brdrw20\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 1024067\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 exactly 1024067\sa60\cell \row \trowd\trleft960 \clvertalt\clbrdrl\brdrs\brdrw20\cellx4680\clvertalt\clbrdrr\brdrs\brdrw20\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 1024K\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 approximately 1024000\sa60\cell \row \trowd\trleft960 \clvertalt\clbrdrl\brdrs\brdrw20\cellx4680\clvertalt\clbrdrr\brdrs\brdrw20\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 1024M\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 approximately 1024000000\sa60\cell \row \trowd\trleft960 \clvertalt\clbrdrl\brdrs\brdrw20\cellx4680\clvertalt\clbrdrr\brdrs\brdrw20\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 1024G\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 approximately 1024000000000\sa60\cell \row \trowd\trleft960 \clvertalt\clbrdrb\brdrs\brdrw20\clbrdrl\brdrs\brdrw20\cellx4680\clvertalt\clbrdrb\brdrs\brdrw20\clbrdrr\brdrs\brdrw20\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 1024T\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 approximately 1024000000000000\sa60\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 These notations apply to both packet and byte counts.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_INSTANCES}{\*\bkmkend ID_INSTANCES}\b\fs26\lang1024\f2 Instances and Logging\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 Since version 2.4, IPTraf allows multiple instances of the facilities at the same time in different processes (for example, you can now run two or more IP Traffic Monitors at the same time). However only one can listen on a specific interface or all interfaces at once. The only exception is the general interface statistics, which is still restricted to only one instance at a time.\hyphpar0\par\pard\sb100\li960\sl220\qj Because of this relaxation, each instance now generates log files with unique names for instances, depending on either their instance or the interface they're listening on. If the \i Logging\i0 option is turned on (see the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt Configuration}} chapter), IPTraf will prompt you for a log file name while presenting a default. You may accept this default or change it. Press Enter to accept, or Ctrl+X to cancel. Canceling will turn logging off for that particular session.\hyphpar0\par\pard\sb100\li960\sl220\qj If you don't specify an absolute path, the log file will be placed in \fs18\f3 /var/log/iptraf\fs20\f1 .\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-logprompt.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 2-1. The logfile prompt dialog\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 See the Logging section in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt Configuration}} chapter for detailed information on logging. See also the documentation on each statistical facility for the default log file names.\hyphpar0\par\pard\sb100\li960\sl220\qj The default log file names will also be used if the \fs18\f3 -B\fs20\f1 parameter is used to run IPTraf in the background. You can override the defaults with the \fs18\f3 -L\fs20\f1 parameter. See {\field{\*\fldinst HYPERLINK \\l ID_BACKOP}{\fldrslt Background Operation}} in Chapter 9.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_UPDATES}{\*\bkmkend ID_UPDATES}\b\fs26\lang1024\f2 Screen Update Delays\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 Older versions of IPTraf updated the screen as soon as a packet was received. However, screen update is one of the slowest operations the program performs. Since version 1.3, a configuration option has been available to control screen update speed.\hyphpar0\par\pard\sb100\li960\sl220\qj See the \i Screen update interval...\i0 configuration option under the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt Configuration}} chapter of this manual.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_IFACES}{\*\bkmkend ID_IFACES}\b\fs26\lang1024\f2 Supported Network Interfaces\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf currently supports the following network interface types and names.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 lo\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab The loopback interface. Every machine has one, and has an IP address of 127.0.0.1. \fs18\f3 lo\fs20\f1 is also indicated if data is detected on the \fs18\f3 dummy\i n\i0\fs20\f1 interface(s).\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 eth\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab An Ethernet interface. \i\f3 n\i0\f1 starts from 0. Therefore, \fs18\f3 eth0\fs20\f1 refers to the first Ethernet interface, \fs18\f3 eth1\fs20\f1 to the second, and so on. Most machines only have one.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 fddi\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab An FDDI interface. \i\f3 n\i0\f1 starts from 0.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 tr\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab A Token Ring interface, where \i\f3 n\i0\f1 starts from 0.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 ppp\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab A PPP interface. \i\f3 n\i0\f1 starts from 0.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 sli\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab A SLIP interface. \i\f3 n\i0\f1 starts from 0.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 ippp\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab A synchronous PPP interface using ISDN. \i\f3 n\i0\f1 starts from 0.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 isdn\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab ISDN interfaces can be given arbitrary names, but for them to work with IPTraf, they must be named \fs18\f3 isdn\i n\i0\fs20\f1 . IPTraf supports synchronous PPP (the \fs18\f3 ippp\i n\i0\fs20\f1 interfaces above), raw IP, and Cisco-HDLC encapsulation.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 plip\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab PLIP interfaces. These are point-to-point IP connections using the PC parallel port.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 ipsec\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab This refers to Free s/WAN (and possibly other) logical VPN interfaces.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 sbni\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab SBNI long-range modem interfaces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 dvb\i n\i0\fs20\f1 , \fs18\f3 sm200\fs20\f1 , \fs18\f3 sm300\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab DVB satellite-receive interfaces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 wlan\i n\i0\fs20\f1 , \fs18\f3 wvlan\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab Wireless LAN interfaces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 tun\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab general logical tunnel interfaces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 brg\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab general logical bridge interfaces\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 hdlc\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab Frame Relay base (FRAD) interfaces (non-PVC)\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 pvc\i n\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab Frame Relay Permanent Virtual Circuit interfaces\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Your system's network interfaces must be named according to the schemes specified above.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 3. The IP Traffic Monitor}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 3. The IP Traffic Monitor}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_ITRAFMON}{\*\bkmkend ID_ITRAFMON}\b\fs29\f2 Chapter 3. The IP Traffic Monitor\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 Executing the first menu item or specifying \fs18\f3 -i\fs20\f1 to the \b iptraf\b0 command takes you to the IP traffic monitor. The traffic monitor is a real-time monitoring system that intercepts all packets on all detected network interfaces, decodes the IP information on all IP packets and displays the appropriate information, most notably the source and destination addresses. It also determines the encapsulated protocol within the IP packet, and displays some important information about that as well.\hyphpar0\par\pard\sb100\li960\sl220\qj There are two windows in the traffic monitor, both of which can be scrolled with the Up and Down cursor keys. Just press W to move the \fs18\f3 Active\fs20\f1 indicator to the window you want to control.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-iptm1.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 3-1. The IP traffic monitor\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_UPPERWIN}{\*\bkmkend ID_UPPERWIN}\fs26\f2 The Upper Window\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The upper window of the traffic monitor displays the currently detected TCP connections. Information about TCP packets are displayed here. The window contains these pieces of information:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 Source address and port\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Packet count\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Byte count\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Source MAC address\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Packet Size\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Window Size\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 TCP flag statuses\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Interface\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\f2 Note: \b0\f4 Previous versions of IPTraf showed both the source and destination addresses on each line. IPTraf 2 and higher show only the \i\fs16\f3 source host\i0 :\i port\i0\fs18\f4 combination to save on screen real estate. TCP connection endpoints are still indicated with the green brackets (on color terminals) along the left edge of the screen.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The Up and Down cursor keys move an indicator bar between entries in the TCP monitor, scrolling the window if necessary. The PgUp and PgDn keys display the previous and next screenfuls of entries respectively.\hyphpar0\par\pard\sb100\li960\sl220\qj The IP traffic monitor computes the data flow rate of the currently highlighted TCP flow and displays it on the lower-right corner of the screen. The flow rate is in kilobits or kilobytes per second depending on the \i Activity mode\i0 switch in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu.\hyphpar0\par\pard\sb100\li960\sl220\qj Because this monitoring system relies solely on packet information, it does not determine which endpoint initiated the connection. In other words, it does not know which endpoints are the client and server. This is necessary because it can operate in promiscuous mode, and as such cannot determine the socket statuses for other machines on the LAN. However, a little knowledge of the well-known TCP port numbers can give a good idea about which address is that of the server.\hyphpar0\par\pard\sb100\li960\sl220\qj The system therefore displays two entries for each connection, one for each direction of the TCP connection. To make it easier to determine the direction pairs of each connection, a bracket is used to "join" both together. This bracket appears at the leftmost part of each entry.\hyphpar0\par\pard\sb100\li960\sl220\qj Just because a host entry appears at the upper end of a connection bracket doesn't mean it was the initiator of the connection.\hyphpar0\par\pard\sb100\li960\sl220\qj Each entry in the window contains these fields:\hyphpar0\par\pard\sb200\li960\sl220\qj \i\lang1024 Source address and port\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The source address and port indicator is in \i\f3 address\i0\f1 :\i\f3 port\i0\f1 format. This indicates the source machine and TCP port on that machine from which this data is coming.\hyphpar0\par\pard\sb100\li1360\sl220\qj \lang1033 The destination is the host:port at the other end of the bracket.\hyphpar0\par\pard\sb200\li960\sl220\qj \i\lang1024 Packet count\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The number of packets received for this direction of the TCP connection\hyphpar0\par\pard\sb200\li960\sl220\qj \i Byte count\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The number of bytes received for this direction of the TCP connection. These bytes include total IP and TCP header information, in addition to the actual data. Data link header (e.g. Ethernet and FDDI) data are not included.\hyphpar0\par\pard\sb200\li960\sl220\qj \i Source MAC address\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The address of the host on your local LAN that delivered this packet. This can be viewed by pressing M once if \i Source MAC addrs\i0 in traffic monitor is enabled in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu.\hyphpar0\par\pard\sb200\li960\sl220\qj \i Packet Size\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The size of the most recently received packet. This item is visible if you press M for more TCP information. This is the size of the IP datagram only, not including the data link header.\hyphpar0\par\pard\sb200\li960\sl220\qj \i Window Size\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The advertised window size of the most recently received packet. This item is visible if you press M for more TCP information.\hyphpar0\par\pard\sb200\li960\sl220\qj \i Flag statuses\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0 \~\tab The flags of the most recently received packet. \hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 S\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab SYN. A synchronization is taking place in preparation for connection establishment. If only an \fs18\f3 S\fs20\f1 is present (\fs18\f3 S---\fs20\f1 ) the source is trying to initiate a connection. If an \fs18\f3 A\fs20\f1 is also present (\fs18\f3 S-A-\fs20\f1 ), this is an acknowledgment of a previous connection request, and is responding.\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 A\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab ACK. This is an acknowledgment of a previously received packet\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 P\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab PSH. A request to push all data to the top of the receiving queue\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 U\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab URG. This packet contains urgent data\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 RESET\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab RST. The source machine indicated in this direction reset the entire connection. The direction entries for reset connections become available for new connections.\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 DONE\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab The connection is done sending data in this direction, and has sent a FIN (finished) packet, but has not yet been acknowledged by the other host.\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 CLOSED\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab The FIN has been acknowledged by the other host. When both directions of a connection are marked CLOSED, the entries they occupy become available for new connection entries.\hyphpar0\par\pard\sb200\li1360\sl220\qj \fs18\f3 -\keepn\hyphpar0\par\pard\sb100\li1760\sl220\fi-400\qj \tx1760 \fs20\f1 \~\tab The flag is not set\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Some other pieces of information can be viewed as well. The M key displays more TCP information. Pressing M once displays the MAC addresses of the LAN hosts that delivered the packets (if the \i Source MAC addrs in traffic monitor\i0 option is enabled in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu). \fs18\f3 N/A\fs20\f1 is displayed if no packets have been received from the source yet, or if the interface doesn't support MAC addresses (such as PPP interfaces).\hyphpar0\par\pard\sb100\li960\sl220\qj If the \i Source MAC addrs in traffic monitor\i0 option is not enabled, pressing M simply toggles between the counts and the packet and window sizes.\hyphpar0\par\pard\sb100\li960\sl220\qj By default, only IP addresses are displayed, but if you have access to a name server or host table, you may enable reverse lookup for the IP addresses. Just enable reverse lookup in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu.\hyphpar0\par\pard\sb100\brdrt\brdrs\brdrw20\brsp200\li1000\ri40\brdrl\brdrs\brdrw20\brsp40\li1000\ri40\brdrb\brdrs\brdrw20\brsp0\li1000\ri40\brdrr\brdrs\brdrw20\brsp40\li1000\ri40\sl220\qj \b\lang1024 The rvnamed Process\keepn\hyphpar0\par\pard\sb100\brdrt\brdrs\brdrw20\brsp200\li1000\ri40\brdrl\brdrs\brdrw20\brsp40\li1000\ri40\brdrb\brdrs\brdrw20\brsp0\li1000\ri40\brdrr\brdrs\brdrw20\brsp40\li1000\ri40\sl220\qj \b0\lang1033 The IP traffic monitor starts a daemon called \b rvnamed\b0 to help speed up reverse lookups without sacrificing too much keyboard control and accuracy of the counts. While reverse lookup is being conducted in the background, IP addresses will be used until the resolution is complete.\hyphpar0\par\pard\sb100\brdrt\brdrs\brdrw20\brsp200\li1000\ri40\brdrl\brdrs\brdrw20\brsp40\li1000\ri40\brdrb\brdrs\brdrw20\brsp0\li1000\ri40\brdrr\brdrs\brdrw20\brsp40\li1000\ri40\sl220\qj If for some reason \b rvnamed\b0 cannot start (probably due to improper installation or lack of memory), and you are on the Internet, and you enable reverse lookup, your keyboard control can become very slow. This is because the standard lookup functions do not return until they have completed their tasks, and it can take several seconds for a name resolution in the foreground to complete.\hyphpar0\par\pard\sb100\brdrt\brdrs\brdrw20\brsp200\li1000\ri40\brdrl\brdrs\brdrw20\brsp40\li1000\ri40\brdrb\brdrs\brdrw20\brsp0\li1000\ri40\brdrr\brdrs\brdrw20\brsp40\li1000\ri40\sl220\qj \b rvnamed\b0 will spawn up to 200 children to process reverse DNS queries.\keepn\hyphpar0\par\pard\brdrt\brdrs\brdrw20\brsp200\li1000\ri40\brdrl\brdrs\brdrw20\brsp40\li1000\ri40\brdrb\brdrs\brdrw20\brsp0\li1000\ri40\brdrr\brdrs\brdrw20\brsp40\li1000\ri40\sl-200\keepn\par\pard\sl-1\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Tip: \b0\f4 If you notice unusual SYN activity (too many initial (\fs16\f3 S---\fs18\f4 ) but frozen SYN entries, or rapidly increasing initial SYN packets for a single connection), you may be under a SYN flooding attack or TCP port scan. Apply appropriate measures, or the targeted machines may begin denying network services.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 Entries not updated within a user-configurable amount of time may get replaced with new connections. The default time is 15 minutes. This is regardless of whether the connection is closed or not. (Some unclosed connections may be due to extremely slow links or crashes at either end of the connection.) This figure can be changed at the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu.\hyphpar0\par\pard\sb100\li960\sl220\qj Some early entries may have a > symbol in front of its packet count. This means the connection was already established when the monitor started. In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. Eventually, these > entries will close (or time out) and disappear. TCP entries without the > were initiated after the traffic monitor started, and the counts indicate the totals of the connection itself. Just consider entries with > partial.\hyphpar0\par\pard\sb100\li960\sl220\qj Some > entries may go idle if the traffic monitor was started when these connections were already half-closed (FIN sent by one host, but data still being sent by the other). This is because the traffic monitor cannot determine if a connection was already half-closed when it started. These entries will eventually time out. (To minimize these entries, an entry is not added by the monitor until a packet with data or a SYN packet is received.)\hyphpar0\par\pard\sb100\li960\sl220\qj Direction entries also become available for reuse if an ICMP Destination Unreachable message is received for the connection.\hyphpar0\par\pard\sb100\li960\sl220\qj The lower part of the screen contains a summary line showing the IP, TCP, UDP, ICMP, and non-IP byte counts since the start of the monitor. The IP, TCP, UDP, and ICMP counts include only the IP datagram header and data, not the data-link headers. The non-IP count includes the data-link headers.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Technical note: IP Forwarding and Masquerading: \b0\f4 Previous versions of IPTraf issued a warning if the kernel had IP masquerading enabled due to the way the kernel masqueraded and translated the IP addresses. The new kernels no longer do it as before and IPTraf now gives output properly on masquerading machines. The \fs16\f3 -q\fs18\f4 parameter is no longer required to suppress the warning screen.\hyphpar0\par\pard\sb100\li1360\sl198\qj On forwarding (non-masquerading) machines packets and TCP connections simply appear twice, one each for the incoming and outgoing interfaces if all interafaces are being monitored.\hyphpar0\par\pard\sb100\li1360\sl198\qj On masquerading machines, packets and connections from the internal network to the external network also appear twice, one for the internal and external interface. Packets coming from the internal network will be indicated as coming from the internal IP address that sourced them, and also as coming from the IP address of the external interface on your masquerading machine. In much the same way, packets coming in from the external network will look like they're destined for the external interface's IP address, and again as destined for the final host on the internal network.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _725}{\*\bkmkend _725}\b\fs24\f2 Closed/Idle/Timed Out Connections\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 A TCP connection entry that closes, gets reset, or stays idle too long normally gets replaced with new connections. However, if there are too many of these, active connections may become interspersed among closed, reset, or idle entries.\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf can be set to automatically remove all closed, reset, and idle entries with the \i TCP closed/idle persistence...\i0 configuration option. You can also press the F key to immediately clear them at any time.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 The \i TCP timeout...\i0 option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains on-screen. The \i TCP closed/idle persistence...\i0 parameter flushes entries that have been idle for the number of minutes defined by the \i TCP timeout...\i0 option.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _736}{\*\bkmkend _736}\b\fs24\f2 Sorting TCP Entries\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 The TCP connection entries can be sorted by pressing the S key, then by selecting a sort criterion. Pressing S will display a box showing the available sort criteria. Press P to sort by packet count, B to sort by byte count. Pressing any other key cancels the sort.\hyphpar0\par\pard\sb100\li960\sl220\qj The sort operation compares the larger values in each connection entry pair and sorts the counts in descending order.\hyphpar0\par\pard\sb100\li960\sl220\qj Over time, the entries will go out of order as counts proceed at varying rates. Sorting is not done automatically so as not to degrade performance and accuracy.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-iptmsort.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 3-2. The IP traffic monitor sort criteria\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_LOWERWIN}{\*\bkmkend ID_LOWERWIN}\fs26\f2 Lower Window\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The lower window displays information about the other types of traffic on your network. The following protocols are detected internally:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 User Datagram Protocol (UDP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Internet Control Message Protocol (ICMP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Open Shortest-Path First (OSPF)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Interior Gateway Routing Protocol (IGRP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Interior Gateway Protocol (IGP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Internet Group Management Protocol (IGMP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 General Routing Encapsulation (GRE)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Layer 2 Tunneling Protocol (L2TP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 IPSec AH and ESP protocols (IPSec AH and IPSec ESP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Address Resolution Protocol (ARP)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Reverse Address Resolution Protocol (RARP)\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Other IP protocols are looked up from the \fs18\f3 /etc/services\fs20\f1 file. If \fs18\f3 /etc/services\fs20\f1 doesn't contain information about that protocol, the protocol number is indicated.\hyphpar0\par\pard\sb100\li960\sl220\qj Non-IP packets are indicated as \fs18\f3 Non-IP\fs20\f1 in the lower window.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 The source and destination addresses for ARP and RARP entries are MAC addresses.\hyphpar0\par\pard\sb100\li1360\sl198\qj Strictly speaking, ARP and RARP packets aren't IP packets, since they are not encapsulated in an IP datagram. They're just indicated because they are integral to proper IP operation on LANs.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 For all packets in the lower window, only the first IP fragment is indicated (since that contains the header of the IP-encapsulated protocol) but with no further information from the encapsulated protocol.\hyphpar0\par\pard\sb100\li960\sl220\qj UDP packets are also displayed in \i\fs18\f3 address\i0 :\i port\i0\fs20\f1 format while ICMP entries also contain the ICMP message type. For easier location, each type of protocol is color-coded (only on color terminals such as the Linux console).\hyphpar0\par\pard\sb200\li960\sl220\qj \lang1024 UDP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Red on White\hyphpar0\par\pard\sb200\li960\sl220\qj ICMP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Yellow on Blue\hyphpar0\par\pard\sb200\li960\sl220\qj OSPF\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Black on Cyan\hyphpar0\par\pard\sb200\li960\sl220\qj IGRP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Bright white on Cyan\hyphpar0\par\pard\sb200\li960\sl220\qj IGP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Red on Cyan\hyphpar0\par\pard\sb200\li960\sl220\qj IGMP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Bright green on Blue\hyphpar0\par\pard\sb200\li960\sl220\qj GRE\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Blue on white\hyphpar0\par\pard\sb200\li960\sl220\qj ARP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Bright white on Red\hyphpar0\par\pard\sb200\li960\sl220\qj RARP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Bright white on Red\hyphpar0\par\pard\sb200\li960\sl220\qj Other IP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Yellow on red\hyphpar0\par\pard\sb200\li960\sl220\qj Non-IP\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \~\tab Yellow on Red\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 The lower window can hold up to 512 entries. You can scroll the lower window by using the W key to move the Active indicator to it, and by using the Up and Down cursor keys. The lower window automatically scrolls every time a new entry is added, and either the first entry or last entry is visible. Upon reaching 512 entries, old entries are thrown out as new entries are added.\hyphpar0\par\pard\sb100\li960\sl220\qj Some entries may be too long to completely fit in a screen line. You can use the Left and Right cursor keys to vertically scroll the lower window when it is marked \fs18\f3 Active\fs20\f1 . If your terminal can be resized (e.g. xterm), you may do so before starting IPTraf.\hyphpar0\par\pard\sb100\li960\sl220\qj Entries for packets received on LAN interfaces also include the source MAC address of the LAN host which delivered it. This behavior is enabled by turning on the Source MAC addrs in traffic monitor toggle in the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} menu.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _835}{\*\bkmkend _835}\b\fs24\lang1024\f2 Entry Details\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 In general, the entries in the lower window indicate the protocol, the IP datagram size (full frame size for non-IP, including ARP and RARP), the source address, the destination address, and the network interface the packet was detected on. However, some protocols have a little more information.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 ICMP\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 ICMP entries are displayed in this format:\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 ICMP \i type\i0 [(\i subtype\i0 )] (\i size\i0 bytes) from \i source\i0 to \i destination\i0 \sa0\par\fi0\sb0 [(src HWaddr \i srcMACaddress\i0 )] on \i interface\hyphpar0\par\pard\sb200\li960\sl220\qj \i0\fs20\lang1033\f1 where type could be any of the following:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 echo req, echo rply\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP echo request and reply. Usually used by the ping program and other network monitoring and diagnostic program. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 dest unrch\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP destination unreachable. Something failed to reach its target. The dest unreach type is supplemented with a further indicator of the problem. Destination unreachable messages for TCP traffic causes the corresponding TCP entry in the upper window to be made available for reuse by new connections. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 redirct\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP redirect. Usually generated by a router to tell a host that a better gateway is available. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 src qnch\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab The ICMP source quench is used to stop a host from transmitting. It's a flow control mechanism for IP. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 time excd\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab Indicates a packet's time-to-live value expired before it got to its destination. Mostly happens if a destination is too far away. Also used by the traceroute program.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 router adv\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP router advertisement \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 router sol\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP router solicitation \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 timestmp req\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP timestamp request\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 timestmp rep\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP timestamp reply \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 info req\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP information request \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 info rep\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP information reply \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 addr mask req\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP address mask request \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 addr mask rep\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP address mask reply \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 param prob\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab ICMP parameter problem \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 bad/unknown\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab An unrecognized ICMP packet was received, or the packet is corrupted.\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 The destination unreachable message also includes information on the type of error encountered. Here are the destination unreachable codes:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 ntwk\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab network unreachable \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 host\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab host unreachable \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 proto\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab protocol unreachable \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 port\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab port unreachable \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 pkt fltrd\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab packet filtered (normally by an access rule on a router or firewall) \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 DF set\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab the packet has to be fragmented somewhere, but its don't fragment (DF) bit is set.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 src rte fail\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab source route failed \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 src isltd\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab source isolated (obsolete) \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 net comm denied\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab network communication denied \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 host comm denied\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab host communication denied \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 net unrch for TOS\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab network unreachable for specified IP type-of-service \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 host unrch for TOS\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab host unreachable for specified IP type-of-service \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 prec violtn\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab precedence violation \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 prec cutoff\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab precedence cutoff \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 dest net unkn\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab destination network unknown \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 dest host unkn\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab destination network unknown\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 For more information on ICMP, see RFC 792.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 OSPF\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 OSPF messages also include a little more information. The format of an OSPF message in the window is:\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 OSPF \i type\i0 (a=\i area\i0 r=\i router\i0 ) (\i size\i0 bytes) from \i source\i0 to \i destination\i0 \sa0\par\fi0\sb0 [(src HWaddr \i srcMACaddress\i0 )] on \i interface\hyphpar0\par\pard\sb200\li960\sl220\qj \i0\fs20\lang1033\f1 The type can be one of the following:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 hlo\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF hello. Hello messages establish OSPF communications and keep routers informed of each other's presence. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 DB desc\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF Database Description \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 LSR\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF Link State Request \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 LSU\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF Link State Update. Messages indicating the states of the OSPF network links \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 LSA\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF Link State Acknowledgment\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 The entries in parentheses:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 a=\i area\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab The area number of the OSPF message\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 r=\i router\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \i0\fs20\f1 \~\tab The IP address of the router that generated the message. It is not necessarily the same as the source address of the encapsulating IP packet.\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Many times, the destination addresses for OSPF packets are class D multicast addresses in standard dotted decimal notation or (if reverse lookup is enabled), hosts under the \fs18\f3 MCAST.NET\fs20\f1 domain. Such multicast addresses are defined as follows:\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1024\f3 224.0.0.5 (OSPF-ALL.MCAST.NET)\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF all routers\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 224.0.0.6 (OSPF-DSIG.MCAST.NET)\keepn\hyphpar0\par\pard\sb100\li1360\sl220\fi-400\qj \tx1360 \fs20\f1 \~\tab OSPF all designated routers\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 See RFC 1247 for details on the OSPF protocol.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart _1076}{\*\bkmkend _1076}\b\fs26\lang1024\f2 Additional Information\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 When started from the main menu and logging is enabled, the IP traffic monitor prompts you for a log file name. The default name is \fs18\f3 ip_traffic-\i n\i0 .log (where \i n\i0\fs20\f1 is what instance of the traffic monitor this is (1, 2, 3, and so on). (e.g. if this is the first instance, the default file name will be \fs18\f3 ip_traffic-1.log\fs20\f1 .)\hyphpar0\par\pard\sb100\li960\sl220\qj When started with the \fs18\f3 -i\fs20\f1 parameter, the log filename can be specified with the \fs18\f3 -L\fs20\f1 parameter. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\pard\sb100\li960\sl220\qj On busy networks, the display may become cluttered with traffic you're not interested in. To control the traffic monitor's output, you can apply a \i filter\i0 . See Chapter 7, {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt Filters}} for more information on IPTraf's filters.\hyphpar0\par\pard\sb100\li960\sl220\qj At any time, you can press X or Q to return to the main menu (or back to the shell if the monitor was started with \b iptraf -i\b0 ).\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 4. Network Interface Statistics}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 4. Network Interface Statistics}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_NETSTATS}{\*\bkmkend ID_NETSTATS}\b\fs29\f2 Chapter 4. Network Interface Statistics\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 There are two network interface statistics facilities: the general interface statistics, which displays a statistical summary of all attached interfaces, and the detailed interface statistics, which shows more statistical and load information about a single selected interface.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GENSTATS}{\*\bkmkend ID_GENSTATS}\b\fs26\lang1024\f2 General Interface Statistics\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The second menu option displays a list of attached network interfaces, and some general packet counts. Specifically, it displays counts of IP, non-IP, and bad IP packets (packets with IP checksum errors). It also includes an activity indicator, which shows the number of kilobits and packets the interface sees per second. All figures are for incoming and outgoing packets. (Again, considering promiscuous mode for LAN interfaces, which simply causes the machine to intercept all packets). This is useful for general monitoring of all attached interfaces. If byte counts and additional information are needed for a specific interface, the \i Detailed interface statistics\i0 option is also available.\hyphpar0\par\pard\sb100\li960\sl220\qj The activity indicators can be toggled between kbits/s and kbytes/s with the \i Activity mode\i0 configuration option.\hyphpar0\par\pard\sb100\li960\sl220\qj The general statistics window will dynamically add new entries as packets from newly-created interfaces (e.g. new PPP interfaces) are intercepted. Long lists can be scrolled with the Up, Down, PgUp, and PgDn keys.\hyphpar0\par\pard\sb100\li960\sl220\qj This monitor is affected by IPTraf's {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt filters}} as described in Chapter 7.\hyphpar0\par\pard\sb100\li960\sl220\qj Copies of the statistics are written to the log file \fs18\f3 iface_stats_general.log\fs20\f1 at regular intervals if logging is enabled. See the \i Logging\i0 option int the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt Configuration}} chapter.\hyphpar0\par\pard\sb100\li960\sl220\qj This facility can be started directly from the command line with the \b -g\b0 option to the \b iptraf\b0 command. When started from the command line, the log filename and log interval can be specified with the \fs18\f3 -L\fs20\f1 and \fs18\f3 -I\fs20\f1 parameters respectively. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-gstat1.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 4-1. The general interface statistics screen\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 You can press X or Q to return to the main menu. \hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_DETSTATS}{\*\bkmkend ID_DETSTATS}\b\fs26\lang1024\f2 Detailed Interface Statistics\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The third menu option displays packet statistics for any selected interface. It provides basically the same information as the \i General interface statistics\i0 option, with additional details. This facility provides the following information:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 Total packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 IP packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 TCP packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 UDP packet and byte count\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 ICMP packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Other IP-type packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Non-IP packet and byte counts\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Checksum error count\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Interface activity\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Broadcast packet and byte counts\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 All IP byte counts (IP, TCP, UDP, ICMP, other IP) include IP header data and payload. The data link header is not included. The full frame length (including data-link header) is included in the non-IP and Total byte count. All data-link headers are also included in the Total byte counts.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-dstat1.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 4-2. The detailed interface statistics screen\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 The upper portion of the screen contains the packet and byte counts for all IP and non-IP packets intercepted on the interface. The lower portion contains the total, incoming, and outgoing interface data rates.\hyphpar0\par\pard\sb100\li960\sl220\qj This facility also displays incoming and outgoing counts and data rates. The packet size breakdown in versions prior to 2.0.0 has been moved to its own facility under \i Statistical breakdowns.../By packet size\i0 as described in {\field{\*\fldinst HYPERLINK \\l ID_PKTSIZE}{\fldrslt Chapter 5}}.\hyphpar0\par\pard\sb100\li960\sl220\qj An outgoing packet is one that exits your interface, regardless of whether it originated from your machine or came from another machine and was routed through yours. An incoming packet is one that enters your interface, either addressed to you directly, broadcast, multicast, or captured promiscuously.\hyphpar0\par\pard\sb100\li960\sl220\qj The rate indicators can be set to display kbits/s or kbytes/s with the \i Activity mode\i0 configuration option.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 Buffering and some other factors may affect the data rates, notably the outgoing rate, causing it to reflect a higher figure than the actual rate at which the interface is sending.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The figures are logged at regular intervals if logging is enabled. The default log file name at the prompt is \fs18\f3 iface_stats_detailed-\i iface\i0 .log\fs20\f1 where iface is the selected interface for this session (for example, \fs18\f3 iface_stats_detailed-eth0.log\fs20\f1 ).\hyphpar0\par\pard\sb100\li960\sl220\qj If you wish to start this facility directly from the command line, you can specify the \fs18\f3 -d\fs20\f1 parameter and an interface to monitor. For example,\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf -d eth0\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 starts the statistics for \fs18\f3 eth0\fs20\f1 . The interface must be specified, or IPTraf will not start the facility.\hyphpar0\par\pard\sb100\li960\sl220\qj When started from the command line, the log filename and log interval can be specified with the \fs18\f3 -L\fs20\f1 and \fs18\f3 -I\fs20\f1 parameters respectively. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 In both the general and detailed statistics screens, as well as in the IP traffic monitor, the packet counts are for actual network packets (layer 2), not the logical IP packets (layer 3) that may be reconstructed after fragmentation. That means, if a packet was fragmented into four pieces, and these four fragments pass over your interface, the packet counts will indicate four separate packets.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The figure for the IP checksum errors is a packet count only, because the corrupted IP header cannot be relied upon to give a correct IP packet length value.\hyphpar0\par\pard\sb100\li960\sl220\qj This facility's output is also affected by IPTraf's {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt filters}}. See Chapter 7 for more information on filters.\hyphpar0\par\pard\sb100\li960\sl220\qj Pressing X or Q takes you back to the main menu (if this facility was started with the command-line option, X or Q drops you back to the shell).\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 5. Statistical Breakdowns}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 5. Statistical Breakdowns}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_STATBREAKDOWNS}{\*\bkmkend ID_STATBREAKDOWNS}\b\fs29\f2 Chapter 5. Statistical Breakdowns\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 Statistical breakdowns contain two facilities that break down traffic counts by either packet size or TCP/UDP port.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_PKTSIZE}{\*\bkmkend ID_PKTSIZE}\b\fs26\lang1024\f2 Packet Sizes\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The packet size breakdown facility used to be incorporated into the detailed interface statistics. It has since been moved to its own facility. It is entered by selecting \i Statistical Breakdowns/By packet size\i0 .\hyphpar0\par\pard\sb100\li960\sl220\qj The packet size breakdown takes the interface's Maximum Transmission Unit (MTU) size and divides it into 20 brackets, each bracket containing a range of sizes. As a packet is captured, its size is determined and the appropriate bracket is incremented.\hyphpar0\par\pard\sb100\li960\sl220\qj This facility provides an idea as to the packet sizes passing over your network, and can aid in network (re)design decisions.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-pktsize.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 5-1. The packet size statistical breakdown\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 If logging is enabled, copies of the statistics are written at regular intervals to a log file. The default log file name is \fs18\f3 packet_size-\i iface\i0 .log\fs20\f1 where \i\f3 iface\i0\f1 is the selected interface for this session (for example, \fs18\f3 packet_size-eth0.log\fs20\f1 ).\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf's filters do not affect this facility.\hyphpar0\par\pard\sb100\li960\sl220\qj The packet size breakdown can also be invoked straight from the command line by specifying the \fs18\f3 -z\fs20\f1 iface parameter. The interface parameter is required. For example, this command runs the facility on interface \fs18\f3 eth0\fs20\f1 .\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf -z eth0\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 When started from the command line, the log filename and log interval can be specified with the \fs18\f3 -L\fs20\f1 and \fs18\f3 -I\fs20\f1 parameters respectively. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\pard\sb100\li960\sl220\qj To exit, press X or Ctrl+X.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_SERVMON}{\*\bkmkend ID_SERVMON}\b\fs26\lang1024\f2 TCP and UDP Traffic Statistics\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf also includes a facility that generates statistics on TCP and UDP traffic. This facility displays counts of all TCP and UDP packets with source or destination ports numbered less than 1024. Ports 1 to 1023 are reserved for the TCP/IP application protocols (well-known ports).\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-tcpudp.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 5-2. The TCP/UDP service monitor\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 The statistics window indicates the protocol (TCP or UDP), the port number, the total packets and bytes counted for this particular protocol/port combination, the packets and bytes destined for that protocol and port, and the packets and bytes coming from that protocol and port.\hyphpar0\par\pard\sb100\li960\sl220\qj Byte counts include the IP header and payload only. The data link header is not included.\hyphpar0\par\pard\sb100\li960\sl220\qj The protocol/port indicators are color-coded for easier identification on color terminals. TCP indicators are in yellow, UDP in bright green.\hyphpar0\par\pard\sb100\li960\sl220\qj Some network applications or protocols may use port numbers higher than 1023. Examples of these include application proxy servers (HTTP proxy servers typically use values like 8000, 8080, 8888, and the like), and IRC (IRC servers commonly accept connections on ports 6660 to 6669). These ports are by default not included in the counts. If you do want to include a higher-numbered port in the statistics, you can add them yourself from the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}}\i /Additional ports...\i0 menu item. See the section below.\hyphpar0\par\pard\sb100\li960\sl220\qj If logging is enabled, The statistics are also written to a log file (the default name is \fs18\f3 tcp_udp_services-\i iface\i0 .log\fs20\f1 , where iface is the selected interface (for example, \fs18\f3 tcp_udp_services-eth0.log\fs20\f1 ).\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf computes the total, incoming, outgoing, and data rates of the protocol currently indicated by the facility's highlight bar. The data rates are indicated at the bottom of the screen. If logging is enabled, the average data rates since the start of the facility are placed in the log file.\hyphpar0\par\pard\sb100\li960\sl220\qj The Up and Down cursor keys move the highlight bar. Pressing X or Ctrl+X exits and returns to the main menu (or the shell if it was started from the command line).\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1222}{\*\bkmkend _1222}\b\fs24\lang1024\f2 Sorting TCP/UDP Entries\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Pressing the S key brings up a window which allows you to select the field by which the entries will be sorted. You can press R to sort by port, P to sort by total packets, B to sort by total bytes, T to sort by incoming packets (packets to), O to sort by incoming bytes (bytes to), F to sort by outgoing packets (packets from) and M to sort by outgoing bytes (bytes from). Pressing any other key cancels the sort.\hyphpar0\par\pard\sb100\li960\sl220\qj Port numbers are sorted in ascending order (least first) but statistics are sorted in descending order (largest counts first).\hyphpar0\par\pard\sb100\li960\sl220\qj As with the IP traffic monitor, sorting is performed only with this sequence. Automatic sorting is not performed so as not to affect performance.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-tcpudpsort.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 5-3. The TCP/UDP monitor's sort criteria\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1230}{\*\bkmkend _1230}\fs24\f2 Additional Information\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf's filters affect the output of this facility. See Chapter 7, {\field{\*\fldinst HYPERLINK \\l ID_FILTERS}{\fldrslt Filters}} for more information about filters.\hyphpar0\par\pard\sb100\li960\sl220\qj If you wish to start this facility from the command line, you can use the \fs18\f3 -s\fs20\f1 option followed by an interface to monitor. For example,\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf -s eth0\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 brings up this module for traffic on \fs18\f3 eth0\fs20\f1 . The interface must be specified, or IPTraf will drop back to the shell.\hyphpar0\par\pard\sb100\li960\sl220\qj When started from the command line, the log filename and log interval can be specified with the \fs18\f3 -L\fs20\f1 and \fs18\f3 -I\fs20\f1 parameters respectively. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 6. LAN Station Statistics}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 6. LAN Station Statistics}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_HOSTMON}{\*\bkmkend ID_HOSTMON}\b\fs29\f2 Chapter 6. LAN Station Statistics\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 The LAN station monitor (Ethernet station monitor on versions prior to 1.3.0) discovers MAC addresses and displays statistics on the number of incoming, and outgoing packets. It also includes figures for incoming and outgoing kilobits per second for each discovered station.\hyphpar0\par\pard\sb100\li960\sl220\qj The entry above each line of statistics is the station's LAN type (Ethernet, PLIP, Token Ring, or FDDI) and the hardware MAC address. Each statistics line consists of the following information:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 Total packets incoming\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 IP packets incoming\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Total bytes incoming\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Incoming rate\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Total packets outgoing\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 IP packets outgoing\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Total bytes outgoing\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Outgoing rate\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 The byte counts include the data link header. The activity indicators can be set to display kbits/s or kbytes/s with the \i Activity mode\i0 configuration option.\hyphpar0\par\pard\sb100\li960\sl220\qj This facility works only for Ethernet, PLIP, Token Ring, and FDDI frames. Loopback. ISDN, and SLIP/PPP networks are not monitored here.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-hw.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 6-1. The LAN station monitor\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 Copies of the statistics are written to a log file at regular intervals if logging is enabled. The default log file name is \fs18\f3 lan_statistics-\i n\i0 .log\fs20\f1 , where n is the instance number of this facility (for example, if this is the first instance, the generated default log file name is \fs18\f3 lan_statistics-1.log\fs20\f1 ).\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_SORTINGLAN}{\*\bkmkend ID_SORTINGLAN}\b\fs26\lang1024\f2 Sorting the LAN Station Monitor Entries\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 Press S to sort the entries. A box will pop up and display the keys you can press to select the field by which the entries will be sorted. Press P to sort by total incoming packets, I to sort by incoming IP packets, B to sort by total incoming bytes, K to sort by total outgoing packets, O to sort by outgoing IP packets, and Y to sort by total outgoing bytes. Pressing any other key cancels the sort.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-hwsort.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 6-2. The LAN station monitor's sort criteria\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 When started from the command line, the log filename and log interval can be specified with the \fs18\f3 -L\fs20\f1 and \fs18\f3 -I\fs20\f1 parameters respectively. See the {\field{\*\fldinst HYPERLINK \\l ID_CMDLINE}{\fldrslt Command-line Parameters}} section above for more information.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_MORELANMONINFO}{\*\bkmkend ID_MORELANMONINFO}\b\fs26\lang1024\f2 Additional Information\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The window can be scrolled with the Up and Down cursor keys. Press X or Q to return to the main menu (or the shell if this facility was started with the \fs18\f3 -l\fs20\f1 command-line option).\hyphpar0\par\pard\sb100\li960\sl220\qj The output of this facility is affected by any applied IPTraf filter.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 7. Filters}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 7. Filters}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_FILTERS}{\*\bkmkend ID_FILTERS}\b\fs29\f2 Chapter 7. Filters\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 Filters are used to control the information displayed by all facilities. You may want to view statistics only on particular traffic so you must restrict the information displayed. The filters also apply to logging activity.\hyphpar0\par\pard\sb100\li960\sl220\qj The IPTraf filter management system is accessible through the \i Filters...\i0 submenu.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-filtermenu.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 7-1. The Filters submenu\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_IPFILTERS}{\*\bkmkend ID_IPFILTERS}\fs26\f2 IP Filters\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The \i Filters/IP...\i0 menu option allows you to define a set of rules that determine what IP traffic to pass to the monitors. Selecting this option pops up another menu with the tasks used to define and apply custom IP filters.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-ipfltmenu.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 7-2. The IP filter menu\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1304}{\*\bkmkend _1304}\fs24\f2 Defining a New Filter\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 A freshly installed program will have no filters defined, so before anything else, you will have to define a filter. You can do this by selecting the \i Define new filter...\i0 option.\hyphpar0\par\pard\sb100\li960\sl220\qj Selecting this option displays a box asking you to enter a short description of the filter you are going to define. Just enter any text that clearly identifies the nature of the filter.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-ipfltnamedlg.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 7-3. The IP filter name dialog\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 Press Enter when you're done with that box. As an alternative, you can also press Ctrl+X to cancel the operation.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 The Filter Rule Selection Screen\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 After you enter the filter's description, you will be taken to a blank rule selection box. At this screen you manage the various rules you define for this filter. You can opt to insert, append, edit, or delete rules.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-ipfltlist.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 7-4. The filter rule selection screen. Selecting an entry displays that set for editing\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\lang1033 Any rules defined will appear here. You will see the source and destination addresses, masks and ports (long addresses and masks may be truncated) and whether this rule includes or excludes matching packets.\hyphpar0\par\pard\sb100\li960\sl220\qj Between the source and destination parameters is an arrow that indicates whether the rule matches packets (single-headed) only exactly or whether it matches packets flowing in the opposite direction (double-headed).\hyphpar0\par\pard\sb100\li960\sl220\qj At this screen, press I to insert at the current position of the selection bar, A to append a rule to the end of the list, Enter to edit the highlighted rule and D to delete the selected rule. With an empty list, A or I can be used to add the first rule.\hyphpar0\par\pard\sb100\li960\sl220\qj To add the first rule, press A or I. You will then be presented with a dialog box that allows you to enter the rule's parameters.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 Entering Filter Rules\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 You can enter addresses of individual hosts, networks, or a catch-all address. The nature of the address will be determined by the wildcard mask.\hyphpar0\par\pard\sb100\li960\sl220\qj You'll notice two sets of fields, marked \fs18\f3 Source\fs20\f1 and \fs18\f3 Destination\fs20\f1 . You fill these out with the information about your source and targets.\hyphpar0\par\pard\sb100\li960\sl220\qj Fill out the host name or IP address of the hosts or networks in the first field marked \fs18\f3 Host name/IP Address\fs20\f1 . Enter it in standard dotted-decimal notation. When done, press Tab to move to the \fs18\f3 Wildcard mask\fs20\f1 field. The wildcard mask is similar but not exactly identical to the standard IP subnet mask. The wildcard mask is used to determine which bits to ignore when processing the filter. In most cases, it will work very closely like a subnet mask. Place ones (1) under the bits you want the filter to recognize, and keep zeros (0) under the bits you want the filter to ignore. For example:\hyphpar0\par\pard\sb100\li960\sl220\qj To recognize the host 207.0.115.44\sa200\par\trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 207.0.115.44\sa60\cell \row \trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To recognize all hosts belonging to network 202.47.132.\i\f3 x\sa200\par\trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 202.47.132.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.0\sa60\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To recognize all hosts with any address:\sa200\par\trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx4680\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The IP address/wildcard mask mechanism of the display filter doesn't recognize IP address class. It uses a simple bit- pattern matching algorithm.\hyphpar0\par\pard\sb100\li960\sl220\qj The wildcard mask also does not have to end on a byte boundary; you may mask right into a byte itself. For example, 255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in binary).\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf also accepts host names in place of the IP addresses. IPTraf will resolve the host name when the filter is loaded. When the filter is interpreted, the wildcard mask will also be applied. This can be useful in cases where a single host name may resolve to several IP addresses.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Tip: \b0\f4 See the \i Linux Network Administrator's Guide\i0 if you need more information on IP addresses and subnet masking.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\f2 Tip: \b0\f4 IPTraf allows you to specify the wildcard mask in Classless Interdomain Routing (CIDR) format. This format allows you to specify the number of 1-bits that mask the address. CIDR notation is the form \i\fs16\f3 address/bits\i0\fs18\f4 where the \i\fs16\f3 address\i0\fs18\f4 is the IP address or host name and \i\fs16\f3 bits\i0\fs18\f4 is the number of 1-bits in the mask. For example, if you want to mask 10.1.1.0 with \fs16\f3 255.255.255.0\fs18\f4 , note that \fs16\f3 255.255.255.0\fs18\f4 has 24 1-bits, so instead of specifying \fs16\f3 255.255.255.0\fs18\f4 in the wildcard mask field, you can just enter \fs16\f3 10.1.1.0/24\fs18\f4 in the address field. IPTraf will translate the mask bits into an appropriate wildcard mask and fill in the mask field the next time you edit the filter rule.\hyphpar0\par\pard\sb100\li1360\sl198\qj If you specify the mask in CIDR notation, leave the wildcard mask fields blank. If you fill them up, the wildcard mask fields will take precedence.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The \fs18\f3 Port\fs20\f1 fields should contain a port number or range of any TCP or UDP service you may be interested in. If you want to match only a single port number, fill in the first field, while leaving the second blank or set to zero. Fill in the second field if you want to match a range of ports (e.g. 80 to 90). Leave the first field blank or set to zero to let the filter ignore the ports altogether. You will most likely be interested in target ports rather than source ports (which are usually unpredictable anyway, perhaps with the exception of FTP data).\hyphpar0\par\pard\sb100\li960\sl220\qj Non-TCP and non-UDP packets are not affected by these fields, and these are used only when filtering TCP or UDP packets.\hyphpar0\par\pard\sb100\li960\sl220\qj Fill out the second set of fields with the parameters of the opposite end of the connection.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Tip: \b0\f4 Any address or mask fields left blank default to 0.0.0.0 while blank \fs16\f3 Port\fs18\f4 fields default to 0. This makes it easy to define filter rules if you're interested only in either the source or destination, but not the other. For example, you may be interested in traffic originating from network 61.9.88.0, in which case you just enter the source address, mask and port in the \fs16\f3 Source\fs18\f4 fields, while leaving the \fs16\f3 Destination\fs18\f4 fields blank.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 The next fields let you specify which IP-type protocols you want matched by this filter rule. Any packet whose protocol's corresponding field is marked with a \fs18\f3 Y\fs20\f1 is matched against the filter's defined IP addresses and ports, otherwise they don't pass through this filter rule.\hyphpar0\par\pard\sb100\li960\sl220\qj If you want to evaluate all IP packets just mark with \fs18\f3 Y\fs20\f1 the \fs18\f3 All IP\fs20\f1 field.\hyphpar0\par\pard\sb100\li960\sl220\qj For example, if you want to see only all TCP traffic, mark the \fs18\f3 TCP\fs20\f1 field with \fs18\f3 Y\fs20\f1 .\hyphpar0\par\pard\sb100\li960\sl220\qj The long field marked \fs18\f3 Additional protocols\fs20\f1 allows you to specify other protocols by their IANA number. (You can view the common IP protocol number in the \fs18\f3 /etc/protocols\fs20\f1 file). You can specify a list of protocol numbers or ranges separated by commas, Ranges have the beginning and ending protocol numbers separated with a hyphen.\hyphpar0\par\pard\sb100\li960\sl220\qj For example, to see the RSVP (46), IP mobile (55), and protocols (101 to 104), you use an entry that looks like this:\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 46, 55, 101-104\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 It's certainly possible to specify any of the protocols listed above in this field. Entering \fs18\f3 1-255\fs20\f1 is functionally identical to marking \fs18\f3 All IP\fs20\f1 with a \fs18\f3 Y\fs20\f1 .\hyphpar0\par\pard\sb100\li960\sl220\qj The next field is marked \fs18\f3 Include/Exclude\fs20\f1 . This field allows you to decide whether to include or filter out matching packets. Setting this field to \fs18\f3 I\fs20\f1 causes the filter to pass matching packets, while setting it to \fs18\f3 E\fs20\f1 causes the filter to drop them. This field is set to \fs18\f3 I\fs20\f1 by default.\hyphpar0\par\pard\sb100\li960\sl220\qj The last field in the dialog is labeled \fs18\f3 Match opposite\fs20\f1 . When set to \fs18\f3 Y\fs20\f1 , the filter will match packets flowing in the opposite direction. Previous versions of IPTraf used to match TCP packets flowing in either direction, so the source and destination address/mask/port combinations were actually interchangeable. Starting with IPTraf 3.0, when filters extended to more than just the IP traffic monitor, this behavior is no longer the default throughout IPTraf except in the IP traffic monitor's TCP window.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 For TCP packets, this field is used in all facilities except the IP traffic monitor. Because the IP traffic monitor must capture TCP packets in both directions to properly determine a closed connection, the filter automatically matches packets in the opposite direction, regardless of this field's setting. However iin all other facilities, automatic matching of the reverse packets is not performed unless you set this field to \fs16\f3 Y\fs18\f4 .\hyphpar0\par\pard\sb100\li1360\sl198\qj Filters for UDP and other IP protocols do not automatically match packets in the opposite direction unless you set the field to \fs16\f3 Y\fs18\f4 , even in the IP traffic monitor.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 Press Enter to accept all parameters when done. The parameters will be accepted and you'll be taken back to the rule selection box. You can then add more rules by pressing A or you can insert new rules at any point by pressing I. Should you make a mistake, you can press Enter to edit the selected filter. You may enter as many sets of parameters as you wish. Press Ctrl+X when done.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 Because of the major changes in the filtering system since IPTraf 2.7, old filters will no longer work and will have to be redefined.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-ipfltdlg.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\fs20\f1 Figure 7-5. The IP filter parameters dialog\hyphpar0\par\pard\sb200\s4\li960\sl242 \fs22\f2 Examples\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 202.47.132.2\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 207.0.115.44\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see all traffic from host 207.0.115.44 to all hosts on network 202.47.132.x\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 207.0.115.44\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 202.47.132.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 All IP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 N\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see all Web traffic (to and from port 80) regardless of source or destination\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 80\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see all IRC traffic from port 6666 to 6669\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 6666\fs20\f1 to \fs18\f3 6669\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see all DNS traffic, (TCP and UDP, destination port 53) regardless of source or destination\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 53\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y UDP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see all mail (SMTP) traffic to a single host (202.47.132.2) from anywhere\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 202.47.132.2\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 25\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 N\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To see traffic from from/to host sunsite.unc.edu to/from cebu.mozcom.com\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 sunsite.unc.edu\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 cebu.mozcom.com\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 All IP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To omit display of traffic to/from 140.66.5.x from/to anywhere\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP Address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 140.66.5.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 All IP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 E\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 You can enter as many parameters as you wish. All of them will be interpreted until the first match is found.\hyphpar0\par\pard\sb200\s4\li960\sl242 \b\fs22\lang1024\f2 Excluding Certain Sites\keepn\hyphpar0\par\pard\sb110\li960\sl220\qj \b0\fs20\lang1033\f1 Filters follow an implicit "no-match" policy, that is, only packets matching defined rules will be matched, others will be filtered out. This is similar to the access-list policy "whatever is not explicitly permitted is denied". If you want to show all traffic to/from everywhere, except certain places, you can specify the sites you wish to exclude, mark them with \fs18\f3 E\fs20\f1 in the \fs18\f3 Include/Exclude field\fs20\f1 , and define a general catch-all entry with source address \fs18\f3 0.0.0.0\fs20\f1 , mask \fs18\f3 0.0.0.0\fs20\f1 , port \fs18\f3 0\fs20\f1 , and destination \fs18\f3 0.0.0.0\fs20\f1 , mask \fs18\f3 0.0.0.0\fs20\f1 , port \fs18\f3 0\fs20\f1 , tagged with an \fs18\f3 I\fs20\f1 in the \fs18\f3 Include/Exclude\fs20\f1 field as the last entry.\hyphpar0\par\pard\sb100\li960\sl220\qj For example:\hyphpar0\par\pard\sb100\li960\sl220\qj To see all traffic except all SMTP (both directions), Web (both directions), and traffic (only) from 207.0.115.44\sa200\par\trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 25\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 E\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 80\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 TCP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 E\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 207.0.115.44\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 255.255.255.255\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 All IP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 E\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 N\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Host name/IP address\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Wildcard mask\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0.0.0.0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Port\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 0\sa60\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Protocols\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 All IP: Y\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Include/Exclude\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 I\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \trowd\trleft960 \clvertalt\cellx3440\clvertalt\cellx5920\clvertalt\cellx8400 \plain \pard\intbl\sb60\li40\ri100\sl220 \fs20\f1 Match opposite\sa60\cell \plain \pard\intbl\sb60\li40\ri100\sl220 \fs18\f3 N\sa60\cell \plain \pard\intbl\sl-120\par\cell \row \pard\plain\sl-1\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\f2 Tip: \b0\f4 To filter out all TCP, define a filter with a single entry, with a source of \fs16\f3 0.0.0.0\fs18\f4 mask \fs16\f3 0.0.0.0\fs18\f4 port \fs16\f3 0\fs18\f4 , and a destination of \fs16\f3 0.0.0.0\fs18\f4 mask \fs16\f3 0.0.0.0\fs18\f4 port \fs16\f3 0\fs18\f4 , with the \fs16\f3 Include/Exclude\fs18\f4 field marked \fs16\f3 E\fs18\f4 (exclude). Then apply this filter.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1902}{\*\bkmkend _1902}\b\fs24\f2 Applying a Filter\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 The above steps only add the filter to a defined list. To actually apply the filter, you must select \i Apply filter...\i0 from the menu. You will be presented with a list of filters you already defined. Select the one you want to apply, and press Enter.\hyphpar0\par\pard\sb100\li960\sl220\qj The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1907}{\*\bkmkend _1907}\b\fs24\lang1024\f2 Editing a Defined Filter\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Select \i Edit filter...\i0 to modify an existing filter. Once you select this option, you will be presented with the list of defined filters. Select the filter you want to edit by moving the selection bar and press Enter.\hyphpar0\par\pard\sb100\li960\sl220\qj Edit the description if you wish. Pressing Ctrl+X at this point will abort the operation, and the filter will remain unmodified. Press Enter to accept any changes to the filter description.\hyphpar0\par\pard\sb100\li960\sl220\qj After pressing Enter, you will see the filter's rules. To edit an existing filter rule, move the selection bar to the desired entry and press Enter. A prefilled dialog box will appear. Edit its contents as desired. Press Enter to accept the changes or Ctrl+X to discard.\hyphpar0\par\pard\sb100\li960\sl220\qj You can add a new filter rule by pressing I to insert at the selection bar's current position. When you press I, you will be presented with a dialog box asking you to enter the new rule data. Pressing A results in a similar operation, except the rule will be appended as the last entry in the rule list.\hyphpar0\par\pard\sb100\li960\sl220\qj Pressing D deletes the currently pointed entry.\hyphpar0\par\pard\sb100\li960\sl220\qj Press X or Ctrl+X to end the edit and save the changes.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 If you're editing the currently applied filter, you will need to re-apply the filter for the changes to take effect.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\f2 Note: \b0\f4 Be aware that the filter processes the rules in order. In other words, if a packet matches more than one rule, only the first matching rule is followed.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1922}{\*\bkmkend _1922}\b\fs24\f2 Deleting a Defined Filter\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Select \i Delete filter...\i0 from the menu to remove a filter from the list. Just move the selection bar to the filter you want to delete, and press Enter.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1926}{\*\bkmkend _1926}\b\fs24\lang1024\f2 Detaching a Filter\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 The \i Detach filter\i0 option deactivates the filter currently in use. Selecting this option causes all TCP traffic to be passed to the monitors.\hyphpar0\par\pard\sb100\li960\sl220\qj When you're done with the menu, just select the Exit menu option.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_NONIPFILTERS}{\*\bkmkend ID_NONIPFILTERS}\b\fs26\lang1024\f2 ARP, RARP, and other Non-IP Packet Filters\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The \i Non-IP\i0 filter option toggles the display and logging of all non-IP packets, except ARP and RARP, which are toggled separately.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 8. Configuring IPTraf}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 8. Configuring IPTraf}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_CONFIG}{\*\bkmkend ID_CONFIG}\b\fs29\f2 Chapter 8. Configuring IPTraf\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf can be easily configured with the {\field{\*\fldinst HYPERLINK \\l ID_CONFIG}{\fldrslt \i Configure...}} item in the main menu. The configuration is stored in the \fs18\f3 /var/local/iptraf/iptraf.cfg\fs20\f1 file. If the file is not found, IPTraf uses the default settings. Any changes to the configuration immediately get stored in the configuration file.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-configmenu.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 8-1. The IPTraf configuration menu\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_TOGGLES}{\*\bkmkend ID_TOGGLES}\fs26\f2 Toggles\keepn\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1946}{\*\bkmkend _1946}\fs24 Reverse DNS Lookups\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Activating reverse lookup causes IPTraf to find out the name of the hosts with the addresses in the IP packets. When this option is enabled, IPTraf's IP traffic monitor starts the rvnamed DNS lookup server to help resolve IP addresses in the background while allowing IPTraf to continue capturing packets.\hyphpar0\par\pard\sb100\li960\sl220\qj This option is off by default.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1950}{\*\bkmkend _1950}\b\fs24\lang1024\f2 TCP/UDP Service Names\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 This option, when on, causes IPTraf to display the TCP/UDP service names (\fs18\f3 smtp\fs20\f1 , \fs18\f3 www\fs20\f1 , \fs18\f3 pop3\fs20\f1 , etc.) instead of their numeric ports (25, 80, 110, etc). The number-to-name mappings will depend on the systems services database file (usually \fs18\f3 /etc/services\fs20\f1 ). Should there be no corresponding service name for the port number, the numeric form will still be displayed. \hyphpar0\par\pard\sb100\li960\sl220\qj This setting is off by default.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 Reverse lookup and service name lookup take some time and may impact performance and increase the chances of dropped packets. Performance and results are best (albeit more cryptic) with both these settings off.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1961}{\*\bkmkend _1961}\b\fs24\f2 Force promiscuous\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 If this option is enabled, your LAN interfaces will capture all packets on your LAN. Using this option enables you to see all TCP connections and packets passing your LAN segment, even if they're not from or for your machine. When this option is active in the statistics windows, the Activity indicators will show a good estimate of the load on your LAN segment.\hyphpar0\par\pard\sb100\li960\sl220\qj When this option is disabled, you'll only receive information about packets coming from and entering your machine.\hyphpar0\par\pard\sb100\li960\sl220\qj The setting of this option affects all LAN ( Ethernet, FDDI, some Token Ring) interfaces on your machine, if you have more than one.\hyphpar0\par\pard\sb100\li960\sl220\qj The interface's promiscuous flag is set only when a facility is started, and turned off when it exits. However, if promiscuous mode was already set when a facility was started, it remains set on exit.\hyphpar0\par\pard\sb100\li960\sl220\qj If multiple instances of IPTraf are started, the promiscuous setting is restored only upon exit of the last facility.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 Do not use other programs that change the interface's promiscuous flag at the same time you're using IPTraf. The programs can interfere with each other's expected operations. While IPTraf tries to obtain the initial setting of any promiscuous flags for restoration upon exit, other programs may not be as well-behaved, and they may turn off the promiscuous flags while IPTraf is still monitoring.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1971}{\*\bkmkend _1971}\b\fs24\f2 Color\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Turn this on with color monitors. Turn it off with black-and- white monitors or non-color terminals (like xterms). Changes to this setting will take effect the next time the program is started.\hyphpar0\par\pard\sb100\li960\sl220\qj Color is on by default on consoles and color xterms, off on non-color terminals like xterms and VT100s.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _1975}{\*\bkmkend _1975}\b\fs24\lang1024\f2 Logging\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 When this option is active, IPTraf will log information to a disk file, which can be examined or analyzed later. Since IPTraf 2.4.0, IPTraf prompts you for the name of the file to which to write the logs. It will provide a default name, which you are free to accept or change. The IP traffic monitor and LAN station monitor will generate a log file name that is based on what instance they are (first, second, and so on). The general interface statistics' default log file name is constant, because it listens to all interfaces at once, and only one instance can run at one time.\hyphpar0\par\pard\sb100\li960\sl220\qj The other facilities generate a log file name based on the interface they're listening on.\hyphpar0\par\pard\sb100\li960\sl220\qj See the descriptions on the facilities above for the default log file names.\hyphpar0\par\pard\sb100\li960\sl220\qj Press Enter to accept the log file name, or Ctrl+X to cancel. Canceling will turn logging off for that session.\hyphpar0\par\pard\sb100\li960\sl220\qj The IP traffic monitor will write the following pieces of information to its log file:\hyphpar0\par\pard\sb100\li1160\sl220\fi-200\qj \tx1160 \fs16\lang1024 \'95\tab \fs20 Start of the traffic monitor\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Receipt of the first TCP packet for a connection. If that packet is a SYN, (SYN) will be indicated in the log entry. (Of course, the traffic monitor may start in the middle of established connections. It will still count those packets. This also explains why some connection entries may become idle if the traffic monitor is started in the middle of a half-closed connection, and miss the first FIN. Such entries time out in a while.)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Receipt of a FIN (with average flow rate)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 ACK of a FIN\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Timeouts of TCP entries (with average flow rate)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Reset connections (with average flow rate)\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Everything that appears in the bottom window of the traffic monitor\hyphpar0\par\pard\li1160\sl220\fi-200\qj \tx1160 \fs16 \'95\tab \fs20 Stopping of the traffic monitor\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 Each log entry includes the date and time the entry was written. Logging is also affected by the defined filters.\hyphpar0\par\pard\sb100\li960\sl220\qj Log files can grow very fast, so be prepared with plenty of free space and delete unneeded logs. Log write errors are not indicated.\hyphpar0\par\pard\sb100\li960\sl220\qj Copies of the interface statistics, TCP/UDP statistics, packet size statistics, and LAN host statistics are also written to the log files at regular intervals. See \i Log Interval...\i0 in this chapter.\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf closes and reopens the active log file when it receives a \fs18\f3 USR1\fs20\f1 signal. This is useful in cases where a facility is run for long periods of time but the log files have to be cleared or moved.\hyphpar0\par\pard\sb100\li960\sl220\qj To clear or move an active log file, rename it first. IPTraf will continue to write to the file despite the new name. Then use the UNIX kill command to send the running IPTraf process a \fs18\f3 USR1\fs20\f1 signal. IPTraf will then close the log file and open another with the original name. You can then safely remove or delete the renamed file.\hyphpar0\par\pard\sb100\li960\sl220\qj Do not delete an open log file. Doing so will only result in a file just as large but filled with null characters (ASCII code 0).\hyphpar0\par\pard\sb100\li960\sl220\qj Logging comes disabled by default. The \fs18\f3 USR1\fs20\f1 signal is caught only if logging is enabled, it is ignored otherwise.\hyphpar0\par\pard\sb100\li960\sl220\qj A valid specification of \fs18\f3 -L\fs20\f1 on the command line with automatically enable logging for that particular session. The saved configuration setting is not affected.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2012}{\*\bkmkend _2012}\b\fs24\lang1024\f2 Activity mode\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Toggles activity indicators in the interface and LAN statistics facilities between kilobits per second (kbits/s) or kilobytes per second (kbytes/s).\hyphpar0\par\pard\sb100\li960\sl220\qj The default setting is kilobits per second.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2016}{\*\bkmkend _2016}\b\fs24\lang1024\f2 Source MAC addrs in traffic monitor\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 When enabled, the IP traffic monitor retrieves the packets' source MAC addresses if they came in on an Ethernet, FDDI, or PLIP interface. The addresses appear in the lower window for non-TCP packets, while for TCP connections, they can be viewed by pressing M.\hyphpar0\par\pard\sb100\li960\sl220\qj No such information is displayed if the network interface doesn't use MAC addresses (such as PPP interfaces).\hyphpar0\par\pard\sb100\li960\sl220\qj This can be used to determine the actual source of the packets on your local LAN.\hyphpar0\par\pard\sb100\li960\sl220\qj The traffic monitor also logs the MAC addresses with this option enabled. The default setting is off.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_TIMERS}{\*\bkmkend ID_TIMERS}\b\fs26\lang1024\f2 Timers\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The \i Timers...\i0 submenu allows you to IPTraf's interval and timeout functions.\hyphpar0\par\pard\sb200\li960{\field\flddirty{\*\fldinst INCLUDEPICTURE "iptraf-timermenu.eps" }{\fldrslt }}\keepn\par\pard\sb200\li960\sl220\qj \b\lang1024 Figure 8-2. The Timers configuration submenu\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2029}{\*\bkmkend _2029}\fs24\f2 TCP Timeout\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 This figure determines the amount of time (in minutes) a connection entry may remain idle before it becomes eligible for replacement by a new connection. The default is 15 minutes. You may want to reduce this on an isolated (not connected to the Internet) LAN or a LAN connected to the Internet with high-speed links. Just enter the new value and press Enter. You can press Ctrl+X to leave the current value unchanged.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2032}{\*\bkmkend _2032}\b\fs24\lang1024\f2 Log Interval\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 This figure determines the number of minutes between logging of interface statistics, TCP/UDP figures, and LAN host statistics. The default is 60 minutes. This figure is meaningless if logging is disabled.\hyphpar0\par\pard\sb100\li960\sl220\qj This configuration item can be overridden with the \fs18\f3 -I\fs20\f1 when a facility is directly invoked from the command line (not accessed via the main menu), and remains effective for that particular session. The configured value is not affected.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2037}{\*\bkmkend _2037}\b\fs24\lang1024\f2 Screen Update Interval\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 This value determines the rate in seconds at which the screen is updated. The default is 0, which means the screen is updated as fast as possible, giving close-to-realtime reflection of network activity. However, this high-speed update can cause incredible amounts of traffic if IPTraf is run on a remote terminal (e.g. a Telnet or Secure Shell session). You can set this to a higher value, such as 1 or 2 seconds to slow down the updates.\hyphpar0\par\pard\sb100\li960\sl220\qj This figure does not affect the rate of data capture. Only the screen refresh is affected. The figures are still updated as fast as possible, although the figure display will no longer be as close to realtime.\hyphpar0\par\pard\sb100\li960\sl220\qj The default setting is 0, which shouldn't be a problem on the console. Set it to a slightly higher value on remote terminals or slow links. The setting affects all monitoring facilities.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 Updating the screen is one of the slowest operations in a program. Older versions of IPTraf had a problem once network activity became very high. Because each packet caused a screen update, IPTraf began spending more time with the screen updates, causing a loss of packets once network activity reached a certain point.\hyphpar0\par\pard\sb100\li1360\sl198\qj However, since many users like rapid counts on their screen, a compromise was incorporated. Even when the screen update interval is set to 0, there is still a 50ms delay between screen updates (except the LAN station monitor, which has a 100 ms delay). This is still visually fast, but provides more time to the packet capture routine. Higher delays may result in better accuracy of counts and activity.\hyphpar0\par\pard\sb100\li1360\sl198\qj In any case, this setting only affects screen updates. Capture still proceeds as fast as possible.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2047}{\*\bkmkend _2047}\b\fs24\f2 TCP closed/idle persistence\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 This parameter determines the interval (in minutes) at which the IP Traffic Monitor clears from the TCP display window all closed, idle, and timed out entries. Enter \fs18\f3 0\fs20\f1 to keep such entries on the screen indefinitely, disappearing only when replaced by new connections.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 The \i TCP timeout...\i0 option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains onscreen. The \i TCP closed/idle persistence...\i0 parameter flushes entries that have been closed or reset, or idle for the number of minutes defined by the \i TCP timeout...\i0 option.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_CUSTOMPORTS}{\*\bkmkend ID_CUSTOMPORTS}\b\fs26\f2 Custom Information\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The remaining configuration items allow you to enter information which IPTraf uses for its displays and logs.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2060}{\*\bkmkend _2060}\b\fs24\lang1024\f2 Additional ports\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Select this item to enter a port number to be included in the TCP/UDP counts in the TCP/UDP service statistics main menu item described above. By default, port numbers above 1023 are not monitored. If you do have a higher-numbered port to monitor, enter it here.\hyphpar0\par\pard\sb100\li960\sl220\qj You will see two fields. If you have only one port to enter, just fill up the first field. To specify a range, fill both fields, the first port in the first field, the last port in the second field.\hyphpar0\par\pard\sb100\li960\sl220\qj You can select this option multiple times to add more values or ranges.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2065}{\*\bkmkend _2065}\b\fs24\lang1024\f2 Delete port/range\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 Select this item to remove a higher-numbered port number or port range you entered earlier with the \i Additional ports...\i0 option. A window will come up containing the entered ports and ranges. Select the entry you want delete and press Enter.\hyphpar0\par\pard\sb200\s3\sl266 {\*\bkmkstart _2069}{\*\bkmkend _2069}\b\fs24\lang1024\f2 LAN Station Identifiers\keepn\hyphpar0\par\pard\sb121\li960\sl220\qj \b0\fs20\lang1033\f1 The LAN station statistics facility monitors stations based on their respective MAC addresses. The hexadecimal notation of these addresses make them even more difficult to remember than the dotted-decimal IP addresses, so these facilities were added to help you better determine which station is which.\hyphpar0\par\pard\sb100\li960\sl220\qj Selecting the \i Ethernet/PLIP host descriptions...\i0 or \i FDDI/Token Ring host descriptions...\i0 options brings up a submenu asking you to add, edit, or delete descriptions.\hyphpar0\par\pard\sb100\li960\sl220\qj To add a new description, select the \i Add description...\i0 option. A dialog box will appear, asking you for the MAC address and an appropriate description. Type in the address in hexadecimal notation with no punctuation of any kind. The dialog box is case-insensitive for the address; the alphabetical digits A to F will be stored in lowercase.\hyphpar0\par\pard\sb100\li960\sl220\qj Use the Tab key to move between fields and Enter to accept. Press Ctrl+X to discard this dialog and return to the main menu.\hyphpar0\par\pard\sb100\li960\sl220\qj The description may be anything: the IP address, a fully-qualified domain name, or a description of your liking as long as the field can hold.\hyphpar0\par\pard\sb100\li960\sl220\qj Enter as many descriptions as you need. Press Ctrl+X at a blank dialog after you have entered the last entry\hyphpar0\par\pard\sb100\li960\sl220\qj These descriptions will be displayed alongside the MAC addresses in the LAN station monitor, together with the type of frame (Ethernet, PLIP, or FDDI).\hyphpar0\par\pard\sb100\li960\sl220\qj An existing address or description may be edited by selecting the \i Edit description...\i0 option from the submenu. A panel will appear with a list of existing address descriptions. Select the one you wish to edit and press Enter. A dialog box identical to that when you add a description will appear with prefilled fields. Just backspace over and edit the fields. Press Enter to accept or Ctrl+X to cancel.\hyphpar0\par\pard\sb100\li960\sl220\qj Selecting the \i Delete description...\i0 submenu item brings up the selection panel. Select the description you want to delete and press Enter. You can also press Ctrl+X to cancel the operation.\hyphpar0\par\pard\sb100\li960\sl220\qj IPTraf 2.4 and later also recognizes the \fs18\f3 /etc/ethers\fs20\f1 file. Should a hardware address be present in the IPTraf definition files and in \fs18\f3 /etc/ethers\fs20\f1 , the IPTraf definition will be used.\hyphpar0\par\pard\sb200\li1360\sl198\qj \b\fs18\lang1024\f2 Note: \b0\f4 The description file for Ethernet and PLIP is \fs16\f3 ethernet.desc\fs18\f4 , while the FDDI and Token Ring mappings are stored in \fs16\f3 fddi.desc\fs18\f4 in the IPTraf working directory. These files are in colon-delimited text format. Database engines or custom scripts can be told to append data lines to those files. Each line follows this simple format:\hyphpar0\par\pard\sb200\li1360\sl178\qj \i\fs16\f3 address\i0 :\i description\hyphpar0\par\pard\sb200\li1360\sl198\qj \i0\fs18\f4 For example\hyphpar0\par\pard\sb200\li1360\sl178\qj \fs16\f3 00201e457e:Cisco 3640 gateway\hyphpar0\par\pard\sb200\li1360\sl198\qj \fs18\f4 Do not put colons, periods, or any invalid characters in the MAC address.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Chapter 9. Background Operation}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Chapter 9. Background Operation}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_BACKOP}{\*\bkmkend ID_BACKOP}\b\fs29\f2 Chapter 9. Background Operation\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf's facilities can be placed in the background solely for logging. When running in the background, it doesn't display any output on the screen, and doesn't receive input from the keyboard, and drops you back to the shell.\hyphpar0\par\pard\sb100\li960\sl220\qj Before starting a statistical facility in the background, configure IPTraf in the usual way (set filters, add TCP/UDP ports, etc).\hyphpar0\par\pard\sb100\li960\sl220\qj Once that's done, exit all instances of IPTraf on the system, then invoke IPTraf from the command line with the parameter to start the facility you want, the timeout (\fs18\f3 -t\fs20\f1 ) parameter if you wish, and the \fs18\f3 -B\fs20\f1 parameter to actually daemonize the program. For example, to run the IP traffic monitor in the background for all interfaces, issue the command\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf -i all -B\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 To run the detailed interface statistics on interface \fs18\f3 eth0\fs20\f1 for 5 minutes in the background:\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 iptraf -d eth0 -t 5 -B\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 If the timeout parameter is not specified, the facility will run until the process receives a USR2 signal. To stop a facility in the background, do a\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 ps x\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 at the command line, and find the process id (pid) of the iptraf process you're looking for. Then send that process a USR2 signal with the kill command:\hyphpar0\par\pard\sb200\li960\sl198\qj \fs18\lang1024\f3 kill -USR2 pid\hyphpar0\par\pard\sb200\li960\sl220\qj \fs20\lang1033\f1 Since IPTraf cannot send error messages to the terminal, all messages are written to the file daemon.log in the IPTraf logging directory.\hyphpar0\par\pard\sb100\li960\sl220\qj The \fs18\f3 -B\fs20\f1 parameter automatically enables logging regardless of its configured setting. The parameter is ignored if not used with one of the parameters to start a facility from the command line.\hyphpar0\par\pard\sb100\li960\sl220\qj The log file can be specified with the \fs18\f3 -L\fs20\f1 command-line parameter. If this parameter is not specified, the default log file name for the facility will be used (see the descriptions of the facilities above for the default log name patterns). If you don't specify an path, the log file will be placed in \fs18\f3 /var/log/iptraf\fs20\f1 .\hyphpar0\par\pard\sb100\li960\sl220\qj The logging interval for all facilities (except the IP traffic monitor) can also be overriden with the \fs18\f3 -I\fs20\f1 command-line parameter.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Appendix A. Messages}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Appendix A. Messages}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_MESSAGES}{\*\bkmkend ID_MESSAGES}\b\fs29\f2 Appendix A. Messages\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 IPTraf's messages are presented in two ways. In interactive mode, messages are displayed in a distictive message box. In daemon (background) mode, appropriate messages are written to the \fs18\f3 iptraf.log\fs20\f1 file in the IPTraf log directory (normally \fs18\f3 /var/log/iptraf\fs20\f1 .\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_IPTRAFMESSAGES}{\*\bkmkend ID_IPTRAFMESSAGES}\b\fs26\lang1024\f2 IPTraf Messages\keepn\hyphpar0\par\pard\sb200\li960\sl220\qj \b0\fs18\lang1033\f3 Unable to create config file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot create the configuration file. The most likely cause of this is that you didn't properly install the program, and the necessary directory \fs18\f3 /var/local/iptraf\fs20\f1 does not exist. Can also be generated if you have a disk problem or if you have too many files open.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to read config file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The configuration record cannot be read. You most likely have a disk problem.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to write config file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The configuration file cannot be written. You either have a disk problem, or (more likely), your disk is full.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Enter an appropriate description for this filter\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 Enter something to clearly describe the filter you are defining. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error loading filter list file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot access the list of defined TCP or UDP filters. Can also be an indicator of a bad disk.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error writing filter list file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The filter list file cannot be written to. You may have trouble accessing your filters. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to read TCP/UDP/misc IP filter file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot read the filter data off the file. Could be caused by a bad disk. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error opening filter data file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot open the filter file. Could be caused by a shortage of file descriptors or a bad disk.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to write filter data\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot add the newly defined filter to the filter list. This may be due to a bad disk.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Cannot create filter data file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot create the filter record file. The defined filter is lost.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to save filter changes\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot save the changes you made to the filter. You probably have a disk error.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to write filter state information\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The current state of the filters cannot be saved. IPTraf will be unable to correctly reload the filters the next time it's started. This can be caused by a bad disk or improper installation.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to save interface flags\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to save the flags of the network interfaces. This is probably due to a bad installation or full filesystem.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to retrieve saved interface flags\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to retrieve the save interface flags. Probably again due to a bad installation or full filesystem.\hyphpar0\par\pard\sb200\li960\sl220\qj \i\fs18\lang1033\f3 protocol\i0 filter data file in use; try again later\hyphpar0\par\pard\sb100\li960\sl220\qj Filter state file in use; try again later\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 Another IPTraf process is modifying the TCP, UDP or miscellaneous IP filter data or the filter state file and has locked the files or file. Try again once the other IPTraf process has terminated or completed its modifications and unlocked the files.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to resolve hostname\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The indicated host name in the filter cannot be resolved into an IP address. Check the local hosts database \fs18\f3 /etc/hosts\fs20\f1 or your machine's DNS configuration or DNS server. The filter parameters will not be used.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to open host description file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot open the file containing the descriptions for Ethernet or FDDI addresses. Could be due to a bad disk or a hit on the file descriptor limit. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to write host description\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to write the description record for this Ethernet or FDDI address. Could be due to a bad disk or corrupted filesystem. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 No descriptions \hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 You tried to edit or delete a description with no previous descriptions defined. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Cannot open log file\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 There is a problem opening the log file. There is most likely a problem with the disk, or there are too many open files. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to obtain interface list\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to retrieve the list of network interfaces from the \fs18\f3 /proc\fs20\f1 filesystem. This may be due to a badly configured kernel. IPTraf needs \fs18\f3 /proc\fs20\f1 filesystem support. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 No active interfaces. Check their status or the /proc filesystem.\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf found no active interfaces. Either all interfaces are down or the \fs18\f3 /proc/net/dev\fs20\f1 file was empty or unavailable. Activate at least one interface or check the \fs18\f3 /proc/net/dev\fs20\f1 file. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to obtain interface parameters for interface\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The system call to retrieve the interface's flags failed. Check your interface or kernel driver. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Promisc change failed for interface\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The system call to change the promiscuous flag failed. Check your interface or its kernel driver. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to open raw socket for flag change\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to open the necessary socket for the promiscuous change operation. May be due to a shortage of file descriptors. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to open socket for MTU determination\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 Returned by the facility for detailed interface statistics if the raw socket's opening sequence failed. The facility will abort.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to open raw socket\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to open the raw socket for packet capture. May be due to a shortage of file descriptors.\hyphpar0\par\pard\sb200\li1760\sl198\qj \b\fs18\f2 Reminder: \b0\f4 IPTraf 2.x.x requires Linux kernel 2.2.x, with the Packet Socket option compiled in or installed as a module. IPTraf 2.x will return this error on a pre-2.2 kernel or on a 2.2 kernel without Packet Socket.\hyphpar0\par\pard\sb200\li960\sl220\qj \lang1033\f3 Unable to obtain interface MTU\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The detailed statistics facility was unable to obtain the maximum transmission unit (MTU) for the selected interface. The facility will abort. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Specified interface not supported\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The interface specified with the \fs18\f3 -i\fs20\f1 , \fs18\f3 -d\fs20\f1 , \fs18\f3 -s\fs20\f1 , \fs18\f3 -l\fs20\f1 , or \fs18\f3 -z\fs20\f1 command-line parameters is not supported by IPTraf.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Specified interface not active\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The interface specified with the \fs18\f3 -i\fs20\f1 , \fs18\f3 -d\fs20\f1 , \fs18\f3 -s\fs20\f1 , \fs18\f3 -l\fs20\f1 , or \fs18\f3 -z\fs20\f1 command-line parameters is supported, but not currently activated. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Fatal: memory allocation error\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 May occur if you have too little memory to allocate for windows, the menu system, or dialog boxes. IPTraf tries to prevent further allocations if memory runs out during a monitor. However, this could also mean a bug if you're reasonably sure you're not out of memory. An instructional message on bug reporting follows this message.\hyphpar0\par\pard\sb200\li1760\sl198\qj \b\fs18\f2 Technical note: \b0\f4 This is actually a response to the segmentation fault error (SIGSEGV).\hyphpar0\par\pard\sb200\li960\sl220\qj \lang1033\f3 This program can be run only by the system administrator\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf normally does not allow anybody but uid 0 (root) to run it. This measure is included for safety reasons. See the section on recompiling the program below if you want to override this. This feature is built in, and not part of the configuration \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Your TERM variable is not set\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The TERM (terminal type) environment variable must be set to a valid terminal type so that the screen management routines can function properly. Set it to the appropriate terminal type. Linux consoles typically have their TERM variables set to \fs18\f3 linux\fs20\f1 . \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Received TERM signal\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 Not related to the previous message. The \fs18\f3 TERM\fs20\f1 (terminate) signal is normally used to gracefully shut down a program. This message simply indicates that the \fs18\f3 TERM\fs20\f1 signal was caught and IPTraf is attempting to shut down as gracefully as possible.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Invalid option or missing parameter, use iptraf -h for help\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The \fs18\f3 -i\fs20\f1 , \fs18\f3 -d\fs20\f1 , \fs18\f3 -s\fs20\f1 , \fs18\f3 -l\fs20\f1 , or \fs18\f3 -z\fs20\f1 options were specified but no interface was specified on the command line. These parameters require a valid interface name (or \fs18\f3 all\fs20\f1 for \fs18\f3 -i\fs20\f1 or \fs18\f3 -l\fs20\f1 ). This message also appears if an unknown option is passed to the \b iptraf\b0 command. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Warning: unable to tag this process\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf normally tags itself when it runs to prevent multiple instances of the statistical facilities from running. This message means the program was unable to create the necessary tag file. This may be due to a bad or improper installation. Try running the \b make install\b0 procedure or the \b Setup\b0 in the distribution's top-level directory. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Warning: unable to tag facility\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to create the tag file for the facility you started. The facility will still run, but other instances of IPTraf that may be running simultaneously will allow the same facility to run. This may cause both instances of the facility to malfunction. This could be due to a bad disk or bad installation. \hyphpar0\par\pard\sb200\li960\sl220\qj \i\fs18\lang1033\f3 facility\i0 already running/listening on interface\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 The facility you tried to start is currently running on the indicated interface in another IPTraf process on the machine. This restriction is placed to prevent conflicts involving internal sockets or the log files. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 General interface statistics already active in another process\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 Only one instance of the general interface statistics can run at a time. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Duplicate port/range entry \hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 You entered a port number or range that was already added to the list of additional ports to be monitored by the TCP/UDP service monitor \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 No custom ports\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 There are no ports or port ranges earlier added. There's nothing to delete. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Can't start rvnamed; lookups will block\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot start the \b rvnamed\b0 daemon; probably due to a bad installation. IPTraf will fall back to blocking lookups. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Can't spawn new process; lookups will block\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot start a new process. This may be due to memory shortage. IPTraf will fall back to blocking lookups. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Fork error, IPTraf cannot run in background\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf cannot start a new process, and can go into the background. This may be due to memory shortage. IPTraf aborts. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 No memory for new filter entry\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 IPTraf was unable to allocate memory for a new filter entry. Most likely due to memory shortage. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Memory Low\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 This indicator appears if memory runs low due to a lot of entries in a facility. Should critical functions fail (window creation, internal allocation), the program could terminate with a segmentation violation.\hyphpar0\par\pard\sb200\li1760\sl198\qj \b\fs18\f2 Note: \b0\f4 Any message or indicator about low memory means that your system does not have enough memory to handle the entries. It is almost certain that sooner or later, IPTraf or other applications will abort due to the failure of important system calls or library functions. Memory must be added right away.\hyphpar0\par\pard\sb200\li960\sl220\qj \lang1033\f3 IPC Error\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 This indicator appears if an error occurs receiving data from the \b rvnamed\b0 program (IPC stands for Interprocess Communication). This indication should not occur under normal circumstances. Report instances of this condition and the circumstances under which it happens. You may also include data from the \fs18\f3 rvnamed.log\fs20\f1 file. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error opening terminal: \i terminal\hyphpar0\par\pard\sb100\li1360\sl220\qj \i0\fs20\lang1024\f1 The screen management routines cannot find the \fs18\f3 terminfo\fs20\f1 entry for your terminal. IPTraf expects the terminfo database located in \fs18\f3 /usr/share/terminfo\fs20\f1 . This error could occur when your terminfo database is located somewhere else. See the section on controlling the \fs18\f3 terminfo\fs20\f1 search path.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 This will end your IPTraf session \hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 In interactive mode IPTraf asks you to confirm your exit command. Press Enter to return to the shell or any other key to cancel your command and return to the main menu.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_RVNAMEDMESSAGES}{\*\bkmkend ID_RVNAMEDMESSAGES}\b\fs26\f2 rvnamed Messages\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 As a daemon, rvnamed does not send messages to the screen. It writes its messages to the file \fs18\f3 rvnamed.log\fs20\f1 in the IPTraf log directory.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\f3 Unable to open child communication socket\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed was unable to open the communication endpoint for data reception from the children it creates. This is highly unusual, and should it occur, report the circumstances.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Unable to open client communication socket\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed was unable to open the communication endpoint for data exchange with the IPTraf program. This is highly unusual, and should it occur, report the circumstances.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error binding client communication socket Error binding child communication socket\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed was unable to assign a name to the indicated communication socket. This may be due to a bad, full, or corrupted filesystem. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Fatal error: no memory for descriptor monitoring\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed ran out of memory. IPTraf will resort to blocking, and may freeze. \hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Error on fork, returning IP address\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed had a problem spawning a copy of itself to resolve the IP address. rvnamed will simply return the IP address in its literal, dotted-decimal notation. IPTraf will still function normally. This may be due to lack of memory or a process limit hit.\hyphpar0\par\pard\sb200\li960\sl220\qj \fs18\lang1033\f3 Maximum child process limit reached\hyphpar0\par\pard\sb100\li1360\sl220\qj \fs20\lang1024\f1 rvnamed has reached its maximum number of child processes. This is intended as a "brake" to prevent too many rvnamed children from hogging your computer's resources and possibly crashing it. Unless IPTraf is monitoring an extremely busy network without filters, this shouldn't happen, at least, not that often. If you notice this message, try applying filters or check your DNS server. Many times, this can happen when the DNS server goes down for whatever reason, and you have rvnamed children taking too long to resolve.\hyphpar0\par\sect\sectd\plain\pgwsxn12240\pghsxn15840\marglsxn1920\margrsxn1920\margtsxn960\margbsxn480\headery0\footery0\pgndec\titlepg{\headerf\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {}\par}{\footerf\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}{\headerl\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 Appendix B. GNU Free Documentation License}\tab {}\tab {}\par}{\footerl\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {\i\fs20\f1 \chpgn }\tab {}\tab {}\par}{\headerr\pard\sl-240\sb770\sa-50\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 Appendix B. GNU Free Documentation License}\par}{\footerr\pard\sl-240\sb-670\sa910\plain\tqc\tx4200\tqr\tx8400 {}\tab {}\tab {\i\fs20\f1 \chpgn }\par}\pard\sb220\s1\sl322 {\*\bkmkstart ID_GFDL}{\*\bkmkend ID_GFDL}\b\fs29\f2 Appendix B. GNU Free Documentation License\keepn\hyphpar0\par\pard\sb146\li960\sl220\qj \b0\fs20\lang1033\f1 Version 1.1, March 2000\hyphpar0\par\pard\sb100\li1160\ri200\sl198\qj \fs18 Copyright (C) 2000 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_0}{\*\bkmkend ID_GFDL_45_0}\b\fs26\lang1024\f2 PREAMBLE\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The purpose of this License is to make a manual, textbook, or other written document "free" in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others.\hyphpar0\par\pard\sb100\li960\sl220\qj This License is a kind of "copyleft", which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software.\hyphpar0\par\pard\sb100\li960\sl220\qj We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_1}{\*\bkmkend ID_GFDL_45_1}\b\fs26\lang1024\f2 APPLICABILITY AND DEFINITIONS\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 This License applies to any manual or other work that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. The "Document", below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as "you".\hyphpar0\par\pard\sb100\li960\sl220\qj A "Modified Version" of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language.\hyphpar0\par\pard\sb100\li960\sl220\qj A "Secondary Section" is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document's overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (For example, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them.\hyphpar0\par\pard\sb100\li960\sl220\qj The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License.\hyphpar0\par\pard\sb100\li960\sl220\qj The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License.\hyphpar0\par\pard\sb100\li960\sl220\qj A "Transparent" copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, whose contents can be viewed and edited directly and straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup has been designed to thwart or discourage subsequent modification by readers is not Transparent. A copy that is not "Transparent" is called "Opaque".\hyphpar0\par\pard\sb100\li960\sl220\qj Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML designed for human modification. Opaque formats include PostScript, PDF, proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML produced by some word processors for output purposes only.\hyphpar0\par\pard\sb100\li960\sl220\qj The "Title Page" means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, "Title Page" means the text near the most prominent appearance of the work's title, preceding the beginning of the body of the text.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_2}{\*\bkmkend ID_GFDL_45_2}\b\fs26\lang1024\f2 VERBATIM COPYING\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3.\hyphpar0\par\pard\sb100\li960\sl220\qj You may also lend copies, under the same conditions stated above, and you may publicly display copies.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_3}{\*\bkmkend ID_GFDL_45_3}\b\fs26\lang1024\f2 COPYING IN QUANTITY\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 If you publish printed copies of the Document numbering more than 100, and the Document's license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects.\hyphpar0\par\pard\sb100\li960\sl220\qj If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages.\hyphpar0\par\pard\sb100\li960\sl220\qj If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a publicly-accessible computer-network location containing a complete Transparent copy of the Document, free of added material, which the general network-using public has access to download anonymously at no charge using public-standard network protocols. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public.\hyphpar0\par\pard\sb100\li960\sl220\qj It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_4}{\*\bkmkend ID_GFDL_45_4}\b\fs26\lang1024\f2 MODIFICATIONS\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version:\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab \lang1024 A.\tab Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab B.\tab List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has less than five).\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab C.\tab State on the Title page the name of the publisher of the Modified Version, as the publisher.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab D.\tab Preserve all the copyright notices of the Document.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab E.\tab Add an appropriate copyright notice for your modifications adjacent to the other copyright notices.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab F.\tab Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab G.\tab Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document's license notice.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab H.\tab Include an unaltered copy of this License.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab I.\tab Preserve the section entitled "History", and its title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section entitled "History" in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab J.\tab Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the "History" section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab K.\tab In any section entitled "Acknowledgements" or "Dedications", preserve the section's title, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab L.\tab Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab M.\tab Delete any section entitled "Endorsements". Such a section may not be included in the Modified Version.\hyphpar0\par\pard\sb100\li1440\sl220\fi-480\qj \tqr\tx1390\tx1440\tab N.\tab Do not retitle any existing section as "Endorsements" or to conflict in title with any Invariant Section.\hyphpar0\par\pard\sb100\li960\sl220\qj \lang1033 If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version's license notice. These titles must be distinct from any other section titles.\hyphpar0\par\pard\sb100\li960\sl220\qj You may add a section entitled "Endorsements", provided it contains nothing but endorsements of your Modified Version by various parties--for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard.\hyphpar0\par\pard\sb100\li960\sl220\qj You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one.\hyphpar0\par\pard\sb100\li960\sl220\qj The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_5}{\*\bkmkend ID_GFDL_45_5}\b\fs26\lang1024\f2 COMBINING DOCUMENTS\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice.\hyphpar0\par\pard\sb100\li960\sl220\qj The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work.\hyphpar0\par\pard\sb100\li960\sl220\qj In the combination, you must combine any sections entitled "History" in the various original documents, forming one section entitled "History"; likewise combine any sections entitled "Acknowledgements", and any sections entitled "Dedications". You must delete all sections entitled "Endorsements."\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_6}{\*\bkmkend ID_GFDL_45_6}\b\fs26\lang1024\f2 COLLECTIONS OF DOCUMENTS\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects.\hyphpar0\par\pard\sb100\li960\sl220\qj You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_7}{\*\bkmkend ID_GFDL_45_7}\b\fs26\lang1024\f2 AGGREGATION WITH INDEPENDENT WORKS\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, does not as a whole count as a Modified Version of the Document, provided no compilation copyright is claimed for the compilation. Such a compilation is called an "aggregate", and this License does not apply to the other self-contained works thus compiled with the Document, on account of their being thus compiled, if they are not themselves derivative works of the Document.\hyphpar0\par\pard\sb100\li960\sl220\qj If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one quarter of the entire aggregate, the Document's Cover Texts may be placed on covers that surround only the Document within the aggregate. Otherwise they must appear on covers around the whole aggregate.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_8}{\*\bkmkend ID_GFDL_45_8}\b\fs26\lang1024\f2 TRANSLATION\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License provided that you also include the original English version of this License. In case of a disagreement between the translation and the original English version of this License, the original English version will prevail.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_9}{\*\bkmkend ID_GFDL_45_9}\b\fs26\lang1024\f2 TERMINATION\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 You may not copy, modify, sublicense, or distribute the Document except as expressly provided for under this License. Any other attempt to copy, modify, sublicense or distribute the Document is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_10}{\*\bkmkend ID_GFDL_45_10}\b\fs26\lang1024\f2 FUTURE REVISIONS OF THIS LICENSE\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/copyleft/\up8\fs12 1\up0\fs20 .\hyphpar0\par\pard\sb100\li960\sl220\qj Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License "or any later version" applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation.\hyphpar0\par\pard\sb200\s2\sl293 {\*\bkmkstart ID_GFDL_45_11}{\*\bkmkend ID_GFDL_45_11}\b\fs26\lang1024\f2 How to use this License for your documents\keepn\hyphpar0\par\pard\sb133\li960\sl220\qj \b0\fs20\lang1033\f1 To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:\hyphpar0\par\pard\sb100\li1160\ri200\sl198\qj \fs18 Copyright (c) YEAR YOUR NAME. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being LIST THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST. A copy of the license is included in the section entitled "GNU Free Documentation License".\hyphpar0\par\pard\sb100\li960\sl220\qj \fs20 If you have no Invariant Sections, write "with no Invariant Sections" instead of saying which ones are invariant. If you have no Front-Cover Texts, write "no Front-Cover Texts" instead of "Front-Cover Texts being LIST"; likewise for Back-Cover Texts.\hyphpar0\par\pard\sb100\li960\sl220\qj If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software.\hyphpar0\par\pard\sb200\sl293 \b\fs26\lang1024\f2 Notes\keepn\hyphpar0\par\pard\sb133\li1280\sl220\fi-320\qj \tx1280 \b0\fs20\f1 1. \tab http://www.gnu.org/copyleft/\hyphpar0\par} iptraf-ng-1.1.4/Documentation/manual.sgml0000664000076400007640000052154712173477702020670 0ustar npajkovsnpajkovs IPTraf User's Manual Version 3.0.0 1997 2003 Gerard Paul Java This manual is released under the terms of the GNU Free Documentation License of March, 2000 as published by the Free Software Foundation, reproduced in this manual as Appendix B. IPTraf is open-source software released under the terms of the GNU General Public License version 2 or any later version as published by the Free Software Foundation, reproduced in the LICENSE file in the distribution's top-level directory. The accomanying software and the information contained in this document are provided "AS IS" without warranty of any kind, express or implied, including, without limitation, the implied warranties of mercantability or fitness for any particular purpose. In no event shall the author be liable for any indirect, special, consequential, or incidental damages arising from the use of this manual or the accompanying software even if the author has been advised of the possibility of such damages. Linux is a registered trademark of Linus Torvalds. Pentium is a registered trademark of Intel Corporation. All other trademarks are property of their respective owners. Some structure declarations were based on code copyrighted by the Regents of the University of California. Token Ring parsing code based on the Token Ring packet construction code in the Linux 2.2 kernel. About This Document This document contains the instructions on how to use the IPTraf network monitoring software version 3.0. This manual details the different statistical facilities, the user interface, and the important features of the software. For Additional Information See the included README file for summarized and late-breaking information. Also read the RELEASE-NOTES file for important new information about this new version. The CHANGES file contains a record of the changes made to the software since 1.0.0. README.rvnamed contains information on the rvnamed reverse resolution program. See the other README files for support and development information. Document Conventions The following symbols and typefaces are used throughout this manual: [ ] items in brackets are optional. Brackets also denote items that may or may not be displayed onscreen depending on settings or conditions. { } curly braces enclose items you choose from | the vertical bar separates choices in curly braces normal monospace normal monospace text in syntax specifications should be typed in exactly as presented. Because UNIX and variants are case-sensitive, case must be preserved. Monospace is also used in presenting items that appear on the screen. monospace italics italics in syntax specifications indicate items that are to be replaced with an actual item (e.g. interface should be replaced with an actual interface name, like eth0). Additional information appears distinctively set apart from the main text. This information includes Notes, Tips, or Technical Notes. Notes are additional pieces of information that may be useful or may clarify the preceeding paragraphs of the manual. Tips provide shortcuts, clarify tasks that may not be immediately obvious, or provide references to additional sources of information. Technical notes are explanations of a more technical nature and may be of more use to programmers and advanced users. Getting Started About IPTraf IPTraf is a network monitoring utility and traffic analyzer for IP networks. It intercepts packets and returns data about captured the network traffic in various statistical facilities. IPTraf comes with these major features: An IP traffic monitor that shows TCP connection information (hosts, packet/byte counts, flags, window sizes), and color-coded information about other IP packets Statistics (counts and load rates) for network interfaces in general and detailed views Statistics per TCP/UDP port Statistical breakdown according to packet sizes A LAN host monitor that returns counts and loads per detected MAC address A powerful filtering system for users to view only interesting traffic Logging An asynchronous DNS resolver for the IP traffic monitor A text-based, full-color, menu-driven user interface suitable for use on all Linux systems with terminals, especially Linux consoles and color xterms Easy configuration Fully software-based. No additional hardware required Basic knowledge of the important TCP/IP protocols (IP, TCP, UDP, ICMP, etc.) is necessary for you to best understand the information generated by the program. Installation IPTraf is most readily available on the Internet, but some may receive it on a diskette. Here are the instructions for both types of distributions. System Requirements IPTraf requires: Hardware Requirements 16 megabytes of physical RAM (more recommended, at least 64 MB for very busy networks) 2 megabytes of free disk space for installation (more will be needed if you log high amounts of traffic over time) Pentium-class processor or higher (Pentium-II 200 MHz or higher recommended) or equivalent. One or more of the supported network interfaces. Operating System Requirements Linux kernel 2.2.0 or higher GNU C Library 2.1 or later ncurses 4.2 or later with the complete terminfo database in /usr/share/terminfo. Support for linux, vt100, xterm, xterm-color recommended. Compilation Requirements The following components are required when compiling IPTraf from the source code. gcc 2.7.2.3 or later GNU C (glibc) development library 2.1 or later ncurses development libraries 4.2 or later Availability IPTraf can be downloaded from the Internet from the official FTP site at ftp://iptraf.seul.org/pub/iptraf/ . The software is available in source form in compressed .tar.gz files named iptraf-x.y.z.tar.gz where x.y.z is the version number. Precompiled ready-to-run software is available in the iptraf-x.y.z.machinetype.bin.tar.gz files. (machinetype indicates what platform the precompiled binaries run on. The official distribution will only be for the Intel x86 architecture indicated as i386.) Installing Downloaded Packages You will need to have GNU tar and GNU zip installed. All modern Linux installations already have these utilities ready. Decompress the .tar.gz file by entering tar zxvf iptraf-x.y.z.tar.gz for the source code or tar zxvf iptraf-x.y.z.i386.bin.tar.gz for the precompiled x86 programs. If your tar doesn't support the z option, you can separately decompress the .tar.gz file then extract the resulting .tar archive. gunzip iptraf-x.y.z.tar.gz tar xvf iptraf-x.y.z.tar This will decompress the sources into a directory called iptraf-x.y.z (source code) or iptraf-x.y.z.bin (precompiled). (x.y.z here should be the IPTraf version number you're installing, like 3.0.0). Change to the created top level directory. To compile and install the software, run the Setup program by entering ./Setup while you are logged in as root. The Setup script will recognize the source distribution and compile the software before installing. It will immediately install a precompiled distribution. The resulting binaries will be placed in the /usr/local/bin directory. All needed directories will also be created. After installation, you will be asked if you want to read the RELEASE-NOTES file. It is recommended that you do so at that point, since the RELEASE-NOTES file contains important information about the new version. Installing a Floppy Distribution If you received IPTraf on a diskette, the sources are already decompressed. The diskette is in Second Extended filesystem format. Perform the following steps to install the software. Insert the floppy in the drive. Mount the floppy on an empty directory. For example, to mount the floppy in the first floppy drive under a directory called /mnt, enter mount -t ext2 /dev/fd0 /mnt This assumes your floppy is in /dev/fd0. You can use any empty directory in place of /mnt. With most Linux installations, this will work fine. After mounting, change to the /mnt (or whatever) directory. Enter ./Setup while logged in as root. Setup will determine whether the diskette contains a source code distribution or ready-to-run precompiled software. This will copy the binaries to /usr/local/bin, and create the necessary working directories. Unmount the diskette by typing umount /mnt (That's umount, not unmount.) You can then eject the diskette. Store it in a safe place. You will also be asked if you want to view the RELEASE-NOTES file. It is recommended that you do so at that point. In both cases (downloaded and floppy), the installation will store the program in /usr/local/bin with the binaries owned by user root, readable, writable, and executable by the owner, no permissions for the group, no permissions for all others. (700 octal, or -rwx------). Note You must be root to do the installation. The old style of installation (cd src;make install) is still supported. Be sure /usr/local/bin is included in your environment's PATH variable. You can edit the appropriate command in your login customization file (.profile for the Bourne-type shells, .cshrc for the C shell and its relatives). Upgrading from Earlier Versions IPTraf 3.0 is a major revision from IPTraf 2.7. The filter subsystem has been completely redesigned and as such, is incompatible with previous filter formats. Therefore old IPTraf filters can no longer be used. The installation procedure for IPTraf 3.0 will rename the filter list files but not delete them. If you install a distribution package (e.g. RPM, dpkg), old filters may still appear in the filter selection list but the new IPTraf version will be unable to load them. Starting and Stopping IPTraf After installation, you can start the program by simply entering iptraf at the shell prompt. You will see a copyright notice, with an instruction to press any key to get started. Just press any character key, and you will be immediately taken to the main menu. All major functions of the program are found there. Entering the IPTraf command without any command-line parameters brings up the program's main menu. From there, you can select the facilities you want. IPTraf determines and makes use of the maximum number of lines and columns on the terminal. Note IPTraf does not have a SIGWINCH handler; it does not adjust itself when an xterm or some other X terminal is resized. Technical note IPTraf needs to refer to the terminfo database in /usr/share/terminfo. If the supplied executable program fails with Error opening terminal, your terminfo database may be located somewhere else. You can control the terminfo search path by using the TERMINFO environment variable. For example, if you're using the sh or bash shell, and your terminfo database is in /usr/lib/terminfo (typical for Slackware distributions), you can use the commands: TERMINFO=/usr/lib/terminfo export TERMINFO You can place these commands in your ~/.profile or the systemwide /etc/profile startup files. You can also create a symbolic link named /usr/share/terminfo to let it point to your existing terminfo (assuming again your terminfo is in /usr/lib/terminfo): ln -s /usr/lib/terminfo /usr/share/terminfo Or you can recompile your program to use your existing ncurses library installation. If you do this, make sure you have ncurses 4.2 or later. Command-line Options IPTraf has a few optional command-line parameters. As with most UNIX commands, IPTraf command-line parameters are case-sensitive (-l is NOT the same as -L). The following command-line parameters can be supplied to the iptraf command: -i iface causes the IP traffic monitor to start immediately on the specified interface. If -i all is specified, all interfaces are monitored. -g starts the general interface statistics -d iface shows detailed statistics for the specified interface -s iface starts the TCP/UDP traffic monitor for the specified interface -z iface starts the packet size breakdown for the specified interface -l iface starts the LAN station monitor on the specified interface. If -l all is specified, all LAN interfaces are monitored. -t timeout The -t parameter, when used with one of the other parameters that specify a facility to start, tells IPTraf to run the indicated facility for only timeout minutes, after which the facility exits. The -t parameter is ignored in menu mode. If this parameter is not specified, the facility runs until the exit keystroke is pressed. -B Redirects all terminal output to the "bit bucket" /dev/null, closes standard input, and places the program in the background. This parameter can be used only with one of the -i, -g, -d, -s, -z, or -l parameters. See Background Operation in Chapter 9. -B is ignored in menu mode. -L filename Allows you to specify an alternate log file name when the any facility is directly started from the command line, whether in foreground or background mode. If specified in foreground mode, the log filename prompt is bypassed, even when logging is turned on in the Configure... menu. If this parameter is omitted in background mode, the default log filename is used. This parameter always turns on logging. If an absolute path is not specified, the log file will be created in the default log file directory -I interval Sets the logging interval (in minutes) when the -L parameter is used. This overrides the Log interval... setting in the Configure... menu. If omitted, the configured value is used. This parameter is ignored when the -L parameter is omitted and logging is disabled. The value specified here will affect all facilities except for the IP traffic monitor. -q Previously used to suppress the warning screen when IPTraf is run on kernels with IP masquerading. Since the masquerading code now processes packets in a way better suited to raw capture, this parameter is no longer needed and is retained only for compatibility. -f Forces IPTraf to clear all lock files and reset all instance counters to zero before running any facilities. IPTraf will then think it's the first instance of itself. The -f parameter overrides the existing locks and counters imposed by the IPTraf process and by the various facilities, causing this instance to think it is the first and that there are no other facilities running. Use this parameter with great caution. A common use for this parameter is to recover from abrupt or abnormal terminations which may leave stale locks and counters still lying around. The -f parameter may be used together with the others. iptraf -h displays a short help screen While the command-line options are case-sensitive, interactive keystroke at the IPTraf full-screen interface are not. Using the Menus Menu items with a trailing ellipsis (...) either pop up a submenu with further items, or require additional information before it can complete the task and return to the menu. Menu items without an ellipsis execute immediately. Use the Up and Down arrow keys on your keyboard to move the selection bar. Press Enter to execute the selected item. Alternatively, you can also directly press the highlighted letter of the item you want. This will immediately execute the option.
The IPTraf Main Menu
Exiting IPTraf You can exit IPTraf with the Exit command in the main menu. When started with one of the command-line options to directly start a statistical facility, pressing X or Q will exit the facility directly, without any confirmation. The -t command-line parameter will automatically exit the facility after the specified length of time without any confirmation as well. Daemon facilities started with the -B parameter will immediately terminate after being sent a USR2 signal. See background operation in chapter 9 for more information. Preparing to Use IPTraf This chapter provides information applicable to all of IPTraf's statistical monitors. Number Display Notations IPTraf initially returns exact counts of bytes and packets. However, as they grow larger, IPTraf begins displaying them in increasingly higher denominations. A number standing alone with no suffix represents an exact count. A number with a K following is a kilo (thousand) figure. An M, G, and T suffix represents mega (million), giga (billion), and tera (trillion) respectively. The following table shows examples. Numeric Display Notations 1024067exactly 1024067 1024Kapproximately 1024000 1024Mapproximately 1024000000 1024Gapproximately 1024000000000 1024Tapproximately 1024000000000000
These notations apply to both packet and byte counts. Instances and Logging Since version 2.4, IPTraf allows multiple instances of the facilities at the same time in different processes (for example, you can now run two or more IP Traffic Monitors at the same time). However only one can listen on a specific interface or all interfaces at once. The only exception is the general interface statistics, which is still restricted to only one instance at a time. Because of this relaxation, each instance now generates log files with unique names for instances, depending on either their instance or the interface they're listening on. If the Logging option is turned on (see the Configuration chapter), IPTraf will prompt you for a log file name while presenting a default. You may accept this default or change it. Press Enter to accept, or Ctrl+X to cancel. Canceling will turn logging off for that particular session. If you don't specify an absolute path, the log file will be placed in /var/log/iptraf.
The logfile prompt dialog
See the Logging section in the Configuration chapter for detailed information on logging. See also the documentation on each statistical facility for the default log file names. The default log file names will also be used if the -B parameter is used to run IPTraf in the background. You can override the defaults with the -L parameter. See Background Operation in Chapter 9. Screen Update Delays Older versions of IPTraf updated the screen as soon as a packet was received. However, screen update is one of the slowest operations the program performs. Since version 1.3, a configuration option has been available to control screen update speed. See the Screen update interval... configuration option under the Configuration chapter of this manual. Supported Network Interfaces IPTraf currently supports the following network interface types and names. lo The loopback interface. Every machine has one, and has an IP address of 127.0.0.1. lo is also indicated if data is detected on the dummyn interface(s). ethn An Ethernet interface. n starts from 0. Therefore, eth0 refers to the first Ethernet interface, eth1 to the second, and so on. Most machines only have one. fddin An FDDI interface. n starts from 0. trn A Token Ring interface, where n starts from 0. pppn A PPP interface. n starts from 0. slin A SLIP interface. n starts from 0. ipppn A synchronous PPP interface using ISDN. n starts from 0. isdnn ISDN interfaces can be given arbitrary names, but for them to work with IPTraf, they must be named isdnn. IPTraf supports synchronous PPP (the ipppn interfaces above), raw IP, and Cisco-HDLC encapsulation. plipn PLIP interfaces. These are point-to-point IP connections using the PC parallel port. ipsecn This refers to Free s/WAN (and possibly other) logical VPN interfaces. sbnin SBNI long-range modem interfaces dvbn, sm200, sm300 DVB satellite-receive interfaces wlann, wvlann Wireless LAN interfaces tunn general logical tunnel interfaces brgn general logical bridge interfaces hdlcn Frame Relay base (FRAD) interfaces (non-PVC) pvcn Frame Relay Permanent Virtual Circuit interfaces Your system's network interfaces must be named according to the schemes specified above. The IP Traffic Monitor Executing the first menu item or specifying -i to the iptraf command takes you to the IP traffic monitor. The traffic monitor is a real-time monitoring system that intercepts all packets on all detected network interfaces, decodes the IP information on all IP packets and displays the appropriate information, most notably the source and destination addresses. It also determines the encapsulated protocol within the IP packet, and displays some important information about that as well. There are two windows in the traffic monitor, both of which can be scrolled with the Up and Down cursor keys. Just press W to move the Active indicator to the window you want to control.
The IP traffic monitor
The Upper Window The upper window of the traffic monitor displays the currently detected TCP connections. Information about TCP packets are displayed here. The window contains these pieces of information: Source address and port Packet count Byte count Source MAC address Packet Size Window Size TCP flag statuses Interface Note Previous versions of IPTraf showed both the source and destination addresses on each line. IPTraf 2 and higher show only the source host:port combination to save on screen real estate. TCP connection endpoints are still indicated with the green brackets (on color terminals) along the left edge of the screen. The Up and Down cursor keys move an indicator bar between entries in the TCP monitor, scrolling the window if necessary. The PgUp and PgDn keys display the previous and next screenfuls of entries respectively. The IP traffic monitor computes the data flow rate of the currently highlighted TCP flow and displays it on the lower-right corner of the screen. The flow rate is in kilobits or kilobytes per second depending on the Activity mode switch in the Configure... menu. Because this monitoring system relies solely on packet information, it does not determine which endpoint initiated the connection. In other words, it does not know which endpoints are the client and server. This is necessary because it can operate in promiscuous mode, and as such cannot determine the socket statuses for other machines on the LAN. However, a little knowledge of the well-known TCP port numbers can give a good idea about which address is that of the server. The system therefore displays two entries for each connection, one for each direction of the TCP connection. To make it easier to determine the direction pairs of each connection, a bracket is used to "join" both together. This bracket appears at the leftmost part of each entry. Just because a host entry appears at the upper end of a connection bracket doesn't mean it was the initiator of the connection. Each entry in the window contains these fields: Source address and port The source address and port indicator is in address:port format. This indicates the source machine and TCP port on that machine from which this data is coming. The destination is the host:port at the other end of the bracket. Packet count The number of packets received for this direction of the TCP connection Byte count The number of bytes received for this direction of the TCP connection. These bytes include total IP and TCP header information, in addition to the actual data. Data link header (e.g. Ethernet and FDDI) data are not included. Source MAC address The address of the host on your local LAN that delivered this packet. This can be viewed by pressing M once if Source MAC addrs in traffic monitor is enabled in the Configure... menu. Packet Size The size of the most recently received packet. This item is visible if you press M for more TCP information. This is the size of the IP datagram only, not including the data link header. Window Size The advertised window size of the most recently received packet. This item is visible if you press M for more TCP information. Flag statuses The flags of the most recently received packet. S SYN. A synchronization is taking place in preparation for connection establishment. If only an S is present (S---) the source is trying to initiate a connection. If an A is also present (S-A-), this is an acknowledgment of a previous connection request, and is responding. A ACK. This is an acknowledgment of a previously received packet P PSH. A request to push all data to the top of the receiving queue U URG. This packet contains urgent data RESET RST. The source machine indicated in this direction reset the entire connection. The direction entries for reset connections become available for new connections. DONE The connection is done sending data in this direction, and has sent a FIN (finished) packet, but has not yet been acknowledged by the other host. CLOSED The FIN has been acknowledged by the other host. When both directions of a connection are marked CLOSED, the entries they occupy become available for new connection entries. - The flag is not set Some other pieces of information can be viewed as well. The M key displays more TCP information. Pressing M once displays the MAC addresses of the LAN hosts that delivered the packets (if the Source MAC addrs in traffic monitor option is enabled in the Configure... menu). N/A is displayed if no packets have been received from the source yet, or if the interface doesn't support MAC addresses (such as PPP interfaces). If the Source MAC addrs in traffic monitor option is not enabled, pressing M simply toggles between the counts and the packet and window sizes. By default, only IP addresses are displayed, but if you have access to a name server or host table, you may enable reverse lookup for the IP addresses. Just enable reverse lookup in the Configure... menu. The rvnamed Process The IP traffic monitor starts a daemon called rvnamed to help speed up reverse lookups without sacrificing too much keyboard control and accuracy of the counts. While reverse lookup is being conducted in the background, IP addresses will be used until the resolution is complete. If for some reason rvnamed cannot start (probably due to improper installation or lack of memory), and you are on the Internet, and you enable reverse lookup, your keyboard control can become very slow. This is because the standard lookup functions do not return until they have completed their tasks, and it can take several seconds for a name resolution in the foreground to complete. rvnamed will spawn up to 200 children to process reverse DNS queries. Tip If you notice unusual SYN activity (too many initial (S---) but frozen SYN entries, or rapidly increasing initial SYN packets for a single connection), you may be under a SYN flooding attack or TCP port scan. Apply appropriate measures, or the targeted machines may begin denying network services. Entries not updated within a user-configurable amount of time may get replaced with new connections. The default time is 15 minutes. This is regardless of whether the connection is closed or not. (Some unclosed connections may be due to extremely slow links or crashes at either end of the connection.) This figure can be changed at the Configure... menu. Some early entries may have a > symbol in front of its packet count. This means the connection was already established when the monitor started. In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. Eventually, these > entries will close (or time out) and disappear. TCP entries without the > were initiated after the traffic monitor started, and the counts indicate the totals of the connection itself. Just consider entries with > partial. Some > entries may go idle if the traffic monitor was started when these connections were already half-closed (FIN sent by one host, but data still being sent by the other). This is because the traffic monitor cannot determine if a connection was already half-closed when it started. These entries will eventually time out. (To minimize these entries, an entry is not added by the monitor until a packet with data or a SYN packet is received.) Direction entries also become available for reuse if an ICMP Destination Unreachable message is received for the connection. The lower part of the screen contains a summary line showing the IP, TCP, UDP, ICMP, and non-IP byte counts since the start of the monitor. The IP, TCP, UDP, and ICMP counts include only the IP datagram header and data, not the data-link headers. The non-IP count includes the data-link headers. Technical note: IP Forwarding and Masquerading Previous versions of IPTraf issued a warning if the kernel had IP masquerading enabled due to the way the kernel masqueraded and translated the IP addresses. The new kernels no longer do it as before and IPTraf now gives output properly on masquerading machines. The -q parameter is no longer required to suppress the warning screen. On forwarding (non-masquerading) machines packets and TCP connections simply appear twice, one each for the incoming and outgoing interfaces if all interafaces are being monitored. On masquerading machines, packets and connections from the internal network to the external network also appear twice, one for the internal and external interface. Packets coming from the internal network will be indicated as coming from the internal IP address that sourced them, and also as coming from the IP address of the external interface on your masquerading machine. In much the same way, packets coming in from the external network will look like they're destined for the external interface's IP address, and again as destined for the final host on the internal network. Closed/Idle/Timed Out Connections A TCP connection entry that closes, gets reset, or stays idle too long normally gets replaced with new connections. However, if there are too many of these, active connections may become interspersed among closed, reset, or idle entries. IPTraf can be set to automatically remove all closed, reset, and idle entries with the TCP closed/idle persistence... configuration option. You can also press the F key to immediately clear them at any time. Note The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains on-screen. The TCP closed/idle persistence... parameter flushes entries that have been idle for the number of minutes defined by the TCP timeout... option. Sorting TCP Entries The TCP connection entries can be sorted by pressing the S key, then by selecting a sort criterion. Pressing S will display a box showing the available sort criteria. Press P to sort by packet count, B to sort by byte count. Pressing any other key cancels the sort. The sort operation compares the larger values in each connection entry pair and sorts the counts in descending order. Over time, the entries will go out of order as counts proceed at varying rates. Sorting is not done automatically so as not to degrade performance and accuracy.
The IP traffic monitor sort criteria
Lower Window The lower window displays information about the other types of traffic on your network. The following protocols are detected internally: User Datagram Protocol (UDP) Internet Control Message Protocol (ICMP) Open Shortest-Path First (OSPF) Interior Gateway Routing Protocol (IGRP) Interior Gateway Protocol (IGP) Internet Group Management Protocol (IGMP) General Routing Encapsulation (GRE) Layer 2 Tunneling Protocol (L2TP) IPSec AH and ESP protocols (IPSec AH and IPSec ESP) Address Resolution Protocol (ARP) Reverse Address Resolution Protocol (RARP) Other IP protocols are looked up from the /etc/services file. If /etc/services doesn't contain information about that protocol, the protocol number is indicated. Non-IP packets are indicated as Non-IP in the lower window. Note The source and destination addresses for ARP and RARP entries are MAC addresses. Strictly speaking, ARP and RARP packets aren't IP packets, since they are not encapsulated in an IP datagram. They're just indicated because they are integral to proper IP operation on LANs. For all packets in the lower window, only the first IP fragment is indicated (since that contains the header of the IP-encapsulated protocol) but with no further information from the encapsulated protocol. UDP packets are also displayed in address:port format while ICMP entries also contain the ICMP message type. For easier location, each type of protocol is color-coded (only on color terminals such as the Linux console). UDPRed on White ICMPYellow on Blue OSPFBlack on Cyan IGRPBright white on Cyan IGPRed on Cyan IGMPBright green on Blue GREBlue on white ARPBright white on Red RARPBright white on Red Other IPYellow on red Non-IPYellow on Red The lower window can hold up to 512 entries. You can scroll the lower window by using the W key to move the Active indicator to it, and by using the Up and Down cursor keys. The lower window automatically scrolls every time a new entry is added, and either the first entry or last entry is visible. Upon reaching 512 entries, old entries are thrown out as new entries are added. Some entries may be too long to completely fit in a screen line. You can use the Left and Right cursor keys to vertically scroll the lower window when it is marked Active. If your terminal can be resized (e.g. xterm), you may do so before starting IPTraf. Entries for packets received on LAN interfaces also include the source MAC address of the LAN host which delivered it. This behavior is enabled by turning on the Source MAC addrs in traffic monitor toggle in the Configure... menu. Entry Details In general, the entries in the lower window indicate the protocol, the IP datagram size (full frame size for non-IP, including ARP and RARP), the source address, the destination address, and the network interface the packet was detected on. However, some protocols have a little more information. ICMP ICMP entries are displayed in this format: ICMP type [(subtype)] (size bytes) from source to destination [(src HWaddr srcMACaddress)] on interface where type could be any of the following: echo req, echo rply ICMP echo request and reply. Usually used by the ping program and other network monitoring and diagnostic program. dest unrch ICMP destination unreachable. Something failed to reach its target. The dest unreach type is supplemented with a further indicator of the problem. Destination unreachable messages for TCP traffic causes the corresponding TCP entry in the upper window to be made available for reuse by new connections. redirct ICMP redirect. Usually generated by a router to tell a host that a better gateway is available. src qnch The ICMP source quench is used to stop a host from transmitting. It's a flow control mechanism for IP. time excd Indicates a packet's time-to-live value expired before it got to its destination. Mostly happens if a destination is too far away. Also used by the traceroute program. router adv ICMP router advertisement router sol ICMP router solicitation timestmp req ICMP timestamp request timestmp rep ICMP timestamp reply info req ICMP information request info rep ICMP information reply addr mask req ICMP address mask request addr mask rep ICMP address mask reply param prob ICMP parameter problem bad/unknown An unrecognized ICMP packet was received, or the packet is corrupted. The destination unreachable message also includes information on the type of error encountered. Here are the destination unreachable codes: ntwk network unreachable host host unreachable proto protocol unreachable port port unreachable pkt fltrd packet filtered (normally by an access rule on a router or firewall) DF set the packet has to be fragmented somewhere, but its don't fragment (DF) bit is set. src rte fail source route failed src isltd source isolated (obsolete) net comm denied network communication denied host comm denied host communication denied net unrch for TOS network unreachable for specified IP type-of-service host unrch for TOS host unreachable for specified IP type-of-service prec violtn precedence violation prec cutoff precedence cutoff dest net unkn destination network unknown dest host unkn destination network unknown For more information on ICMP, see RFC 792. OSPF OSPF messages also include a little more information. The format of an OSPF message in the window is: OSPF type (a=area r=router) (sizebytes) from source to destination [(src HWaddr srcMACaddress)] on interface The type can be one of the following: hlo OSPF hello. Hello messages establish OSPF communications and keep routers informed of each other's presence. DB desc OSPF Database Description LSR OSPF Link State Request LSU OSPF Link State Update. Messages indicating the states of the OSPF network links LSA OSPF Link State Acknowledgment The entries in parentheses: a=area The area number of the OSPF message r=router The IP address of the router that generated the message. It is not necessarily the same as the source address of the encapsulating IP packet. Many times, the destination addresses for OSPF packets are class D multicast addresses in standard dotted decimal notation or (if reverse lookup is enabled), hosts under the MCAST.NET domain. Such multicast addresses are defined as follows: 224.0.0.5 (OSPF-ALL.MCAST.NET) OSPF all routers 224.0.0.6 (OSPF-DSIG.MCAST.NET) OSPF all designated routers See RFC 1247 for details on the OSPF protocol. Additional Information When started from the main menu and logging is enabled, the IP traffic monitor prompts you for a log file name. The default name is ip_traffic-n.log (where n is what instance of the traffic monitor this is (1, 2, 3, and so on). (e.g. if this is the first instance, the default file name will be ip_traffic-1.log.) When started with the -i parameter, the log filename can be specified with the -L parameter. See the Command-line Parameters section above for more information. On busy networks, the display may become cluttered with traffic you're not interested in. To control the traffic monitor's output, you can apply a filter. See Chapter 7, Filters for more information on IPTraf's filters. At any time, you can press X or Q to return to the main menu (or back to the shell if the monitor was started with iptraf -i). Network Interface Statistics There are two network interface statistics facilities: the general interface statistics, which displays a statistical summary of all attached interfaces, and the detailed interface statistics, which shows more statistical and load information about a single selected interface. General Interface Statistics The second menu option displays a list of attached network interfaces, and some general packet counts. Specifically, it displays counts of IP, non-IP, and bad IP packets (packets with IP checksum errors). It also includes an activity indicator, which shows the number of kilobits and packets the interface sees per second. All figures are for incoming and outgoing packets. (Again, considering promiscuous mode for LAN interfaces, which simply causes the machine to intercept all packets). This is useful for general monitoring of all attached interfaces. If byte counts and additional information are needed for a specific interface, the Detailed interface statistics option is also available. The activity indicators can be toggled between kbits/s and kbytes/s with the Activity mode configuration option. The general statistics window will dynamically add new entries as packets from newly-created interfaces (e.g. new PPP interfaces) are intercepted. Long lists can be scrolled with the Up, Down, PgUp, and PgDn keys. This monitor is affected by IPTraf's filters as described in Chapter 7. Copies of the statistics are written to the log file iface_stats_general.log at regular intervals if logging is enabled. See the Logging option int the Configuration chapter. This facility can be started directly from the command line with the -g option to the iptraf command. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.
The general interface statistics screen
You can press X or Q to return to the main menu. Detailed Interface Statistics The third menu option displays packet statistics for any selected interface. It provides basically the same information as the General interface statistics option, with additional details. This facility provides the following information: Total packet and byte counts IP packet and byte counts TCP packet and byte counts UDP packet and byte count ICMP packet and byte counts Other IP-type packet and byte counts Non-IP packet and byte counts Checksum error count Interface activity Broadcast packet and byte counts All IP byte counts (IP, TCP, UDP, ICMP, other IP) include IP header data and payload. The data link header is not included. The full frame length (including data-link header) is included in the non-IP and Total byte count. All data-link headers are also included in the Total byte counts.
The detailed interface statistics screen
The upper portion of the screen contains the packet and byte counts for all IP and non-IP packets intercepted on the interface. The lower portion contains the total, incoming, and outgoing interface data rates. This facility also displays incoming and outgoing counts and data rates. The packet size breakdown in versions prior to 2.0.0 has been moved to its own facility under Statistical breakdowns.../By packet size as described in Chapter 5. An outgoing packet is one that exits your interface, regardless of whether it originated from your machine or came from another machine and was routed through yours. An incoming packet is one that enters your interface, either addressed to you directly, broadcast, multicast, or captured promiscuously. The rate indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option. Note Buffering and some other factors may affect the data rates, notably the outgoing rate, causing it to reflect a higher figure than the actual rate at which the interface is sending. The figures are logged at regular intervals if logging is enabled. The default log file name at the prompt is iface_stats_detailed-iface.log where iface is the selected interface for this session (for example, iface_stats_detailed-eth0.log). If you wish to start this facility directly from the command line, you can specify the -d parameter and an interface to monitor. For example, iptraf -d eth0 starts the statistics for eth0. The interface must be specified, or IPTraf will not start the facility. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. Note In both the general and detailed statistics screens, as well as in the IP traffic monitor, the packet counts are for actual network packets (layer 2), not the logical IP packets (layer 3) that may be reconstructed after fragmentation. That means, if a packet was fragmented into four pieces, and these four fragments pass over your interface, the packet counts will indicate four separate packets. The figure for the IP checksum errors is a packet count only, because the corrupted IP header cannot be relied upon to give a correct IP packet length value. This facility's output is also affected by IPTraf's filters. See Chapter 7 for more information on filters. Pressing X or Q takes you back to the main menu (if this facility was started with the command-line option, X or Q drops you back to the shell). Statistical Breakdowns Statistical breakdowns contain two facilities that break down traffic counts by either packet size or TCP/UDP port. Packet Sizes The packet size breakdown facility used to be incorporated into the detailed interface statistics. It has since been moved to its own facility. It is entered by selecting Statistical Breakdowns/By packet size. The packet size breakdown takes the interface's Maximum Transmission Unit (MTU) size and divides it into 20 brackets, each bracket containing a range of sizes. As a packet is captured, its size is determined and the appropriate bracket is incremented. This facility provides an idea as to the packet sizes passing over your network, and can aid in network (re)design decisions.
The packet size statistical breakdown
If logging is enabled, copies of the statistics are written at regular intervals to a log file. The default log file name is packet_size-iface.log where iface is the selected interface for this session (for example, packet_size-eth0.log). IPTraf's filters do not affect this facility. The packet size breakdown can also be invoked straight from the command line by specifying the -z iface parameter. The interface parameter is required. For example, this command runs the facility on interface eth0. iptraf -z eth0 When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. To exit, press X or Ctrl+X. TCP and UDP Traffic Statistics IPTraf also includes a facility that generates statistics on TCP and UDP traffic. This facility displays counts of all TCP and UDP packets with source or destination ports numbered less than 1024. Ports 1 to 1023 are reserved for the TCP/IP application protocols (well-known ports).
The TCP/UDP service monitor
The statistics window indicates the protocol (TCP or UDP), the port number, the total packets and bytes counted for this particular protocol/port combination, the packets and bytes destined for that protocol and port, and the packets and bytes coming from that protocol and port. Byte counts include the IP header and payload only. The data link header is not included. The protocol/port indicators are color-coded for easier identification on color terminals. TCP indicators are in yellow, UDP in bright green. Some network applications or protocols may use port numbers higher than 1023. Examples of these include application proxy servers (HTTP proxy servers typically use values like 8000, 8080, 8888, and the like), and IRC (IRC servers commonly accept connections on ports 6660 to 6669). These ports are by default not included in the counts. If you do want to include a higher-numbered port in the statistics, you can add them yourself from the Configure.../Additional ports... menu item. See the section below. If logging is enabled, The statistics are also written to a log file (the default name is tcp_udp_services-iface.log, where iface is the selected interface (for example, tcp_udp_services-eth0.log). IPTraf computes the total, incoming, outgoing, and data rates of the protocol currently indicated by the facility's highlight bar. The data rates are indicated at the bottom of the screen. If logging is enabled, the average data rates since the start of the facility are placed in the log file. The Up and Down cursor keys move the highlight bar. Pressing X or Ctrl+X exits and returns to the main menu (or the shell if it was started from the command line). Sorting TCP/UDP Entries Pressing the S key brings up a window which allows you to select the field by which the entries will be sorted. You can press R to sort by port, P to sort by total packets, B to sort by total bytes, T to sort by incoming packets (packets to), O to sort by incoming bytes (bytes to), F to sort by outgoing packets (packets from) and M to sort by outgoing bytes (bytes from). Pressing any other key cancels the sort. Port numbers are sorted in ascending order (least first) but statistics are sorted in descending order (largest counts first). As with the IP traffic monitor, sorting is performed only with this sequence. Automatic sorting is not performed so as not to affect performance.
The TCP/UDP monitor's sort criteria
Additional Information IPTraf's filters affect the output of this facility. See Chapter 7, Filters for more information about filters. If you wish to start this facility from the command line, you can use the -s option followed by an interface to monitor. For example, iptraf -s eth0 brings up this module for traffic on eth0. The interface must be specified, or IPTraf will drop back to the shell. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. LAN Station Statistics The LAN station monitor (Ethernet station monitor on versions prior to 1.3.0) discovers MAC addresses and displays statistics on the number of incoming, and outgoing packets. It also includes figures for incoming and outgoing kilobits per second for each discovered station. The entry above each line of statistics is the station's LAN type (Ethernet, PLIP, Token Ring, or FDDI) and the hardware MAC address. Each statistics line consists of the following information: Total packets incoming IP packets incoming Total bytes incoming Incoming rate Total packets outgoing IP packets outgoing Total bytes outgoing Outgoing rate The byte counts include the data link header. The activity indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option. This facility works only for Ethernet, PLIP, Token Ring, and FDDI frames. Loopback. ISDN, and SLIP/PPP networks are not monitored here.
The LAN station monitor
Copies of the statistics are written to a log file at regular intervals if logging is enabled. The default log file name is lan_statistics-n.log, where n is the instance number of this facility (for example, if this is the first instance, the generated default log file name is lan_statistics-1.log). Sorting the LAN Station Monitor Entries Press S to sort the entries. A box will pop up and display the keys you can press to select the field by which the entries will be sorted. Press P to sort by total incoming packets, I to sort by incoming IP packets, B to sort by total incoming bytes, K to sort by total outgoing packets, O to sort by outgoing IP packets, and Y to sort by total outgoing bytes. Pressing any other key cancels the sort.
The LAN station monitor's sort criteria When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. Additional Information The window can be scrolled with the Up and Down cursor keys. Press X or Q to return to the main menu (or the shell if this facility was started with the -l command-line option). The output of this facility is affected by any applied IPTraf filter. Filters Filters are used to control the information displayed by all facilities. You may want to view statistics only on particular traffic so you must restrict the information displayed. The filters also apply to logging activity. The IPTraf filter management system is accessible through the Filters... submenu.
The Filters submenu
IP Filters The Filters/IP... menu option allows you to define a set of rules that determine what IP traffic to pass to the monitors. Selecting this option pops up another menu with the tasks used to define and apply custom IP filters.
The IP filter menu
Defining a New Filter A freshly installed program will have no filters defined, so before anything else, you will have to define a filter. You can do this by selecting the Define new filter... option. Selecting this option displays a box asking you to enter a short description of the filter you are going to define. Just enter any text that clearly identifies the nature of the filter.
The IP filter name dialog
Press Enter when you're done with that box. As an alternative, you can also press Ctrl+X to cancel the operation. The Filter Rule Selection Screen After you enter the filter's description, you will be taken to a blank rule selection box. At this screen you manage the various rules you define for this filter. You can opt to insert, append, edit, or delete rules.
The filter rule selection screen. Selecting an entry displays that set for editing
Any rules defined will appear here. You will see the source and destination addresses, masks and ports (long addresses and masks may be truncated) and whether this rule includes or excludes matching packets. Between the source and destination parameters is an arrow that indicates whether the rule matches packets (single-headed) only exactly or whether it matches packets flowing in the opposite direction (double-headed). At this screen, press I to insert at the current position of the selection bar, A to append a rule to the end of the list, Enter to edit the highlighted rule and D to delete the selected rule. With an empty list, A or I can be used to add the first rule. To add the first rule, press A or I. You will then be presented with a dialog box that allows you to enter the rule's parameters. Entering Filter Rules You can enter addresses of individual hosts, networks, or a catch-all address. The nature of the address will be determined by the wildcard mask. You'll notice two sets of fields, marked Source and Destination. You fill these out with the information about your source and targets. Fill out the host name or IP address of the hosts or networks in the first field marked Host name/IP Address. Enter it in standard dotted-decimal notation. When done, press Tab to move to the Wildcard mask field. The wildcard mask is similar but not exactly identical to the standard IP subnet mask. The wildcard mask is used to determine which bits to ignore when processing the filter. In most cases, it will work very closely like a subnet mask. Place ones (1) under the bits you want the filter to recognize, and keep zeros (0) under the bits you want the filter to ignore. For example: To recognize the host 207.0.115.44 IP address207.0.115.44 Wildcard mask255.255.255.255 To recognize all hosts belonging to network 202.47.132.x IP address202.47.132.0 Wildcard mask255.255.255.0 To recognize all hosts with any address: IP address0.0.0.0 Wildcard mask0.0.0.0 The IP address/wildcard mask mechanism of the display filter doesn't recognize IP address class. It uses a simple bit- pattern matching algorithm. The wildcard mask also does not have to end on a byte boundary; you may mask right into a byte itself. For example, 255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in binary). IPTraf also accepts host names in place of the IP addresses. IPTraf will resolve the host name when the filter is loaded. When the filter is interpreted, the wildcard mask will also be applied. This can be useful in cases where a single host name may resolve to several IP addresses. Tip See the Linux Network Administrator's Guide if you need more information on IP addresses and subnet masking. Tip IPTraf allows you to specify the wildcard mask in Classless Interdomain Routing (CIDR) format. This format allows you to specify the number of 1-bits that mask the address. CIDR notation is the form address/bits where the address is the IP address or host name and bits is the number of 1-bits in the mask. For example, if you want to mask 10.1.1.0 with 255.255.255.0, note that 255.255.255.0 has 24 1-bits, so instead of specifying 255.255.255.0 in the wildcard mask field, you can just enter 10.1.1.0/24 in the address field. IPTraf will translate the mask bits into an appropriate wildcard mask and fill in the mask field the next time you edit the filter rule. If you specify the mask in CIDR notation, leave the wildcard mask fields blank. If you fill them up, the wildcard mask fields will take precedence. The Port fields should contain a port number or range of any TCP or UDP service you may be interested in. If you want to match only a single port number, fill in the first field, while leaving the second blank or set to zero. Fill in the second field if you want to match a range of ports (e.g. 80 to 90). Leave the first field blank or set to zero to let the filter ignore the ports altogether. You will most likely be interested in target ports rather than source ports (which are usually unpredictable anyway, perhaps with the exception of FTP data). Non-TCP and non-UDP packets are not affected by these fields, and these are used only when filtering TCP or UDP packets. Fill out the second set of fields with the parameters of the opposite end of the connection. Tip Any address or mask fields left blank default to 0.0.0.0 while blank Port fields default to 0. This makes it easy to define filter rules if you're interested only in either the source or destination, but not the other. For example, you may be interested in traffic originating from network 61.9.88.0, in which case you just enter the source address, mask and port in the Source fields, while leaving the Destination fields blank. The next fields let you specify which IP-type protocols you want matched by this filter rule. Any packet whose protocol's corresponding field is marked with a Y is matched against the filter's defined IP addresses and ports, otherwise they don't pass through this filter rule. If you want to evaluate all IP packets just mark with Y the All IP field. For example, if you want to see only all TCP traffic, mark the TCP field with Y. The long field marked Additional protocols allows you to specify other protocols by their IANA number. (You can view the common IP protocol number in the /etc/protocols file). You can specify a list of protocol numbers or ranges separated by commas, Ranges have the beginning and ending protocol numbers separated with a hyphen. For example, to see the RSVP (46), IP mobile (55), and protocols (101 to 104), you use an entry that looks like this: 46, 55, 101-104 It's certainly possible to specify any of the protocols listed above in this field. Entering 1-255 is functionally identical to marking All IP with a Y. The next field is marked Include/Exclude. This field allows you to decide whether to include or filter out matching packets. Setting this field to I causes the filter to pass matching packets, while setting it to E causes the filter to drop them. This field is set to I by default. The last field in the dialog is labeled Match opposite. When set to Y, the filter will match packets flowing in the opposite direction. Previous versions of IPTraf used to match TCP packets flowing in either direction, so the source and destination address/mask/port combinations were actually interchangeable. Starting with IPTraf 3.0, when filters extended to more than just the IP traffic monitor, this behavior is no longer the default throughout IPTraf except in the IP traffic monitor's TCP window. Note For TCP packets, this field is used in all facilities except the IP traffic monitor. Because the IP traffic monitor must capture TCP packets in both directions to properly determine a closed connection, the filter automatically matches packets in the opposite direction, regardless of this field's setting. However iin all other facilities, automatic matching of the reverse packets is not performed unless you set this field to Y. Filters for UDP and other IP protocols do not automatically match packets in the opposite direction unless you set the field to Y, even in the IP traffic monitor. Press Enter to accept all parameters when done. The parameters will be accepted and you'll be taken back to the rule selection box. You can then add more rules by pressing A or you can insert new rules at any point by pressing I. Should you make a mistake, you can press Enter to edit the selected filter. You may enter as many sets of parameters as you wish. Press Ctrl+X when done. Note Because of the major changes in the filtering system since IPTraf 2.7, old filters will no longer work and will have to be redefined.
The IP filter parameters dialog
Examples To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port Host name/IP Address202.47.132.2207.0.115.44 Wildcard mask255.255.255.255255.255.255.255 Port00 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all traffic from host 207.0.115.44 to all hosts on network 202.47.132.x Host name/IP Address207.0.115.44202.47.132.0 Wildcard mask255.255.255.255255.255.255.0 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeN To see all Web traffic (to and from port 80) regardless of source or destination Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port800 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all IRC traffic from port 6666 to 6669 Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port06666 to 6669 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all DNS traffic, (TCP and UDP, destination port 53) regardless of source or destination Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port053 ProtocolsTCP: Y UDP: Y Include/ExcludeI Match oppositeY To see all mail (SMTP) traffic to a single host (202.47.132.2) from anywhere Host name/IP Address0.0.0.0202.47.132.2 Wildcard mask0.0.0.0255.255.255.255 Port025 ProtocolsTCP: Y Include/ExcludeI Match oppositeN To see traffic from from/to host sunsite.unc.edu to/from cebu.mozcom.com Host name/IP Addresssunsite.unc.educebu.mozcom.com Wildcard mask255.255.255.255255.255.255.255 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeY To omit display of traffic to/from 140.66.5.x from/to anywhere Host name/IP Address140.66.5.00.0.0.0 Wildcard mask255.255.255.00.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeE Match oppositeY You can enter as many parameters as you wish. All of them will be interpreted until the first match is found. Excluding Certain Sites Filters follow an implicit "no-match" policy, that is, only packets matching defined rules will be matched, others will be filtered out. This is similar to the access-list policy "whatever is not explicitly permitted is denied". If you want to show all traffic to/from everywhere, except certain places, you can specify the sites you wish to exclude, mark them with E in the Include/Exclude field, and define a general catch-all entry with source address 0.0.0.0, mask 0.0.0.0, port 0, and destination 0.0.0.0, mask 0.0.0.0, port 0, tagged with an I in the Include/Exclude field as the last entry. For example: To see all traffic except all SMTP (both directions), Web (both directions), and traffic (only) from 207.0.115.44 Host name/IP address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port250 ProtocolsTCP: Y Include/ExcludeE Match oppositeY Host name/IP address0.0.0.0 0.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port800 ProtocolsTCP: Y Include/ExcludeE Match oppositeY Host name/IP address207.0.115.440.0.0.0 Wildcard mask255.255.255.2550.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeE Match oppositeN Host name/IP address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeN Tip To filter out all TCP, define a filter with a single entry, with a source of 0.0.0.0 mask 0.0.0.0 port 0, and a destination of 0.0.0.0 mask 0.0.0.0 port 0, with the Include/Exclude field marked E (exclude). Then apply this filter. Applying a Filter The above steps only add the filter to a defined list. To actually apply the filter, you must select Apply filter... from the menu. You will be presented with a list of filters you already defined. Select the one you want to apply, and press Enter. The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached. Editing a Defined Filter Select Edit filter... to modify an existing filter. Once you select this option, you will be presented with the list of defined filters. Select the filter you want to edit by moving the selection bar and press Enter. Edit the description if you wish. Pressing Ctrl+X at this point will abort the operation, and the filter will remain unmodified. Press Enter to accept any changes to the filter description. After pressing Enter, you will see the filter's rules. To edit an existing filter rule, move the selection bar to the desired entry and press Enter. A prefilled dialog box will appear. Edit its contents as desired. Press Enter to accept the changes or Ctrl+X to discard. You can add a new filter rule by pressing I to insert at the selection bar's current position. When you press I, you will be presented with a dialog box asking you to enter the new rule data. Pressing A results in a similar operation, except the rule will be appended as the last entry in the rule list. Pressing D deletes the currently pointed entry. Press X or Ctrl+X to end the edit and save the changes. Note If you're editing the currently applied filter, you will need to re-apply the filter for the changes to take effect. Note Be aware that the filter processes the rules in order. In other words, if a packet matches more than one rule, only the first matching rule is followed. Deleting a Defined Filter Select Delete filter... from the menu to remove a filter from the list. Just move the selection bar to the filter you want to delete, and press Enter. Detaching a Filter The Detach filter option deactivates the filter currently in use. Selecting this option causes all TCP traffic to be passed to the monitors. When you're done with the menu, just select the Exit menu option. ARP, RARP, and other Non-IP Packet Filters The Non-IP filter option toggles the display and logging of all non-IP packets, except ARP and RARP, which are toggled separately. Configuring IPTraf IPTraf can be easily configured with the Configure... item in the main menu. The configuration is stored in the /var/local/iptraf/iptraf.cfg file. If the file is not found, IPTraf uses the default settings. Any changes to the configuration immediately get stored in the configuration file.
The IPTraf configuration menu
Toggles Reverse DNS Lookups Activating reverse lookup causes IPTraf to find out the name of the hosts with the addresses in the IP packets. When this option is enabled, IPTraf's IP traffic monitor starts the rvnamed DNS lookup server to help resolve IP addresses in the background while allowing IPTraf to continue capturing packets. This option is off by default. TCP/UDP Service Names This option, when on, causes IPTraf to display the TCP/UDP service names (smtp, www, pop3, etc.) instead of their numeric ports (25, 80, 110, etc). The number-to-name mappings will depend on the systems services database file (usually /etc/services). Should there be no corresponding service name for the port number, the numeric form will still be displayed. This setting is off by default. Note Reverse lookup and service name lookup take some time and may impact performance and increase the chances of dropped packets. Performance and results are best (albeit more cryptic) with both these settings off. Force promiscuous If this option is enabled, your LAN interfaces will capture all packets on your LAN. Using this option enables you to see all TCP connections and packets passing your LAN segment, even if they're not from or for your machine. When this option is active in the statistics windows, the Activity indicators will show a good estimate of the load on your LAN segment. When this option is disabled, you'll only receive information about packets coming from and entering your machine. The setting of this option affects all LAN ( Ethernet, FDDI, some Token Ring) interfaces on your machine, if you have more than one. The interface's promiscuous flag is set only when a facility is started, and turned off when it exits. However, if promiscuous mode was already set when a facility was started, it remains set on exit. If multiple instances of IPTraf are started, the promiscuous setting is restored only upon exit of the last facility. Note Do not use other programs that change the interface's promiscuous flag at the same time you're using IPTraf. The programs can interfere with each other's expected operations. While IPTraf tries to obtain the initial setting of any promiscuous flags for restoration upon exit, other programs may not be as well-behaved, and they may turn off the promiscuous flags while IPTraf is still monitoring. Color Turn this on with color monitors. Turn it off with black-and- white monitors or non-color terminals (like xterms). Changes to this setting will take effect the next time the program is started. Color is on by default on consoles and color xterms, off on non-color terminals like xterms and VT100s. Logging When this option is active, IPTraf will log information to a disk file, which can be examined or analyzed later. Since IPTraf 2.4.0, IPTraf prompts you for the name of the file to which to write the logs. It will provide a default name, which you are free to accept or change. The IP traffic monitor and LAN station monitor will generate a log file name that is based on what instance they are (first, second, and so on). The general interface statistics' default log file name is constant, because it listens to all interfaces at once, and only one instance can run at one time. The other facilities generate a log file name based on the interface they're listening on. See the descriptions on the facilities above for the default log file names. Press Enter to accept the log file name, or Ctrl+X to cancel. Canceling will turn logging off for that session. The IP traffic monitor will write the following pieces of information to its log file: Start of the traffic monitor Receipt of the first TCP packet for a connection. If that packet is a SYN, (SYN) will be indicated in the log entry. (Of course, the traffic monitor may start in the middle of established connections. It will still count those packets. This also explains why some connection entries may become idle if the traffic monitor is started in the middle of a half-closed connection, and miss the first FIN. Such entries time out in a while.) Receipt of a FIN (with average flow rate) ACK of a FIN Timeouts of TCP entries (with average flow rate) Reset connections (with average flow rate) Everything that appears in the bottom window of the traffic monitor Stopping of the traffic monitor Each log entry includes the date and time the entry was written. Logging is also affected by the defined filters. Log files can grow very fast, so be prepared with plenty of free space and delete unneeded logs. Log write errors are not indicated. Copies of the interface statistics, TCP/UDP statistics, packet size statistics, and LAN host statistics are also written to the log files at regular intervals. See Log Interval... in this chapter. IPTraf closes and reopens the active log file when it receives a USR1 signal. This is useful in cases where a facility is run for long periods of time but the log files have to be cleared or moved. To clear or move an active log file, rename it first. IPTraf will continue to write to the file despite the new name. Then use the UNIX kill command to send the running IPTraf process a USR1 signal. IPTraf will then close the log file and open another with the original name. You can then safely remove or delete the renamed file. Do not delete an open log file. Doing so will only result in a file just as large but filled with null characters (ASCII code 0). Logging comes disabled by default. The USR1 signal is caught only if logging is enabled, it is ignored otherwise. A valid specification of -L on the command line with automatically enable logging for that particular session. The saved configuration setting is not affected. Activity mode Toggles activity indicators in the interface and LAN statistics facilities between kilobits per second (kbits/s) or kilobytes per second (kbytes/s). The default setting is kilobits per second. Source MAC addrs in traffic monitor When enabled, the IP traffic monitor retrieves the packets' source MAC addresses if they came in on an Ethernet, FDDI, or PLIP interface. The addresses appear in the lower window for non-TCP packets, while for TCP connections, they can be viewed by pressing M. No such information is displayed if the network interface doesn't use MAC addresses (such as PPP interfaces). This can be used to determine the actual source of the packets on your local LAN. The traffic monitor also logs the MAC addresses with this option enabled. The default setting is off. Timers The Timers... submenu allows you to IPTraf's interval and timeout functions.
The Timers configuration submenu
TCP Timeout This figure determines the amount of time (in minutes) a connection entry may remain idle before it becomes eligible for replacement by a new connection. The default is 15 minutes. You may want to reduce this on an isolated (not connected to the Internet) LAN or a LAN connected to the Internet with high-speed links. Just enter the new value and press Enter. You can press Ctrl+X to leave the current value unchanged. Log Interval This figure determines the number of minutes between logging of interface statistics, TCP/UDP figures, and LAN host statistics. The default is 60 minutes. This figure is meaningless if logging is disabled. This configuration item can be overridden with the -I when a facility is directly invoked from the command line (not accessed via the main menu), and remains effective for that particular session. The configured value is not affected. Screen Update Interval This value determines the rate in seconds at which the screen is updated. The default is 0, which means the screen is updated as fast as possible, giving close-to-realtime reflection of network activity. However, this high-speed update can cause incredible amounts of traffic if IPTraf is run on a remote terminal (e.g. a Telnet or Secure Shell session). You can set this to a higher value, such as 1 or 2 seconds to slow down the updates. This figure does not affect the rate of data capture. Only the screen refresh is affected. The figures are still updated as fast as possible, although the figure display will no longer be as close to realtime. The default setting is 0, which shouldn't be a problem on the console. Set it to a slightly higher value on remote terminals or slow links. The setting affects all monitoring facilities. Note Updating the screen is one of the slowest operations in a program. Older versions of IPTraf had a problem once network activity became very high. Because each packet caused a screen update, IPTraf began spending more time with the screen updates, causing a loss of packets once network activity reached a certain point. However, since many users like rapid counts on their screen, a compromise was incorporated. Even when the screen update interval is set to 0, there is still a 50ms delay between screen updates (except the LAN station monitor, which has a 100 ms delay). This is still visually fast, but provides more time to the packet capture routine. Higher delays may result in better accuracy of counts and activity. In any case, this setting only affects screen updates. Capture still proceeds as fast as possible. TCP closed/idle persistence This parameter determines the interval (in minutes) at which the IP Traffic Monitor clears from the TCP display window all closed, idle, and timed out entries. Enter 0 to keep such entries on the screen indefinitely, disappearing only when replaced by new connections. Note The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains onscreen. The TCP closed/idle persistence... parameter flushes entries that have been closed or reset, or idle for the number of minutes defined by the TCP timeout... option. Custom Information The remaining configuration items allow you to enter information which IPTraf uses for its displays and logs. Additional ports Select this item to enter a port number to be included in the TCP/UDP counts in the TCP/UDP service statistics main menu item described above. By default, port numbers above 1023 are not monitored. If you do have a higher-numbered port to monitor, enter it here. You will see two fields. If you have only one port to enter, just fill up the first field. To specify a range, fill both fields, the first port in the first field, the last port in the second field. You can select this option multiple times to add more values or ranges. Delete port/range Select this item to remove a higher-numbered port number or port range you entered earlier with the Additional ports... option. A window will come up containing the entered ports and ranges. Select the entry you want delete and press Enter. LAN Station Identifiers The LAN station statistics facility monitors stations based on their respective MAC addresses. The hexadecimal notation of these addresses make them even more difficult to remember than the dotted-decimal IP addresses, so these facilities were added to help you better determine which station is which. Selecting the Ethernet/PLIP host descriptions... or FDDI/Token Ring host descriptions... options brings up a submenu asking you to add, edit, or delete descriptions. To add a new description, select the Add description... option. A dialog box will appear, asking you for the MAC address and an appropriate description. Type in the address in hexadecimal notation with no punctuation of any kind. The dialog box is case-insensitive for the address; the alphabetical digits A to F will be stored in lowercase. Use the Tab key to move between fields and Enter to accept. Press Ctrl+X to discard this dialog and return to the main menu. The description may be anything: the IP address, a fully-qualified domain name, or a description of your liking as long as the field can hold. Enter as many descriptions as you need. Press Ctrl+X at a blank dialog after you have entered the last entry These descriptions will be displayed alongside the MAC addresses in the LAN station monitor, together with the type of frame (Ethernet, PLIP, or FDDI). An existing address or description may be edited by selecting the Edit description... option from the submenu. A panel will appear with a list of existing address descriptions. Select the one you wish to edit and press Enter. A dialog box identical to that when you add a description will appear with prefilled fields. Just backspace over and edit the fields. Press Enter to accept or Ctrl+X to cancel. Selecting the Delete description... submenu item brings up the selection panel. Select the description you want to delete and press Enter. You can also press Ctrl+X to cancel the operation. IPTraf 2.4 and later also recognizes the /etc/ethers file. Should a hardware address be present in the IPTraf definition files and in /etc/ethers, the IPTraf definition will be used. Note The description file for Ethernet and PLIP is ethernet.desc, while the FDDI and Token Ring mappings are stored in fddi.desc in the IPTraf working directory. These files are in colon-delimited text format. Database engines or custom scripts can be told to append data lines to those files. Each line follows this simple format: address:description For example 00201e457e:Cisco 3640 gateway Do not put colons, periods, or any invalid characters in the MAC address. Background Operation IPTraf's facilities can be placed in the background solely for logging. When running in the background, it doesn't display any output on the screen, and doesn't receive input from the keyboard, and drops you back to the shell. Before starting a statistical facility in the background, configure IPTraf in the usual way (set filters, add TCP/UDP ports, etc). Once that's done, exit all instances of IPTraf on the system, then invoke IPTraf from the command line with the parameter to start the facility you want, the timeout (-t) parameter if you wish, and the -B parameter to actually daemonize the program. For example, to run the IP traffic monitor in the background for all interfaces, issue the command iptraf -i all -B To run the detailed interface statistics on interface eth0 for 5 minutes in the background: iptraf -d eth0 -t 5 -B If the timeout parameter is not specified, the facility will run until the process receives a USR2 signal. To stop a facility in the background, do a ps x at the command line, and find the process id (pid) of the iptraf process you're looking for. Then send that process a USR2 signal with the kill command: kill -USR2 pid Since IPTraf cannot send error messages to the terminal, all messages are written to the file daemon.log in the IPTraf logging directory. The -B parameter automatically enables logging regardless of its configured setting. The parameter is ignored if not used with one of the parameters to start a facility from the command line. The log file can be specified with the -L command-line parameter. If this parameter is not specified, the default log file name for the facility will be used (see the descriptions of the facilities above for the default log name patterns). If you don't specify an path, the log file will be placed in /var/log/iptraf. The logging interval for all facilities (except the IP traffic monitor) can also be overriden with the -I command-line parameter. Messages IPTraf's messages are presented in two ways. In interactive mode, messages are displayed in a distictive message box. In daemon (background) mode, appropriate messages are written to the iptraf.log file in the IPTraf log directory (normally /var/log/iptraf. IPTraf Messages Unable to create config file IPTraf cannot create the configuration file. The most likely cause of this is that you didn't properly install the program, and the necessary directory /var/local/iptraf does not exist. Can also be generated if you have a disk problem or if you have too many files open. Unable to read config file The configuration record cannot be read. You most likely have a disk problem. Unable to write config file The configuration file cannot be written. You either have a disk problem, or (more likely), your disk is full. Enter an appropriate description for this filter Enter something to clearly describe the filter you are defining. Error loading filter list file IPTraf cannot access the list of defined TCP or UDP filters. Can also be an indicator of a bad disk. Error writing filter list file The filter list file cannot be written to. You may have trouble accessing your filters. Unable to read TCP/UDP/misc IP filter file IPTraf cannot read the filter data off the file. Could be caused by a bad disk. Error opening filter data file IPTraf cannot open the filter file. Could be caused by a shortage of file descriptors or a bad disk. Unable to write filter data IPTraf cannot add the newly defined filter to the filter list. This may be due to a bad disk. Cannot create filter data file IPTraf cannot create the filter record file. The defined filter is lost. Unable to save filter changes IPTraf cannot save the changes you made to the filter. You probably have a disk error. Unable to write filter state information The current state of the filters cannot be saved. IPTraf will be unable to correctly reload the filters the next time it's started. This can be caused by a bad disk or improper installation. Unable to save interface flags IPTraf was unable to save the flags of the network interfaces. This is probably due to a bad installation or full filesystem. Unable to retrieve saved interface flags IPTraf was unable to retrieve the save interface flags. Probably again due to a bad installation or full filesystem. protocol filter data file in use; try again later Filter state file in use; try again later Another IPTraf process is modifying the TCP, UDP or miscellaneous IP filter data or the filter state file and has locked the files or file. Try again once the other IPTraf process has terminated or completed its modifications and unlocked the files. Unable to resolve hostname The indicated host name in the filter cannot be resolved into an IP address. Check the local hosts database /etc/hosts or your machine's DNS configuration or DNS server. The filter parameters will not be used. Unable to open host description file IPTraf cannot open the file containing the descriptions for Ethernet or FDDI addresses. Could be due to a bad disk or a hit on the file descriptor limit. Unable to write host description IPTraf was unable to write the description record for this Ethernet or FDDI address. Could be due to a bad disk or corrupted filesystem. No descriptions You tried to edit or delete a description with no previous descriptions defined. Cannot open log file There is a problem opening the log file. There is most likely a problem with the disk, or there are too many open files. Unable to obtain interface list IPTraf was unable to retrieve the list of network interfaces from the /proc filesystem. This may be due to a badly configured kernel. IPTraf needs /proc filesystem support. No active interfaces. Check their status or the /proc filesystem. IPTraf found no active interfaces. Either all interfaces are down or the /proc/net/dev file was empty or unavailable. Activate at least one interface or check the /proc/net/dev file. Unable to obtain interface parameters for interface The system call to retrieve the interface's flags failed. Check your interface or kernel driver. Promisc change failed for interface The system call to change the promiscuous flag failed. Check your interface or its kernel driver. Unable to open raw socket for flag change IPTraf was unable to open the necessary socket for the promiscuous change operation. May be due to a shortage of file descriptors. Unable to open socket for MTU determination Returned by the facility for detailed interface statistics if the raw socket's opening sequence failed. The facility will abort. Unable to open raw socket IPTraf was unable to open the raw socket for packet capture. May be due to a shortage of file descriptors. Reminder IPTraf 2.x.x requires Linux kernel 2.2.x, with the Packet Socket option compiled in or installed as a module. IPTraf 2.x will return this error on a pre-2.2 kernel or on a 2.2 kernel without Packet Socket. Unable to obtain interface MTU The detailed statistics facility was unable to obtain the maximum transmission unit (MTU) for the selected interface. The facility will abort. Specified interface not supported The interface specified with the -i, -d, -s, -l, or -z command-line parameters is not supported by IPTraf. Specified interface not active The interface specified with the -i, -d, -s, -l, or -z command-line parameters is supported, but not currently activated. Fatal: memory allocation error May occur if you have too little memory to allocate for windows, the menu system, or dialog boxes. IPTraf tries to prevent further allocations if memory runs out during a monitor. However, this could also mean a bug if you're reasonably sure you're not out of memory. An instructional message on bug reporting follows this message. Technical note This is actually a response to the segmentation fault error (SIGSEGV). This program can be run only by the system administrator IPTraf normally does not allow anybody but uid 0 (root) to run it. This measure is included for safety reasons. See the section on recompiling the program below if you want to override this. This feature is built in, and not part of the configuration Your TERM variable is not set The TERM (terminal type) environment variable must be set to a valid terminal type so that the screen management routines can function properly. Set it to the appropriate terminal type. Linux consoles typically have their TERM variables set to linux. Received TERM signal Not related to the previous message. The TERM (terminate) signal is normally used to gracefully shut down a program. This message simply indicates that the TERM signal was caught and IPTraf is attempting to shut down as gracefully as possible. Invalid option or missing parameter, use iptraf -h for help The -i, -d, -s, -l, or -z options were specified but no interface was specified on the command line. These parameters require a valid interface name (or all for -i or -l). This message also appears if an unknown option is passed to the iptraf command. Warning: unable to tag this process IPTraf normally tags itself when it runs to prevent multiple instances of the statistical facilities from running. This message means the program was unable to create the necessary tag file. This may be due to a bad or improper installation. Try running the make install procedure or the Setup in the distribution's top-level directory. Warning: unable to tag facility IPTraf was unable to create the tag file for the facility you started. The facility will still run, but other instances of IPTraf that may be running simultaneously will allow the same facility to run. This may cause both instances of the facility to malfunction. This could be due to a bad disk or bad installation. facility already running/listening on interface The facility you tried to start is currently running on the indicated interface in another IPTraf process on the machine. This restriction is placed to prevent conflicts involving internal sockets or the log files. General interface statistics already active in another process Only one instance of the general interface statistics can run at a time. Duplicate port/range entry You entered a port number or range that was already added to the list of additional ports to be monitored by the TCP/UDP service monitor No custom ports There are no ports or port ranges earlier added. There's nothing to delete. Can't start rvnamed; lookups will block IPTraf cannot start the rvnamed daemon; probably due to a bad installation. IPTraf will fall back to blocking lookups. Can't spawn new process; lookups will block IPTraf cannot start a new process. This may be due to memory shortage. IPTraf will fall back to blocking lookups. Fork error, IPTraf cannot run in background IPTraf cannot start a new process, and can go into the background. This may be due to memory shortage. IPTraf aborts. No memory for new filter entry IPTraf was unable to allocate memory for a new filter entry. Most likely due to memory shortage. Memory Low This indicator appears if memory runs low due to a lot of entries in a facility. Should critical functions fail (window creation, internal allocation), the program could terminate with a segmentation violation. Note Any message or indicator about low memory means that your system does not have enough memory to handle the entries. It is almost certain that sooner or later, IPTraf or other applications will abort due to the failure of important system calls or library functions. Memory must be added right away. IPC Error This indicator appears if an error occurs receiving data from the rvnamed program (IPC stands for Interprocess Communication). This indication should not occur under normal circumstances. Report instances of this condition and the circumstances under which it happens. You may also include data from the rvnamed.log file. Error opening terminal: terminal The screen management routines cannot find the terminfo entry for your terminal. IPTraf expects the terminfo database located in /usr/share/terminfo. This error could occur when your terminfo database is located somewhere else. See the section on controlling the terminfo search path. This will end your IPTraf session In interactive mode IPTraf asks you to confirm your exit command. Press Enter to return to the shell or any other key to cancel your command and return to the main menu. rvnamed Messages As a daemon, rvnamed does not send messages to the screen. It writes its messages to the file rvnamed.log in the IPTraf log directory. Unable to open child communication socket rvnamed was unable to open the communication endpoint for data reception from the children it creates. This is highly unusual, and should it occur, report the circumstances. Unable to open client communication socket rvnamed was unable to open the communication endpoint for data exchange with the IPTraf program. This is highly unusual, and should it occur, report the circumstances. Error binding client communication socket Error binding child communication socket rvnamed was unable to assign a name to the indicated communication socket. This may be due to a bad, full, or corrupted filesystem. Fatal error: no memory for descriptor monitoring rvnamed ran out of memory. IPTraf will resort to blocking, and may freeze. Error on fork, returning IP address rvnamed had a problem spawning a copy of itself to resolve the IP address. rvnamed will simply return the IP address in its literal, dotted-decimal notation. IPTraf will still function normally. This may be due to lack of memory or a process limit hit. Maximum child process limit reached rvnamed has reached its maximum number of child processes. This is intended as a "brake" to prevent too many rvnamed children from hogging your computer's resources and possibly crashing it. Unless IPTraf is monitoring an extremely busy network without filters, this shouldn't happen, at least, not that often. If you notice this message, try applying filters or check your DNS server. Many times, this can happen when the DNS server goes down for whatever reason, and you have rvnamed children taking too long to resolve. GNU Free Documentation License Version 1.1, March 2000
Copyright (C) 2000 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
PREAMBLE The purpose of this License is to make a manual, textbook, or other written document "free" in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others. This License is a kind of "copyleft", which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software. We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference. APPLICABILITY AND DEFINITIONS This License applies to any manual or other work that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. The "Document", below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as "you". A "Modified Version" of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language. A "Secondary Section" is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document's overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (For example, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them. The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License. The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License. A "Transparent" copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, whose contents can be viewed and edited directly and straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup has been designed to thwart or discourage subsequent modification by readers is not Transparent. A copy that is not "Transparent" is called "Opaque". Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML designed for human modification. Opaque formats include PostScript, PDF, proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML produced by some word processors for output purposes only. The "Title Page" means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, "Title Page" means the text near the most prominent appearance of the work's title, preceding the beginning of the body of the text. VERBATIM COPYING You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3. You may also lend copies, under the same conditions stated above, and you may publicly display copies. COPYING IN QUANTITY If you publish printed copies of the Document numbering more than 100, and the Document's license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects. If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages. If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a publicly-accessible computer-network location containing a complete Transparent copy of the Document, free of added material, which the general network-using public has access to download anonymously at no charge using public-standard network protocols. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public. It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document. MODIFICATIONS You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version: Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission. List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has less than five). State on the Title page the name of the publisher of the Modified Version, as the publisher. Preserve all the copyright notices of the Document. Add an appropriate copyright notice for your modifications adjacent to the other copyright notices. Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below. Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document's license notice. Include an unaltered copy of this License. Preserve the section entitled "History", and its title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section entitled "History" in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence. Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the "History" section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission. In any section entitled "Acknowledgements" or "Dedications", preserve the section's title, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein. Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles. Delete any section entitled "Endorsements". Such a section may not be included in the Modified Version. Do not retitle any existing section as "Endorsements" or to conflict in title with any Invariant Section. If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version's license notice. These titles must be distinct from any other section titles. You may add a section entitled "Endorsements", provided it contains nothing but endorsements of your Modified Version by various parties--for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard. You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one. The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version. COMBINING DOCUMENTS You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice. The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work. In the combination, you must combine any sections entitled "History" in the various original documents, forming one section entitled "History"; likewise combine any sections entitled "Acknowledgements", and any sections entitled "Dedications". You must delete all sections entitled "Endorsements." COLLECTIONS OF DOCUMENTS You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects. You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document. AGGREGATION WITH INDEPENDENT WORKS A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, does not as a whole count as a Modified Version of the Document, provided no compilation copyright is claimed for the compilation. Such a compilation is called an "aggregate", and this License does not apply to the other self-contained works thus compiled with the Document, on account of their being thus compiled, if they are not themselves derivative works of the Document. If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one quarter of the entire aggregate, the Document's Cover Texts may be placed on covers that surround only the Document within the aggregate. Otherwise they must appear on covers around the whole aggregate. TRANSLATION Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License provided that you also include the original English version of this License. In case of a disagreement between the translation and the original English version of this License, the original English version will prevail. TERMINATION You may not copy, modify, sublicense, or distribute the Document except as expressly provided for under this License. Any other attempt to copy, modify, sublicense or distribute the Document is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. FUTURE REVISIONS OF THIS LICENSE The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/copyleft/. Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License "or any later version" applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation. How to use this License for your documents To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:
Copyright (c) YEAR YOUR NAME. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being LIST THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST. A copy of the license is included in the section entitled "GNU Free Documentation License".
If you have no Invariant Sections, write "with no Invariant Sections" instead of saying which ones are invariant. If you have no Front-Cover Texts, write "no Front-Cover Texts" instead of "Front-Cover Texts being LIST"; likewise for Back-Cover Texts. If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software. iptraf-ng-1.1.4/Documentation/manual.template0000664000076400007640000052033112173477702021527 0ustar npajkovsnpajkovs IPTraf User's Manual Version @@version@@ 1997 2003 Gerard Paul Java This manual is released under the terms of the GNU Free Documentation License of March, 2000 as published by the Free Software Foundation, reproduced in this manual as Appendix B. IPTraf is open-source software released under the terms of the GNU General Public License version 2 or any later version as published by the Free Software Foundation, reproduced in the LICENSE file in the distribution's top-level directory. The accomanying software and the information contained in this document are provided "AS IS" without warranty of any kind, express or implied, including, without limitation, the implied warranties of mercantability or fitness for any particular purpose. In no event shall the author be liable for any indirect, special, consequential, or incidental damages arising from the use of this manual or the accompanying software even if the author has been advised of the possibility of such damages. Linux is a registered trademark of Linus Torvalds. Pentium is a registered trademark of Intel Corporation. All other trademarks are property of their respective owners. Some structure declarations were based on code copyrighted by the Regents of the University of California. Token Ring parsing code based on the Token Ring packet construction code in the Linux 2.2 kernel. About This Document This document contains the instructions on how to use the IPTraf network monitoring software version @@major@@. This manual details the different statistical facilities, the user interface, and the important features of the software. For Additional Information See the included README file for summarized and late-breaking information. Also read the RELEASE-NOTES file for important new information about this new version. The CHANGES file contains a record of the changes made to the software since 1.0.0. README.rvnamed contains information on the rvnamed reverse resolution program. See the other README files for support and development information. Document Conventions The following symbols and typefaces are used throughout this manual: [ ] items in brackets are optional. Brackets also denote items that may or may not be displayed onscreen depending on settings or conditions. { } curly braces enclose items you choose from | the vertical bar separates choices in curly braces normal monospace normal monospace text in syntax specifications should be typed in exactly as presented. Because UNIX and variants are case-sensitive, case must be preserved. Monospace is also used in presenting items that appear on the screen. monospace italics italics in syntax specifications indicate items that are to be replaced with an actual item (e.g. interface should be replaced with an actual interface name, like eth0). Additional information appears distinctively set apart from the main text. This information includes Notes, Tips, or Technical Notes. Notes are additional pieces of information that may be useful or may clarify the preceeding paragraphs of the manual. Tips provide shortcuts, clarify tasks that may not be immediately obvious, or provide references to additional sources of information. Technical notes are explanations of a more technical nature and may be of more use to programmers and advanced users. Getting Started About IPTraf IPTraf is a network monitoring utility and traffic analyzer for IP networks. It intercepts packets and returns data about captured the network traffic in various statistical facilities. IPTraf comes with these major features: An IP traffic monitor that shows TCP connection information (hosts, packet/byte counts, flags, window sizes), and color-coded information about other IP packets Statistics (counts and load rates) for network interfaces in general and detailed views Statistics per TCP/UDP port Statistical breakdown according to packet sizes A LAN host monitor that returns counts and loads per detected MAC address A powerful filtering system for users to view only interesting traffic Logging An asynchronous DNS resolver for the IP traffic monitor A text-based, full-color, menu-driven user interface suitable for use on all Linux systems with terminals, especially Linux consoles and color xterms Easy configuration Fully software-based. No additional hardware required Basic knowledge of the important TCP/IP protocols (IP, TCP, UDP, ICMP, etc.) is necessary for you to best understand the information generated by the program. Installation IPTraf is most readily available on the Internet, but some may receive it on a diskette. Here are the instructions for both types of distributions. System Requirements IPTraf requires: Hardware Requirements 16 megabytes of physical RAM (more recommended, at least 64 MB for very busy networks) 2 megabytes of free disk space for installation (more will be needed if you log high amounts of traffic over time) Pentium-class processor or higher (Pentium-II 200 MHz or higher recommended) or equivalent. One or more of the supported network interfaces. Operating System Requirements Linux kernel 2.2.0 or higher GNU C Library 2.1 or later ncurses 4.2 or later with the complete terminfo database in /usr/share/terminfo. Support for linux, vt100, xterm, xterm-color recommended. Compilation Requirements The following components are required when compiling IPTraf from the source code. gcc 2.7.2.3 or later GNU C (glibc) development library 2.1 or later ncurses development libraries 4.2 or later Availability IPTraf can be downloaded from the Internet from the official FTP site at ftp://iptraf.seul.org/pub/iptraf/ . The software is available in source form in compressed .tar.gz files named iptraf-x.y.z.tar.gz where x.y.z is the version number. Precompiled ready-to-run software is available in the iptraf-x.y.z.machinetype.bin.tar.gz files. (machinetype indicates what platform the precompiled binaries run on. The official distribution will only be for the Intel x86 architecture indicated as i386.) Installing Downloaded Packages You will need to have GNU tar and GNU zip installed. All modern Linux installations already have these utilities ready. Decompress the .tar.gz file by entering tar zxvf iptraf-x.y.z.tar.gz for the source code or tar zxvf iptraf-x.y.z.i386.bin.tar.gz for the precompiled x86 programs. If your tar doesn't support the z option, you can separately decompress the .tar.gz file then extract the resulting .tar archive. gunzip iptraf-x.y.z.tar.gz tar xvf iptraf-x.y.z.tar This will decompress the sources into a directory called iptraf-x.y.z (source code) or iptraf-x.y.z.bin (precompiled). (x.y.z here should be the IPTraf version number you're installing, like @@version@@). Change to the created top level directory. To compile and install the software, run the Setup program by entering ./Setup while you are logged in as root. The Setup script will recognize the source distribution and compile the software before installing. It will immediately install a precompiled distribution. The resulting binaries will be placed in the /usr/local/bin directory. All needed directories will also be created. After installation, you will be asked if you want to read the RELEASE-NOTES file. It is recommended that you do so at that point, since the RELEASE-NOTES file contains important information about the new version. Installing a Floppy Distribution If you received IPTraf on a diskette, the sources are already decompressed. The diskette is in Second Extended filesystem format. Perform the following steps to install the software. Insert the floppy in the drive. Mount the floppy on an empty directory. For example, to mount the floppy in the first floppy drive under a directory called /mnt, enter mount -t ext2 /dev/fd0 /mnt This assumes your floppy is in /dev/fd0. You can use any empty directory in place of /mnt. With most Linux installations, this will work fine. After mounting, change to the /mnt (or whatever) directory. Enter ./Setup while logged in as root. Setup will determine whether the diskette contains a source code distribution or ready-to-run precompiled software. This will copy the binaries to /usr/local/bin, and create the necessary working directories. Unmount the diskette by typing umount /mnt (That's umount, not unmount.) You can then eject the diskette. Store it in a safe place. You will also be asked if you want to view the RELEASE-NOTES file. It is recommended that you do so at that point. In both cases (downloaded and floppy), the installation will store the program in /usr/local/bin with the binaries owned by user root, readable, writable, and executable by the owner, no permissions for the group, no permissions for all others. (700 octal, or -rwx------). Note You must be root to do the installation. The old style of installation (cd src;make install) is still supported. Be sure /usr/local/bin is included in your environment's PATH variable. You can edit the appropriate command in your login customization file (.profile for the Bourne-type shells, .cshrc for the C shell and its relatives). Upgrading from Earlier Versions IPTraf 3.0 is a major revision from IPTraf 2.7. The filter subsystem has been completely redesigned and as such, is incompatible with previous filter formats. Therefore old IPTraf filters can no longer be used. The installation procedure for IPTraf 3.0 will rename the filter list files but not delete them. If you install a distribution package (e.g. RPM, dpkg), old filters may still appear in the filter selection list but the new IPTraf version will be unable to load them. Starting and Stopping IPTraf After installation, you can start the program by simply entering iptraf at the shell prompt. You will see a copyright notice, with an instruction to press any key to get started. Just press any character key, and you will be immediately taken to the main menu. All major functions of the program are found there. Entering the IPTraf command without any command-line parameters brings up the program's main menu. From there, you can select the facilities you want. IPTraf determines and makes use of the maximum number of lines and columns on the terminal. Note IPTraf does not have a SIGWINCH handler; it does not adjust itself when an xterm or some other X terminal is resized. Technical note IPTraf needs to refer to the terminfo database in /usr/share/terminfo. If the supplied executable program fails with Error opening terminal, your terminfo database may be located somewhere else. You can control the terminfo search path by using the TERMINFO environment variable. For example, if you're using the sh or bash shell, and your terminfo database is in /usr/lib/terminfo (typical for Slackware distributions), you can use the commands: TERMINFO=/usr/lib/terminfo export TERMINFO You can place these commands in your ~/.profile or the systemwide /etc/profile startup files. You can also create a symbolic link named /usr/share/terminfo to let it point to your existing terminfo (assuming again your terminfo is in /usr/lib/terminfo): ln -s /usr/lib/terminfo /usr/share/terminfo Or you can recompile your program to use your existing ncurses library installation. If you do this, make sure you have ncurses 4.2 or later. Command-line Options IPTraf has a few optional command-line parameters. As with most UNIX commands, IPTraf command-line parameters are case-sensitive (-l is NOT the same as -L). The following command-line parameters can be supplied to the iptraf command: -i iface causes the IP traffic monitor to start immediately on the specified interface. If -i all is specified, all interfaces are monitored. -g starts the general interface statistics -d iface shows detailed statistics for the specified interface -s iface starts the TCP/UDP traffic monitor for the specified interface -z iface starts the packet size breakdown for the specified interface -l iface starts the LAN station monitor on the specified interface. If -l all is specified, all LAN interfaces are monitored. -t timeout The -t parameter, when used with one of the other parameters that specify a facility to start, tells IPTraf to run the indicated facility for only timeout minutes, after which the facility exits. The -t parameter is ignored in menu mode. If this parameter is not specified, the facility runs until the exit keystroke is pressed. -B Redirects all terminal output to the "bit bucket" /dev/null, closes standard input, and places the program in the background. This parameter can be used only with one of the -i, -g, -d, -s, -z, or -l parameters. See Background Operation in Chapter 9. -B is ignored in menu mode. -L filename Allows you to specify an alternate log file name when the any facility is directly started from the command line, whether in foreground or background mode. If specified in foreground mode, the log filename prompt is bypassed, even when logging is turned on in the Configure... menu. If this parameter is omitted in background mode, the default log filename is used. This parameter always turns on logging. If an absolute path is not specified, the log file will be created in the default log file directory -I interval Sets the logging interval (in minutes) when the -L parameter is used. This overrides the Log interval... setting in the Configure... menu. If omitted, the configured value is used. This parameter is ignored when the -L parameter is omitted and logging is disabled. The value specified here will affect all facilities except for the IP traffic monitor. -q Previously used to suppress the warning screen when IPTraf is run on kernels with IP masquerading. Since the masquerading code now processes packets in a way better suited to raw capture, this parameter is no longer needed and is retained only for compatibility. -f Forces IPTraf to clear all lock files and reset all instance counters to zero before running any facilities. IPTraf will then think it's the first instance of itself. The -f parameter overrides the existing locks and counters imposed by the IPTraf process and by the various facilities, causing this instance to think it is the first and that there are no other facilities running. Use this parameter with great caution. A common use for this parameter is to recover from abrupt or abnormal terminations which may leave stale locks and counters still lying around. The -f parameter may be used together with the others. iptraf -h displays a short help screen While the command-line options are case-sensitive, interactive keystroke at the IPTraf full-screen interface are not. Using the Menus Menu items with a trailing ellipsis (...) either pop up a submenu with further items, or require additional information before it can complete the task and return to the menu. Menu items without an ellipsis execute immediately. Use the Up and Down arrow keys on your keyboard to move the selection bar. Press Enter to execute the selected item. Alternatively, you can also directly press the highlighted letter of the item you want. This will immediately execute the option.
The IPTraf Main Menu
Exiting IPTraf You can exit IPTraf with the Exit command in the main menu. When started with one of the command-line options to directly start a statistical facility, pressing X or Q will exit the facility directly, without any confirmation. The -t command-line parameter will automatically exit the facility after the specified length of time without any confirmation as well. Daemon facilities started with the -B parameter will immediately terminate after being sent a USR2 signal. See background operation in chapter 9 for more information. Preparing to Use IPTraf This chapter provides information applicable to all of IPTraf's statistical monitors. Number Display Notations IPTraf initially returns exact counts of bytes and packets. However, as they grow larger, IPTraf begins displaying them in increasingly higher denominations. A number standing alone with no suffix represents an exact count. A number with a K following is a kilo (thousand) figure. An M, G, and T suffix represents mega (million), giga (billion), and tera (trillion) respectively. The following table shows examples. Numeric Display Notations 1024067exactly 1024067 1024Kapproximately 1024000 1024Mapproximately 1024000000 1024Gapproximately 1024000000000 1024Tapproximately 1024000000000000
These notations apply to both packet and byte counts. Instances and Logging Since version 2.4, IPTraf allows multiple instances of the facilities at the same time in different processes (for example, you can now run two or more IP Traffic Monitors at the same time). However only one can listen on a specific interface or all interfaces at once. The only exception is the general interface statistics, which is still restricted to only one instance at a time. Because of this relaxation, each instance now generates log files with unique names for instances, depending on either their instance or the interface they're listening on. If the Logging option is turned on (see the Configuration chapter), IPTraf will prompt you for a log file name while presenting a default. You may accept this default or change it. Press Enter to accept, or Ctrl+X to cancel. Canceling will turn logging off for that particular session. If you don't specify an absolute path, the log file will be placed in /var/log/iptraf.
The logfile prompt dialog
See the Logging section in the Configuration chapter for detailed information on logging. See also the documentation on each statistical facility for the default log file names. The default log file names will also be used if the -B parameter is used to run IPTraf in the background. You can override the defaults with the -L parameter. See Background Operation in Chapter 9. Screen Update Delays Older versions of IPTraf updated the screen as soon as a packet was received. However, screen update is one of the slowest operations the program performs. Since version 1.3, a configuration option has been available to control screen update speed. See the Screen update interval... configuration option under the Configuration chapter of this manual. Supported Network Interfaces IPTraf currently supports the following network interface types and names. lo The loopback interface. Every machine has one, and has an IP address of 127.0.0.1. lo is also indicated if data is detected on the dummyn interface(s). ethn An Ethernet interface. n starts from 0. Therefore, eth0 refers to the first Ethernet interface, eth1 to the second, and so on. Most machines only have one. fddin An FDDI interface. n starts from 0. trn A Token Ring interface, where n starts from 0. pppn A PPP interface. n starts from 0. slin A SLIP interface. n starts from 0. plipn PLIP interfaces. These are point-to-point IP connections using the PC parallel port. ipsecn This refers to Free s/WAN (and possibly other) logical VPN interfaces. sbnin SBNI long-range modem interfaces dvbn, sm200, sm300 DVB satellite-receive interfaces wlann, wvlann Wireless LAN interfaces tunn general logical tunnel interfaces brgn general logical bridge interfaces hdlcn Frame Relay base (FRAD) interfaces (non-PVC) pvcn Frame Relay Permanent Virtual Circuit interfaces Your system's network interfaces must be named according to the schemes specified above. The IP Traffic Monitor Executing the first menu item or specifying -i to the iptraf command takes you to the IP traffic monitor. The traffic monitor is a real-time monitoring system that intercepts all packets on all detected network interfaces, decodes the IP information on all IP packets and displays the appropriate information, most notably the source and destination addresses. It also determines the encapsulated protocol within the IP packet, and displays some important information about that as well. There are two windows in the traffic monitor, both of which can be scrolled with the Up and Down cursor keys. Just press W to move the Active indicator to the window you want to control.
The IP traffic monitor
The Upper Window The upper window of the traffic monitor displays the currently detected TCP connections. Information about TCP packets are displayed here. The window contains these pieces of information: Source address and port Packet count Byte count Source MAC address Packet Size Window Size TCP flag statuses Interface Note Previous versions of IPTraf showed both the source and destination addresses on each line. IPTraf 2 and higher show only the source host:port combination to save on screen real estate. TCP connection endpoints are still indicated with the green brackets (on color terminals) along the left edge of the screen. The Up and Down cursor keys move an indicator bar between entries in the TCP monitor, scrolling the window if necessary. The PgUp and PgDn keys display the previous and next screenfuls of entries respectively. The IP traffic monitor computes the data flow rate of the currently highlighted TCP flow and displays it on the lower-right corner of the screen. The flow rate is in kilobits or kilobytes per second depending on the Activity mode switch in the Configure... menu. Because this monitoring system relies solely on packet information, it does not determine which endpoint initiated the connection. In other words, it does not know which endpoints are the client and server. This is necessary because it can operate in promiscuous mode, and as such cannot determine the socket statuses for other machines on the LAN. However, a little knowledge of the well-known TCP port numbers can give a good idea about which address is that of the server. The system therefore displays two entries for each connection, one for each direction of the TCP connection. To make it easier to determine the direction pairs of each connection, a bracket is used to "join" both together. This bracket appears at the leftmost part of each entry. Just because a host entry appears at the upper end of a connection bracket doesn't mean it was the initiator of the connection. Each entry in the window contains these fields: Source address and port The source address and port indicator is in address:port format. This indicates the source machine and TCP port on that machine from which this data is coming. The destination is the host:port at the other end of the bracket. Packet count The number of packets received for this direction of the TCP connection Byte count The number of bytes received for this direction of the TCP connection. These bytes include total IP and TCP header information, in addition to the actual data. Data link header (e.g. Ethernet and FDDI) data are not included. Source MAC address The address of the host on your local LAN that delivered this packet. This can be viewed by pressing M once if Source MAC addrs in traffic monitor is enabled in the Configure... menu. Packet Size The size of the most recently received packet. This item is visible if you press M for more TCP information. This is the size of the IP datagram only, not including the data link header. Window Size The advertised window size of the most recently received packet. This item is visible if you press M for more TCP information. Flag statuses The flags of the most recently received packet. S SYN. A synchronization is taking place in preparation for connection establishment. If only an S is present (S---) the source is trying to initiate a connection. If an A is also present (S-A-), this is an acknowledgment of a previous connection request, and is responding. A ACK. This is an acknowledgment of a previously received packet P PSH. A request to push all data to the top of the receiving queue U URG. This packet contains urgent data RESET RST. The source machine indicated in this direction reset the entire connection. The direction entries for reset connections become available for new connections. DONE The connection is done sending data in this direction, and has sent a FIN (finished) packet, but has not yet been acknowledged by the other host. CLOSED The FIN has been acknowledged by the other host. When both directions of a connection are marked CLOSED, the entries they occupy become available for new connection entries. - The flag is not set Some other pieces of information can be viewed as well. The M key displays more TCP information. Pressing M once displays the MAC addresses of the LAN hosts that delivered the packets (if the Source MAC addrs in traffic monitor option is enabled in the Configure... menu). N/A is displayed if no packets have been received from the source yet, or if the interface doesn't support MAC addresses (such as PPP interfaces). If the Source MAC addrs in traffic monitor option is not enabled, pressing M simply toggles between the counts and the packet and window sizes. By default, only IP addresses are displayed, but if you have access to a name server or host table, you may enable reverse lookup for the IP addresses. Just enable reverse lookup in the Configure... menu. The rvnamed Process The IP traffic monitor starts a daemon called rvnamed to help speed up reverse lookups without sacrificing too much keyboard control and accuracy of the counts. While reverse lookup is being conducted in the background, IP addresses will be used until the resolution is complete. If for some reason rvnamed cannot start (probably due to improper installation or lack of memory), and you are on the Internet, and you enable reverse lookup, your keyboard control can become very slow. This is because the standard lookup functions do not return until they have completed their tasks, and it can take several seconds for a name resolution in the foreground to complete. rvnamed will spawn up to 200 children to process reverse DNS queries. Tip If you notice unusual SYN activity (too many initial (S---) but frozen SYN entries, or rapidly increasing initial SYN packets for a single connection), you may be under a SYN flooding attack or TCP port scan. Apply appropriate measures, or the targeted machines may begin denying network services. Entries not updated within a user-configurable amount of time may get replaced with new connections. The default time is 15 minutes. This is regardless of whether the connection is closed or not. (Some unclosed connections may be due to extremely slow links or crashes at either end of the connection.) This figure can be changed at the Configure... menu. Some early entries may have a > symbol in front of its packet count. This means the connection was already established when the monitor started. In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. Eventually, these > entries will close (or time out) and disappear. TCP entries without the > were initiated after the traffic monitor started, and the counts indicate the totals of the connection itself. Just consider entries with > partial. Some > entries may go idle if the traffic monitor was started when these connections were already half-closed (FIN sent by one host, but data still being sent by the other). This is because the traffic monitor cannot determine if a connection was already half-closed when it started. These entries will eventually time out. (To minimize these entries, an entry is not added by the monitor until a packet with data or a SYN packet is received.) Direction entries also become available for reuse if an ICMP Destination Unreachable message is received for the connection. The lower part of the screen contains a summary line showing the IP, TCP, UDP, ICMP, and non-IP byte counts since the start of the monitor. The IP, TCP, UDP, and ICMP counts include only the IP datagram header and data, not the data-link headers. The non-IP count includes the data-link headers. Technical note: IP Forwarding and Masquerading Previous versions of IPTraf issued a warning if the kernel had IP masquerading enabled due to the way the kernel masqueraded and translated the IP addresses. The new kernels no longer do it as before and IPTraf now gives output properly on masquerading machines. The -q parameter is no longer required to suppress the warning screen. On forwarding (non-masquerading) machines packets and TCP connections simply appear twice, one each for the incoming and outgoing interfaces if all interafaces are being monitored. On masquerading machines, packets and connections from the internal network to the external network also appear twice, one for the internal and external interface. Packets coming from the internal network will be indicated as coming from the internal IP address that sourced them, and also as coming from the IP address of the external interface on your masquerading machine. In much the same way, packets coming in from the external network will look like they're destined for the external interface's IP address, and again as destined for the final host on the internal network. Closed/Idle/Timed Out Connections A TCP connection entry that closes, gets reset, or stays idle too long normally gets replaced with new connections. However, if there are too many of these, active connections may become interspersed among closed, reset, or idle entries. IPTraf can be set to automatically remove all closed, reset, and idle entries with the TCP closed/idle persistence... configuration option. You can also press the F key to immediately clear them at any time. Note The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains on-screen. The TCP closed/idle persistence... parameter flushes entries that have been idle for the number of minutes defined by the TCP timeout... option. Sorting TCP Entries The TCP connection entries can be sorted by pressing the S key, then by selecting a sort criterion. Pressing S will display a box showing the available sort criteria. Press P to sort by packet count, B to sort by byte count. Pressing any other key cancels the sort. The sort operation compares the larger values in each connection entry pair and sorts the counts in descending order. Over time, the entries will go out of order as counts proceed at varying rates. Sorting is not done automatically so as not to degrade performance and accuracy.
The IP traffic monitor sort criteria
Lower Window The lower window displays information about the other types of traffic on your network. The following protocols are detected internally: User Datagram Protocol (UDP) Internet Control Message Protocol (ICMP) Open Shortest-Path First (OSPF) Interior Gateway Routing Protocol (IGRP) Interior Gateway Protocol (IGP) Internet Group Management Protocol (IGMP) General Routing Encapsulation (GRE) Layer 2 Tunneling Protocol (L2TP) IPSec AH and ESP protocols (IPSec AH and IPSec ESP) Address Resolution Protocol (ARP) Reverse Address Resolution Protocol (RARP) Other IP protocols are looked up from the /etc/services file. If /etc/services doesn't contain information about that protocol, the protocol number is indicated. Non-IP packets are indicated as Non-IP in the lower window. Note The source and destination addresses for ARP and RARP entries are MAC addresses. Strictly speaking, ARP and RARP packets aren't IP packets, since they are not encapsulated in an IP datagram. They're just indicated because they are integral to proper IP operation on LANs. For all packets in the lower window, only the first IP fragment is indicated (since that contains the header of the IP-encapsulated protocol) but with no further information from the encapsulated protocol. UDP packets are also displayed in address:port format while ICMP entries also contain the ICMP message type. For easier location, each type of protocol is color-coded (only on color terminals such as the Linux console). UDPRed on White ICMPYellow on Blue OSPFBlack on Cyan IGRPBright white on Cyan IGPRed on Cyan IGMPBright green on Blue GREBlue on white ARPBright white on Red RARPBright white on Red Other IPYellow on red Non-IPYellow on Red The lower window can hold up to 512 entries. You can scroll the lower window by using the W key to move the Active indicator to it, and by using the Up and Down cursor keys. The lower window automatically scrolls every time a new entry is added, and either the first entry or last entry is visible. Upon reaching 512 entries, old entries are thrown out as new entries are added. Some entries may be too long to completely fit in a screen line. You can use the Left and Right cursor keys to vertically scroll the lower window when it is marked Active. If your terminal can be resized (e.g. xterm), you may do so before starting IPTraf. Entries for packets received on LAN interfaces also include the source MAC address of the LAN host which delivered it. This behavior is enabled by turning on the Source MAC addrs in traffic monitor toggle in the Configure... menu. Entry Details In general, the entries in the lower window indicate the protocol, the IP datagram size (full frame size for non-IP, including ARP and RARP), the source address, the destination address, and the network interface the packet was detected on. However, some protocols have a little more information. ICMP ICMP entries are displayed in this format: ICMP type [(subtype)] (size bytes) from source to destination [(src HWaddr srcMACaddress)] on interface where type could be any of the following: echo req, echo rply ICMP echo request and reply. Usually used by the ping program and other network monitoring and diagnostic program. dest unrch ICMP destination unreachable. Something failed to reach its target. The dest unreach type is supplemented with a further indicator of the problem. Destination unreachable messages for TCP traffic causes the corresponding TCP entry in the upper window to be made available for reuse by new connections. redirct ICMP redirect. Usually generated by a router to tell a host that a better gateway is available. src qnch The ICMP source quench is used to stop a host from transmitting. It's a flow control mechanism for IP. time excd Indicates a packet's time-to-live value expired before it got to its destination. Mostly happens if a destination is too far away. Also used by the traceroute program. router adv ICMP router advertisement router sol ICMP router solicitation timestmp req ICMP timestamp request timestmp rep ICMP timestamp reply info req ICMP information request info rep ICMP information reply addr mask req ICMP address mask request addr mask rep ICMP address mask reply param prob ICMP parameter problem bad/unknown An unrecognized ICMP packet was received, or the packet is corrupted. The destination unreachable message also includes information on the type of error encountered. Here are the destination unreachable codes: ntwk network unreachable host host unreachable proto protocol unreachable port port unreachable pkt fltrd packet filtered (normally by an access rule on a router or firewall) DF set the packet has to be fragmented somewhere, but its don't fragment (DF) bit is set. src rte fail source route failed src isltd source isolated (obsolete) net comm denied network communication denied host comm denied host communication denied net unrch for TOS network unreachable for specified IP type-of-service host unrch for TOS host unreachable for specified IP type-of-service prec violtn precedence violation prec cutoff precedence cutoff dest net unkn destination network unknown dest host unkn destination network unknown For more information on ICMP, see RFC 792. OSPF OSPF messages also include a little more information. The format of an OSPF message in the window is: OSPF type (a=area r=router) (sizebytes) from source to destination [(src HWaddr srcMACaddress)] on interface The type can be one of the following: hlo OSPF hello. Hello messages establish OSPF communications and keep routers informed of each other's presence. DB desc OSPF Database Description LSR OSPF Link State Request LSU OSPF Link State Update. Messages indicating the states of the OSPF network links LSA OSPF Link State Acknowledgment The entries in parentheses: a=area The area number of the OSPF message r=router The IP address of the router that generated the message. It is not necessarily the same as the source address of the encapsulating IP packet. Many times, the destination addresses for OSPF packets are class D multicast addresses in standard dotted decimal notation or (if reverse lookup is enabled), hosts under the MCAST.NET domain. Such multicast addresses are defined as follows: 224.0.0.5 (OSPF-ALL.MCAST.NET) OSPF all routers 224.0.0.6 (OSPF-DSIG.MCAST.NET) OSPF all designated routers See RFC 1247 for details on the OSPF protocol. Additional Information When started from the main menu and logging is enabled, the IP traffic monitor prompts you for a log file name. The default name is ip_traffic-n.log (where n is what instance of the traffic monitor this is (1, 2, 3, and so on). (e.g. if this is the first instance, the default file name will be ip_traffic-1.log.) When started with the -i parameter, the log filename can be specified with the -L parameter. See the Command-line Parameters section above for more information. On busy networks, the display may become cluttered with traffic you're not interested in. To control the traffic monitor's output, you can apply a filter. See Chapter 7, Filters for more information on IPTraf's filters. At any time, you can press X or Q to return to the main menu (or back to the shell if the monitor was started with iptraf -i). Network Interface Statistics There are two network interface statistics facilities: the general interface statistics, which displays a statistical summary of all attached interfaces, and the detailed interface statistics, which shows more statistical and load information about a single selected interface. General Interface Statistics The second menu option displays a list of attached network interfaces, and some general packet counts. Specifically, it displays counts of IP, non-IP, and bad IP packets (packets with IP checksum errors). It also includes an activity indicator, which shows the number of kilobits and packets the interface sees per second. All figures are for incoming and outgoing packets. (Again, considering promiscuous mode for LAN interfaces, which simply causes the machine to intercept all packets). This is useful for general monitoring of all attached interfaces. If byte counts and additional information are needed for a specific interface, the Detailed interface statistics option is also available. The activity indicators can be toggled between kbits/s and kbytes/s with the Activity mode configuration option. The general statistics window will dynamically add new entries as packets from newly-created interfaces (e.g. new PPP interfaces) are intercepted. Long lists can be scrolled with the Up, Down, PgUp, and PgDn keys. This monitor is affected by IPTraf's filters as described in Chapter 7. Copies of the statistics are written to the log file iface_stats_general.log at regular intervals if logging is enabled. See the Logging option int the Configuration chapter. This facility can be started directly from the command line with the -g option to the iptraf command. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.
The general interface statistics screen
You can press X or Q to return to the main menu. Detailed Interface Statistics The third menu option displays packet statistics for any selected interface. It provides basically the same information as the General interface statistics option, with additional details. This facility provides the following information: Total packet and byte counts IP packet and byte counts TCP packet and byte counts UDP packet and byte count ICMP packet and byte counts Other IP-type packet and byte counts Non-IP packet and byte counts Checksum error count Interface activity Broadcast packet and byte counts All IP byte counts (IP, TCP, UDP, ICMP, other IP) include IP header data and payload. The data link header is not included. The full frame length (including data-link header) is included in the non-IP and Total byte count. All data-link headers are also included in the Total byte counts.
The detailed interface statistics screen
The upper portion of the screen contains the packet and byte counts for all IP and non-IP packets intercepted on the interface. The lower portion contains the total, incoming, and outgoing interface data rates. This facility also displays incoming and outgoing counts and data rates. The packet size breakdown in versions prior to 2.0.0 has been moved to its own facility under Statistical breakdowns.../By packet size as described in Chapter 5. An outgoing packet is one that exits your interface, regardless of whether it originated from your machine or came from another machine and was routed through yours. An incoming packet is one that enters your interface, either addressed to you directly, broadcast, multicast, or captured promiscuously. The rate indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option. Note Buffering and some other factors may affect the data rates, notably the outgoing rate, causing it to reflect a higher figure than the actual rate at which the interface is sending. The figures are logged at regular intervals if logging is enabled. The default log file name at the prompt is iface_stats_detailed-iface.log where iface is the selected interface for this session (for example, iface_stats_detailed-eth0.log). If you wish to start this facility directly from the command line, you can specify the -d parameter and an interface to monitor. For example, iptraf -d eth0 starts the statistics for eth0. The interface must be specified, or IPTraf will not start the facility. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. Note In both the general and detailed statistics screens, as well as in the IP traffic monitor, the packet counts are for actual network packets (layer 2), not the logical IP packets (layer 3) that may be reconstructed after fragmentation. That means, if a packet was fragmented into four pieces, and these four fragments pass over your interface, the packet counts will indicate four separate packets. The figure for the IP checksum errors is a packet count only, because the corrupted IP header cannot be relied upon to give a correct IP packet length value. This facility's output is also affected by IPTraf's filters. See Chapter 7 for more information on filters. Pressing X or Q takes you back to the main menu (if this facility was started with the command-line option, X or Q drops you back to the shell). Statistical Breakdowns Statistical breakdowns contain two facilities that break down traffic counts by either packet size or TCP/UDP port. Packet Sizes The packet size breakdown facility used to be incorporated into the detailed interface statistics. It has since been moved to its own facility. It is entered by selecting Statistical Breakdowns/By packet size. The packet size breakdown takes the interface's Maximum Transmission Unit (MTU) size and divides it into 20 brackets, each bracket containing a range of sizes. As a packet is captured, its size is determined and the appropriate bracket is incremented. This facility provides an idea as to the packet sizes passing over your network, and can aid in network (re)design decisions.
The packet size statistical breakdown
If logging is enabled, copies of the statistics are written at regular intervals to a log file. The default log file name is packet_size-iface.log where iface is the selected interface for this session (for example, packet_size-eth0.log). IPTraf's filters do not affect this facility. The packet size breakdown can also be invoked straight from the command line by specifying the -z iface parameter. The interface parameter is required. For example, this command runs the facility on interface eth0. iptraf -z eth0 When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. To exit, press X or Ctrl+X. TCP and UDP Traffic Statistics IPTraf also includes a facility that generates statistics on TCP and UDP traffic. This facility displays counts of all TCP and UDP packets with source or destination ports numbered less than 1024. Ports 1 to 1023 are reserved for the TCP/IP application protocols (well-known ports).
The TCP/UDP service monitor
The statistics window indicates the protocol (TCP or UDP), the port number, the total packets and bytes counted for this particular protocol/port combination, the packets and bytes destined for that protocol and port, and the packets and bytes coming from that protocol and port. Byte counts include the IP header and payload only. The data link header is not included. The protocol/port indicators are color-coded for easier identification on color terminals. TCP indicators are in yellow, UDP in bright green. Some network applications or protocols may use port numbers higher than 1023. Examples of these include application proxy servers (HTTP proxy servers typically use values like 8000, 8080, 8888, and the like), and IRC (IRC servers commonly accept connections on ports 6660 to 6669). These ports are by default not included in the counts. If you do want to include a higher-numbered port in the statistics, you can add them yourself from the Configure.../Additional ports... menu item. See the section below. If logging is enabled, The statistics are also written to a log file (the default name is tcp_udp_services-iface.log, where iface is the selected interface (for example, tcp_udp_services-eth0.log). IPTraf computes the total, incoming, outgoing, and data rates of the protocol currently indicated by the facility's highlight bar. The data rates are indicated at the bottom of the screen. If logging is enabled, the average data rates since the start of the facility are placed in the log file. The Up and Down cursor keys move the highlight bar. Pressing X or Ctrl+X exits and returns to the main menu (or the shell if it was started from the command line). Sorting TCP/UDP Entries Pressing the S key brings up a window which allows you to select the field by which the entries will be sorted. You can press R to sort by port, P to sort by total packets, B to sort by total bytes, T to sort by incoming packets (packets to), O to sort by incoming bytes (bytes to), F to sort by outgoing packets (packets from) and M to sort by outgoing bytes (bytes from). Pressing any other key cancels the sort. Port numbers are sorted in ascending order (least first) but statistics are sorted in descending order (largest counts first). As with the IP traffic monitor, sorting is performed only with this sequence. Automatic sorting is not performed so as not to affect performance.
The TCP/UDP monitor's sort criteria
Additional Information IPTraf's filters affect the output of this facility. See Chapter 7, Filters for more information about filters. If you wish to start this facility from the command line, you can use the -s option followed by an interface to monitor. For example, iptraf -s eth0 brings up this module for traffic on eth0. The interface must be specified, or IPTraf will drop back to the shell. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. LAN Station Statistics The LAN station monitor (Ethernet station monitor on versions prior to 1.3.0) discovers MAC addresses and displays statistics on the number of incoming, and outgoing packets. It also includes figures for incoming and outgoing kilobits per second for each discovered station. The entry above each line of statistics is the station's LAN type (Ethernet, PLIP, Token Ring, or FDDI) and the hardware MAC address. Each statistics line consists of the following information: Total packets incoming IP packets incoming Total bytes incoming Incoming rate Total packets outgoing IP packets outgoing Total bytes outgoing Outgoing rate The byte counts include the data link header. The activity indicators can be set to display kbits/s or kbytes/s with the Activity mode configuration option. This facility works only for Ethernet, PLIP, Token Ring, and FDDI frames. Loopback. ISDN, and SLIP/PPP networks are not monitored here.
The LAN station monitor
Copies of the statistics are written to a log file at regular intervals if logging is enabled. The default log file name is lan_statistics-n.log, where n is the instance number of this facility (for example, if this is the first instance, the generated default log file name is lan_statistics-1.log). Sorting the LAN Station Monitor Entries Press S to sort the entries. A box will pop up and display the keys you can press to select the field by which the entries will be sorted. Press P to sort by total incoming packets, I to sort by incoming IP packets, B to sort by total incoming bytes, K to sort by total outgoing packets, O to sort by outgoing IP packets, and Y to sort by total outgoing bytes. Pressing any other key cancels the sort.
The LAN station monitor's sort criteria When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information. Additional Information The window can be scrolled with the Up and Down cursor keys. Press X or Q to return to the main menu (or the shell if this facility was started with the -l command-line option). The output of this facility is affected by any applied IPTraf filter. Filters Filters are used to control the information displayed by all facilities. You may want to view statistics only on particular traffic so you must restrict the information displayed. The filters also apply to logging activity. The IPTraf filter management system is accessible through the Filters... submenu.
The Filters submenu
IP Filters The Filters/IP... menu option allows you to define a set of rules that determine what IP traffic to pass to the monitors. Selecting this option pops up another menu with the tasks used to define and apply custom IP filters.
The IP filter menu
Defining a New Filter A freshly installed program will have no filters defined, so before anything else, you will have to define a filter. You can do this by selecting the Define new filter... option. Selecting this option displays a box asking you to enter a short description of the filter you are going to define. Just enter any text that clearly identifies the nature of the filter.
The IP filter name dialog
Press Enter when you're done with that box. As an alternative, you can also press Ctrl+X to cancel the operation. The Filter Rule Selection Screen After you enter the filter's description, you will be taken to a blank rule selection box. At this screen you manage the various rules you define for this filter. You can opt to insert, append, edit, or delete rules.
The filter rule selection screen. Selecting an entry displays that set for editing
Any rules defined will appear here. You will see the source and destination addresses, masks and ports (long addresses and masks may be truncated) and whether this rule includes or excludes matching packets. Between the source and destination parameters is an arrow that indicates whether the rule matches packets (single-headed) only exactly or whether it matches packets flowing in the opposite direction (double-headed). At this screen, press I to insert at the current position of the selection bar, A to append a rule to the end of the list, Enter to edit the highlighted rule and D to delete the selected rule. With an empty list, A or I can be used to add the first rule. To add the first rule, press A or I. You will then be presented with a dialog box that allows you to enter the rule's parameters. Entering Filter Rules You can enter addresses of individual hosts, networks, or a catch-all address. The nature of the address will be determined by the wildcard mask. You'll notice two sets of fields, marked Source and Destination. You fill these out with the information about your source and targets. Fill out the host name or IP address of the hosts or networks in the first field marked Host name/IP Address. Enter it in standard dotted-decimal notation. When done, press Tab to move to the Wildcard mask field. The wildcard mask is similar but not exactly identical to the standard IP subnet mask. The wildcard mask is used to determine which bits to ignore when processing the filter. In most cases, it will work very closely like a subnet mask. Place ones (1) under the bits you want the filter to recognize, and keep zeros (0) under the bits you want the filter to ignore. For example: To recognize the host 207.0.115.44 IP address207.0.115.44 Wildcard mask255.255.255.255 To recognize all hosts belonging to network 202.47.132.x IP address202.47.132.0 Wildcard mask255.255.255.0 To recognize all hosts with any address: IP address0.0.0.0 Wildcard mask0.0.0.0 The IP address/wildcard mask mechanism of the display filter doesn't recognize IP address class. It uses a simple bit- pattern matching algorithm. The wildcard mask also does not have to end on a byte boundary; you may mask right into a byte itself. For example, 255.255.255.224 masks 27 bits (255 is 11111111, 224 is 11100000 in binary). IPTraf also accepts host names in place of the IP addresses. IPTraf will resolve the host name when the filter is loaded. When the filter is interpreted, the wildcard mask will also be applied. This can be useful in cases where a single host name may resolve to several IP addresses. Tip See the Linux Network Administrator's Guide if you need more information on IP addresses and subnet masking. Tip IPTraf allows you to specify the wildcard mask in Classless Interdomain Routing (CIDR) format. This format allows you to specify the number of 1-bits that mask the address. CIDR notation is the form address/bits where the address is the IP address or host name and bits is the number of 1-bits in the mask. For example, if you want to mask 10.1.1.0 with 255.255.255.0, note that 255.255.255.0 has 24 1-bits, so instead of specifying 255.255.255.0 in the wildcard mask field, you can just enter 10.1.1.0/24 in the address field. IPTraf will translate the mask bits into an appropriate wildcard mask and fill in the mask field the next time you edit the filter rule. If you specify the mask in CIDR notation, leave the wildcard mask fields blank. If you fill them up, the wildcard mask fields will take precedence. The Port fields should contain a port number or range of any TCP or UDP service you may be interested in. If you want to match only a single port number, fill in the first field, while leaving the second blank or set to zero. Fill in the second field if you want to match a range of ports (e.g. 80 to 90). Leave the first field blank or set to zero to let the filter ignore the ports altogether. You will most likely be interested in target ports rather than source ports (which are usually unpredictable anyway, perhaps with the exception of FTP data). Non-TCP and non-UDP packets are not affected by these fields, and these are used only when filtering TCP or UDP packets. Fill out the second set of fields with the parameters of the opposite end of the connection. Tip Any address or mask fields left blank default to 0.0.0.0 while blank Port fields default to 0. This makes it easy to define filter rules if you're interested only in either the source or destination, but not the other. For example, you may be interested in traffic originating from network 61.9.88.0, in which case you just enter the source address, mask and port in the Source fields, while leaving the Destination fields blank. The next fields let you specify which IP-type protocols you want matched by this filter rule. Any packet whose protocol's corresponding field is marked with a Y is matched against the filter's defined IP addresses and ports, otherwise they don't pass through this filter rule. If you want to evaluate all IP packets just mark with Y the All IP field. For example, if you want to see only all TCP traffic, mark the TCP field with Y. The long field marked Additional protocols allows you to specify other protocols by their IANA number. (You can view the common IP protocol number in the /etc/protocols file). You can specify a list of protocol numbers or ranges separated by commas, Ranges have the beginning and ending protocol numbers separated with a hyphen. For example, to see the RSVP (46), IP mobile (55), and protocols (101 to 104), you use an entry that looks like this: 46, 55, 101-104 It's certainly possible to specify any of the protocols listed above in this field. Entering 1-255 is functionally identical to marking All IP with a Y. The next field is marked Include/Exclude. This field allows you to decide whether to include or filter out matching packets. Setting this field to I causes the filter to pass matching packets, while setting it to E causes the filter to drop them. This field is set to I by default. The last field in the dialog is labeled Match opposite. When set to Y, the filter will match packets flowing in the opposite direction. Previous versions of IPTraf used to match TCP packets flowing in either direction, so the source and destination address/mask/port combinations were actually interchangeable. Starting with IPTraf 3.0, when filters extended to more than just the IP traffic monitor, this behavior is no longer the default throughout IPTraf except in the IP traffic monitor's TCP window. Note For TCP packets, this field is used in all facilities except the IP traffic monitor. Because the IP traffic monitor must capture TCP packets in both directions to properly determine a closed connection, the filter automatically matches packets in the opposite direction, regardless of this field's setting. However iin all other facilities, automatic matching of the reverse packets is not performed unless you set this field to Y. Filters for UDP and other IP protocols do not automatically match packets in the opposite direction unless you set the field to Y, even in the IP traffic monitor. Press Enter to accept all parameters when done. The parameters will be accepted and you'll be taken back to the rule selection box. You can then add more rules by pressing A or you can insert new rules at any point by pressing I. Should you make a mistake, you can press Enter to edit the selected filter. You may enter as many sets of parameters as you wish. Press Ctrl+X when done. Note Because of the major changes in the filtering system since IPTraf 2.7, old filters will no longer work and will have to be redefined.
The IP filter parameters dialog
Examples To see all traffic to/from host 202.47.132.1 from/to 207.0.115.44, regardless of TCP port Host name/IP Address202.47.132.2207.0.115.44 Wildcard mask255.255.255.255255.255.255.255 Port00 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all traffic from host 207.0.115.44 to all hosts on network 202.47.132.x Host name/IP Address207.0.115.44202.47.132.0 Wildcard mask255.255.255.255255.255.255.0 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeN To see all Web traffic (to and from port 80) regardless of source or destination Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port800 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all IRC traffic from port 6666 to 6669 Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port06666 to 6669 ProtocolsTCP: Y Include/ExcludeI Match oppositeY To see all DNS traffic, (TCP and UDP, destination port 53) regardless of source or destination Host name/IP Address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port053 ProtocolsTCP: Y UDP: Y Include/ExcludeI Match oppositeY To see all mail (SMTP) traffic to a single host (202.47.132.2) from anywhere Host name/IP Address0.0.0.0202.47.132.2 Wildcard mask0.0.0.0255.255.255.255 Port025 ProtocolsTCP: Y Include/ExcludeI Match oppositeN To see traffic from from/to host sunsite.unc.edu to/from cebu.mozcom.com Host name/IP Addresssunsite.unc.educebu.mozcom.com Wildcard mask255.255.255.255255.255.255.255 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeY To omit display of traffic to/from 140.66.5.x from/to anywhere Host name/IP Address140.66.5.00.0.0.0 Wildcard mask255.255.255.00.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeE Match oppositeY You can enter as many parameters as you wish. All of them will be interpreted until the first match is found. Excluding Certain Sites Filters follow an implicit "no-match" policy, that is, only packets matching defined rules will be matched, others will be filtered out. This is similar to the access-list policy "whatever is not explicitly permitted is denied". If you want to show all traffic to/from everywhere, except certain places, you can specify the sites you wish to exclude, mark them with E in the Include/Exclude field, and define a general catch-all entry with source address 0.0.0.0, mask 0.0.0.0, port 0, and destination 0.0.0.0, mask 0.0.0.0, port 0, tagged with an I in the Include/Exclude field as the last entry. For example: To see all traffic except all SMTP (both directions), Web (both directions), and traffic (only) from 207.0.115.44 Host name/IP address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port250 ProtocolsTCP: Y Include/ExcludeE Match oppositeY Host name/IP address0.0.0.0 0.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port800 ProtocolsTCP: Y Include/ExcludeE Match oppositeY Host name/IP address207.0.115.440.0.0.0 Wildcard mask255.255.255.2550.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeE Match oppositeN Host name/IP address0.0.0.00.0.0.0 Wildcard mask0.0.0.00.0.0.0 Port00 ProtocolsAll IP: Y Include/ExcludeI Match oppositeN Tip To filter out all TCP, define a filter with a single entry, with a source of 0.0.0.0 mask 0.0.0.0 port 0, and a destination of 0.0.0.0 mask 0.0.0.0 port 0, with the Include/Exclude field marked E (exclude). Then apply this filter. Applying a Filter The above steps only add the filter to a defined list. To actually apply the filter, you must select Apply filter... from the menu. You will be presented with a list of filters you already defined. Select the one you want to apply, and press Enter. The applied filter stays in effect over exits and restarts of the IPTraf program until it is detached. Editing a Defined Filter Select Edit filter... to modify an existing filter. Once you select this option, you will be presented with the list of defined filters. Select the filter you want to edit by moving the selection bar and press Enter. Edit the description if you wish. Pressing Ctrl+X at this point will abort the operation, and the filter will remain unmodified. Press Enter to accept any changes to the filter description. After pressing Enter, you will see the filter's rules. To edit an existing filter rule, move the selection bar to the desired entry and press Enter. A prefilled dialog box will appear. Edit its contents as desired. Press Enter to accept the changes or Ctrl+X to discard. You can add a new filter rule by pressing I to insert at the selection bar's current position. When you press I, you will be presented with a dialog box asking you to enter the new rule data. Pressing A results in a similar operation, except the rule will be appended as the last entry in the rule list. Pressing D deletes the currently pointed entry. Press X or Ctrl+X to end the edit and save the changes. Note If you're editing the currently applied filter, you will need to re-apply the filter for the changes to take effect. Note Be aware that the filter processes the rules in order. In other words, if a packet matches more than one rule, only the first matching rule is followed. Deleting a Defined Filter Select Delete filter... from the menu to remove a filter from the list. Just move the selection bar to the filter you want to delete, and press Enter. Detaching a Filter The Detach filter option deactivates the filter currently in use. Selecting this option causes all TCP traffic to be passed to the monitors. When you're done with the menu, just select the Exit menu option. ARP, RARP, and other Non-IP Packet Filters The Non-IP filter option toggles the display and logging of all non-IP packets, except ARP and RARP, which are toggled separately. Configuring IPTraf IPTraf can be easily configured with the Configure... item in the main menu. The configuration is stored in the /var/local/iptraf/iptraf.cfg file. If the file is not found, IPTraf uses the default settings. Any changes to the configuration immediately get stored in the configuration file.
The IPTraf configuration menu
Toggles Reverse DNS Lookups Activating reverse lookup causes IPTraf to find out the name of the hosts with the addresses in the IP packets. When this option is enabled, IPTraf's IP traffic monitor starts the rvnamed DNS lookup server to help resolve IP addresses in the background while allowing IPTraf to continue capturing packets. This option is off by default. TCP/UDP Service Names This option, when on, causes IPTraf to display the TCP/UDP service names (smtp, www, pop3, etc.) instead of their numeric ports (25, 80, 110, etc). The number-to-name mappings will depend on the systems services database file (usually /etc/services). Should there be no corresponding service name for the port number, the numeric form will still be displayed. This setting is off by default. Note Reverse lookup and service name lookup take some time and may impact performance and increase the chances of dropped packets. Performance and results are best (albeit more cryptic) with both these settings off. Force promiscuous If this option is enabled, your LAN interfaces will capture all packets on your LAN. Using this option enables you to see all TCP connections and packets passing your LAN segment, even if they're not from or for your machine. When this option is active in the statistics windows, the Activity indicators will show a good estimate of the load on your LAN segment. When this option is disabled, you'll only receive information about packets coming from and entering your machine. The setting of this option affects all LAN ( Ethernet, FDDI, some Token Ring) interfaces on your machine, if you have more than one. The interface's promiscuous flag is set only when a facility is started, and turned off when it exits. However, if promiscuous mode was already set when a facility was started, it remains set on exit. If multiple instances of IPTraf are started, the promiscuous setting is restored only upon exit of the last facility. Note Do not use other programs that change the interface's promiscuous flag at the same time you're using IPTraf. The programs can interfere with each other's expected operations. While IPTraf tries to obtain the initial setting of any promiscuous flags for restoration upon exit, other programs may not be as well-behaved, and they may turn off the promiscuous flags while IPTraf is still monitoring. Color Turn this on with color monitors. Turn it off with black-and- white monitors or non-color terminals (like xterms). Changes to this setting will take effect the next time the program is started. Color is on by default on consoles and color xterms, off on non-color terminals like xterms and VT100s. Logging When this option is active, IPTraf will log information to a disk file, which can be examined or analyzed later. Since IPTraf 2.4.0, IPTraf prompts you for the name of the file to which to write the logs. It will provide a default name, which you are free to accept or change. The IP traffic monitor and LAN station monitor will generate a log file name that is based on what instance they are (first, second, and so on). The general interface statistics' default log file name is constant, because it listens to all interfaces at once, and only one instance can run at one time. The other facilities generate a log file name based on the interface they're listening on. See the descriptions on the facilities above for the default log file names. Press Enter to accept the log file name, or Ctrl+X to cancel. Canceling will turn logging off for that session. The IP traffic monitor will write the following pieces of information to its log file: Start of the traffic monitor Receipt of the first TCP packet for a connection. If that packet is a SYN, (SYN) will be indicated in the log entry. (Of course, the traffic monitor may start in the middle of established connections. It will still count those packets. This also explains why some connection entries may become idle if the traffic monitor is started in the middle of a half-closed connection, and miss the first FIN. Such entries time out in a while.) Receipt of a FIN (with average flow rate) ACK of a FIN Timeouts of TCP entries (with average flow rate) Reset connections (with average flow rate) Everything that appears in the bottom window of the traffic monitor Stopping of the traffic monitor Each log entry includes the date and time the entry was written. Logging is also affected by the defined filters. Log files can grow very fast, so be prepared with plenty of free space and delete unneeded logs. Log write errors are not indicated. Copies of the interface statistics, TCP/UDP statistics, packet size statistics, and LAN host statistics are also written to the log files at regular intervals. See Log Interval... in this chapter. IPTraf closes and reopens the active log file when it receives a USR1 signal. This is useful in cases where a facility is run for long periods of time but the log files have to be cleared or moved. To clear or move an active log file, rename it first. IPTraf will continue to write to the file despite the new name. Then use the UNIX kill command to send the running IPTraf process a USR1 signal. IPTraf will then close the log file and open another with the original name. You can then safely remove or delete the renamed file. Do not delete an open log file. Doing so will only result in a file just as large but filled with null characters (ASCII code 0). Logging comes disabled by default. The USR1 signal is caught only if logging is enabled, it is ignored otherwise. A valid specification of -L on the command line with automatically enable logging for that particular session. The saved configuration setting is not affected. Activity mode Toggles activity indicators in the interface and LAN statistics facilities between kilobits per second (kbits/s) or kilobytes per second (kbytes/s). The default setting is kilobits per second. Source MAC addrs in traffic monitor When enabled, the IP traffic monitor retrieves the packets' source MAC addresses if they came in on an Ethernet, FDDI, or PLIP interface. The addresses appear in the lower window for non-TCP packets, while for TCP connections, they can be viewed by pressing M. No such information is displayed if the network interface doesn't use MAC addresses (such as PPP interfaces). This can be used to determine the actual source of the packets on your local LAN. The traffic monitor also logs the MAC addresses with this option enabled. The default setting is off. Timers The Timers... submenu allows you to IPTraf's interval and timeout functions.
The Timers configuration submenu
TCP Timeout This figure determines the amount of time (in minutes) a connection entry may remain idle before it becomes eligible for replacement by a new connection. The default is 15 minutes. You may want to reduce this on an isolated (not connected to the Internet) LAN or a LAN connected to the Internet with high-speed links. Just enter the new value and press Enter. You can press Ctrl+X to leave the current value unchanged. Log Interval This figure determines the number of minutes between logging of interface statistics, TCP/UDP figures, and LAN host statistics. The default is 60 minutes. This figure is meaningless if logging is disabled. This configuration item can be overridden with the -I when a facility is directly invoked from the command line (not accessed via the main menu), and remains effective for that particular session. The configured value is not affected. Screen Update Interval This value determines the rate in seconds at which the screen is updated. The default is 0, which means the screen is updated as fast as possible, giving close-to-realtime reflection of network activity. However, this high-speed update can cause incredible amounts of traffic if IPTraf is run on a remote terminal (e.g. a Telnet or Secure Shell session). You can set this to a higher value, such as 1 or 2 seconds to slow down the updates. This figure does not affect the rate of data capture. Only the screen refresh is affected. The figures are still updated as fast as possible, although the figure display will no longer be as close to realtime. The default setting is 0, which shouldn't be a problem on the console. Set it to a slightly higher value on remote terminals or slow links. The setting affects all monitoring facilities. Note Updating the screen is one of the slowest operations in a program. Older versions of IPTraf had a problem once network activity became very high. Because each packet caused a screen update, IPTraf began spending more time with the screen updates, causing a loss of packets once network activity reached a certain point. However, since many users like rapid counts on their screen, a compromise was incorporated. Even when the screen update interval is set to 0, there is still a 50ms delay between screen updates (except the LAN station monitor, which has a 100 ms delay). This is still visually fast, but provides more time to the packet capture routine. Higher delays may result in better accuracy of counts and activity. In any case, this setting only affects screen updates. Capture still proceeds as fast as possible. TCP closed/idle persistence This parameter determines the interval (in minutes) at which the IP Traffic Monitor clears from the TCP display window all closed, idle, and timed out entries. Enter 0 to keep such entries on the screen indefinitely, disappearing only when replaced by new connections. Note The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains onscreen. The TCP closed/idle persistence... parameter flushes entries that have been closed or reset, or idle for the number of minutes defined by the TCP timeout... option. Custom Information The remaining configuration items allow you to enter information which IPTraf uses for its displays and logs. Additional ports Select this item to enter a port number to be included in the TCP/UDP counts in the TCP/UDP service statistics main menu item described above. By default, port numbers above 1023 are not monitored. If you do have a higher-numbered port to monitor, enter it here. You will see two fields. If you have only one port to enter, just fill up the first field. To specify a range, fill both fields, the first port in the first field, the last port in the second field. You can select this option multiple times to add more values or ranges. Delete port/range Select this item to remove a higher-numbered port number or port range you entered earlier with the Additional ports... option. A window will come up containing the entered ports and ranges. Select the entry you want delete and press Enter. LAN Station Identifiers The LAN station statistics facility monitors stations based on their respective MAC addresses. The hexadecimal notation of these addresses make them even more difficult to remember than the dotted-decimal IP addresses, so these facilities were added to help you better determine which station is which. Selecting the Ethernet/PLIP host descriptions... or FDDI/Token Ring host descriptions... options brings up a submenu asking you to add, edit, or delete descriptions. To add a new description, select the Add description... option. A dialog box will appear, asking you for the MAC address and an appropriate description. Type in the address in hexadecimal notation with no punctuation of any kind. The dialog box is case-insensitive for the address; the alphabetical digits A to F will be stored in lowercase. Use the Tab key to move between fields and Enter to accept. Press Ctrl+X to discard this dialog and return to the main menu. The description may be anything: the IP address, a fully-qualified domain name, or a description of your liking as long as the field can hold. Enter as many descriptions as you need. Press Ctrl+X at a blank dialog after you have entered the last entry These descriptions will be displayed alongside the MAC addresses in the LAN station monitor, together with the type of frame (Ethernet, PLIP, or FDDI). An existing address or description may be edited by selecting the Edit description... option from the submenu. A panel will appear with a list of existing address descriptions. Select the one you wish to edit and press Enter. A dialog box identical to that when you add a description will appear with prefilled fields. Just backspace over and edit the fields. Press Enter to accept or Ctrl+X to cancel. Selecting the Delete description... submenu item brings up the selection panel. Select the description you want to delete and press Enter. You can also press Ctrl+X to cancel the operation. IPTraf 2.4 and later also recognizes the /etc/ethers file. Should a hardware address be present in the IPTraf definition files and in /etc/ethers, the IPTraf definition will be used. Note The description file for Ethernet and PLIP is ethernet.desc, while the FDDI and Token Ring mappings are stored in fddi.desc in the IPTraf working directory. These files are in colon-delimited text format. Database engines or custom scripts can be told to append data lines to those files. Each line follows this simple format: address:description For example 00201e457e:Cisco 3640 gateway Do not put colons, periods, or any invalid characters in the MAC address. Background Operation IPTraf's facilities can be placed in the background solely for logging. When running in the background, it doesn't display any output on the screen, and doesn't receive input from the keyboard, and drops you back to the shell. Before starting a statistical facility in the background, configure IPTraf in the usual way (set filters, add TCP/UDP ports, etc). Once that's done, exit all instances of IPTraf on the system, then invoke IPTraf from the command line with the parameter to start the facility you want, the timeout (-t) parameter if you wish, and the -B parameter to actually daemonize the program. For example, to run the IP traffic monitor in the background for all interfaces, issue the command iptraf -i all -B To run the detailed interface statistics on interface eth0 for 5 minutes in the background: iptraf -d eth0 -t 5 -B If the timeout parameter is not specified, the facility will run until the process receives a USR2 signal. To stop a facility in the background, do a ps x at the command line, and find the process id (pid) of the iptraf process you're looking for. Then send that process a USR2 signal with the kill command: kill -USR2 pid Since IPTraf cannot send error messages to the terminal, all messages are written to the file daemon.log in the IPTraf logging directory. The -B parameter automatically enables logging regardless of its configured setting. The parameter is ignored if not used with one of the parameters to start a facility from the command line. The log file can be specified with the -L command-line parameter. If this parameter is not specified, the default log file name for the facility will be used (see the descriptions of the facilities above for the default log name patterns). If you don't specify an path, the log file will be placed in /var/log/iptraf. The logging interval for all facilities (except the IP traffic monitor) can also be overriden with the -I command-line parameter. Messages IPTraf's messages are presented in two ways. In interactive mode, messages are displayed in a distictive message box. In daemon (background) mode, appropriate messages are written to the iptraf.log file in the IPTraf log directory (normally /var/log/iptraf. IPTraf Messages Unable to create config file IPTraf cannot create the configuration file. The most likely cause of this is that you didn't properly install the program, and the necessary directory /var/local/iptraf does not exist. Can also be generated if you have a disk problem or if you have too many files open. Unable to read config file The configuration record cannot be read. You most likely have a disk problem. Unable to write config file The configuration file cannot be written. You either have a disk problem, or (more likely), your disk is full. Enter an appropriate description for this filter Enter something to clearly describe the filter you are defining. Error loading filter list file IPTraf cannot access the list of defined TCP or UDP filters. Can also be an indicator of a bad disk. Error writing filter list file The filter list file cannot be written to. You may have trouble accessing your filters. Unable to read TCP/UDP/misc IP filter file IPTraf cannot read the filter data off the file. Could be caused by a bad disk. Error opening filter data file IPTraf cannot open the filter file. Could be caused by a shortage of file descriptors or a bad disk. Unable to write filter data IPTraf cannot add the newly defined filter to the filter list. This may be due to a bad disk. Cannot create filter data file IPTraf cannot create the filter record file. The defined filter is lost. Unable to save filter changes IPTraf cannot save the changes you made to the filter. You probably have a disk error. Unable to write filter state information The current state of the filters cannot be saved. IPTraf will be unable to correctly reload the filters the next time it's started. This can be caused by a bad disk or improper installation. Unable to save interface flags IPTraf was unable to save the flags of the network interfaces. This is probably due to a bad installation or full filesystem. Unable to retrieve saved interface flags IPTraf was unable to retrieve the save interface flags. Probably again due to a bad installation or full filesystem. protocol filter data file in use; try again later Filter state file in use; try again later Another IPTraf process is modifying the TCP, UDP or miscellaneous IP filter data or the filter state file and has locked the files or file. Try again once the other IPTraf process has terminated or completed its modifications and unlocked the files. Unable to resolve hostname The indicated host name in the filter cannot be resolved into an IP address. Check the local hosts database /etc/hosts or your machine's DNS configuration or DNS server. The filter parameters will not be used. Unable to open host description file IPTraf cannot open the file containing the descriptions for Ethernet or FDDI addresses. Could be due to a bad disk or a hit on the file descriptor limit. Unable to write host description IPTraf was unable to write the description record for this Ethernet or FDDI address. Could be due to a bad disk or corrupted filesystem. No descriptions You tried to edit or delete a description with no previous descriptions defined. Cannot open log file There is a problem opening the log file. There is most likely a problem with the disk, or there are too many open files. Unable to obtain interface list IPTraf was unable to retrieve the list of network interfaces from the /proc filesystem. This may be due to a badly configured kernel. IPTraf needs /proc filesystem support. No active interfaces. Check their status or the /proc filesystem. IPTraf found no active interfaces. Either all interfaces are down or the /proc/net/dev file was empty or unavailable. Activate at least one interface or check the /proc/net/dev file. Unable to obtain interface parameters for interface The system call to retrieve the interface's flags failed. Check your interface or kernel driver. Promisc change failed for interface The system call to change the promiscuous flag failed. Check your interface or its kernel driver. Unable to open raw socket for flag change IPTraf was unable to open the necessary socket for the promiscuous change operation. May be due to a shortage of file descriptors. Unable to open socket for MTU determination Returned by the facility for detailed interface statistics if the raw socket's opening sequence failed. The facility will abort. Unable to open raw socket IPTraf was unable to open the raw socket for packet capture. May be due to a shortage of file descriptors. Reminder IPTraf 2.x.x requires Linux kernel 2.2.x, with the Packet Socket option compiled in or installed as a module. IPTraf 2.x will return this error on a pre-2.2 kernel or on a 2.2 kernel without Packet Socket. Unable to obtain interface MTU The detailed statistics facility was unable to obtain the maximum transmission unit (MTU) for the selected interface. The facility will abort. Specified interface not supported The interface specified with the -i, -d, -s, -l, or -z command-line parameters is not supported by IPTraf. Specified interface not active The interface specified with the -i, -d, -s, -l, or -z command-line parameters is supported, but not currently activated. Fatal: memory allocation error May occur if you have too little memory to allocate for windows, the menu system, or dialog boxes. IPTraf tries to prevent further allocations if memory runs out during a monitor. However, this could also mean a bug if you're reasonably sure you're not out of memory. An instructional message on bug reporting follows this message. Technical note This is actually a response to the segmentation fault error (SIGSEGV). This program can be run only by the system administrator IPTraf normally does not allow anybody but uid 0 (root) to run it. This measure is included for safety reasons. See the section on recompiling the program below if you want to override this. This feature is built in, and not part of the configuration Your TERM variable is not set The TERM (terminal type) environment variable must be set to a valid terminal type so that the screen management routines can function properly. Set it to the appropriate terminal type. Linux consoles typically have their TERM variables set to linux. Received TERM signal Not related to the previous message. The TERM (terminate) signal is normally used to gracefully shut down a program. This message simply indicates that the TERM signal was caught and IPTraf is attempting to shut down as gracefully as possible. Invalid option or missing parameter, use iptraf -h for help The -i, -d, -s, -l, or -z options were specified but no interface was specified on the command line. These parameters require a valid interface name (or all for -i or -l). This message also appears if an unknown option is passed to the iptraf command. Warning: unable to tag this process IPTraf normally tags itself when it runs to prevent multiple instances of the statistical facilities from running. This message means the program was unable to create the necessary tag file. This may be due to a bad or improper installation. Try running the make install procedure or the Setup in the distribution's top-level directory. Warning: unable to tag facility IPTraf was unable to create the tag file for the facility you started. The facility will still run, but other instances of IPTraf that may be running simultaneously will allow the same facility to run. This may cause both instances of the facility to malfunction. This could be due to a bad disk or bad installation. facility already running/listening on interface The facility you tried to start is currently running on the indicated interface in another IPTraf process on the machine. This restriction is placed to prevent conflicts involving internal sockets or the log files. General interface statistics already active in another process Only one instance of the general interface statistics can run at a time. Duplicate port/range entry You entered a port number or range that was already added to the list of additional ports to be monitored by the TCP/UDP service monitor No custom ports There are no ports or port ranges earlier added. There's nothing to delete. Can't start rvnamed; lookups will block IPTraf cannot start the rvnamed daemon; probably due to a bad installation. IPTraf will fall back to blocking lookups. Can't spawn new process; lookups will block IPTraf cannot start a new process. This may be due to memory shortage. IPTraf will fall back to blocking lookups. Fork error, IPTraf cannot run in background IPTraf cannot start a new process, and can go into the background. This may be due to memory shortage. IPTraf aborts. No memory for new filter entry IPTraf was unable to allocate memory for a new filter entry. Most likely due to memory shortage. Memory Low This indicator appears if memory runs low due to a lot of entries in a facility. Should critical functions fail (window creation, internal allocation), the program could terminate with a segmentation violation. Note Any message or indicator about low memory means that your system does not have enough memory to handle the entries. It is almost certain that sooner or later, IPTraf or other applications will abort due to the failure of important system calls or library functions. Memory must be added right away. IPC Error This indicator appears if an error occurs receiving data from the rvnamed program (IPC stands for Interprocess Communication). This indication should not occur under normal circumstances. Report instances of this condition and the circumstances under which it happens. You may also include data from the rvnamed.log file. Error opening terminal: terminal The screen management routines cannot find the terminfo entry for your terminal. IPTraf expects the terminfo database located in /usr/share/terminfo. This error could occur when your terminfo database is located somewhere else. See the section on controlling the terminfo search path. This will end your IPTraf session In interactive mode IPTraf asks you to confirm your exit command. Press Enter to return to the shell or any other key to cancel your command and return to the main menu. rvnamed Messages As a daemon, rvnamed does not send messages to the screen. It writes its messages to the file rvnamed.log in the IPTraf log directory. Unable to open child communication socket rvnamed was unable to open the communication endpoint for data reception from the children it creates. This is highly unusual, and should it occur, report the circumstances. Unable to open client communication socket rvnamed was unable to open the communication endpoint for data exchange with the IPTraf program. This is highly unusual, and should it occur, report the circumstances. Error binding client communication socket Error binding child communication socket rvnamed was unable to assign a name to the indicated communication socket. This may be due to a bad, full, or corrupted filesystem. Fatal error: no memory for descriptor monitoring rvnamed ran out of memory. IPTraf will resort to blocking, and may freeze. Error on fork, returning IP address rvnamed had a problem spawning a copy of itself to resolve the IP address. rvnamed will simply return the IP address in its literal, dotted-decimal notation. IPTraf will still function normally. This may be due to lack of memory or a process limit hit. Maximum child process limit reached rvnamed has reached its maximum number of child processes. This is intended as a "brake" to prevent too many rvnamed children from hogging your computer's resources and possibly crashing it. Unless IPTraf is monitoring an extremely busy network without filters, this shouldn't happen, at least, not that often. If you notice this message, try applying filters or check your DNS server. Many times, this can happen when the DNS server goes down for whatever reason, and you have rvnamed children taking too long to resolve. GNU Free Documentation License Version 1.1, March 2000
Copyright (C) 2000 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
PREAMBLE The purpose of this License is to make a manual, textbook, or other written document "free" in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others. This License is a kind of "copyleft", which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software. We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference. APPLICABILITY AND DEFINITIONS This License applies to any manual or other work that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. The "Document", below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as "you". A "Modified Version" of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language. A "Secondary Section" is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document's overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (For example, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them. The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License. The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License. A "Transparent" copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, whose contents can be viewed and edited directly and straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup has been designed to thwart or discourage subsequent modification by readers is not Transparent. A copy that is not "Transparent" is called "Opaque". Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML designed for human modification. Opaque formats include PostScript, PDF, proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML produced by some word processors for output purposes only. The "Title Page" means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, "Title Page" means the text near the most prominent appearance of the work's title, preceding the beginning of the body of the text. VERBATIM COPYING You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3. You may also lend copies, under the same conditions stated above, and you may publicly display copies. COPYING IN QUANTITY If you publish printed copies of the Document numbering more than 100, and the Document's license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects. If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages. If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a publicly-accessible computer-network location containing a complete Transparent copy of the Document, free of added material, which the general network-using public has access to download anonymously at no charge using public-standard network protocols. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public. It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document. MODIFICATIONS You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version: Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission. List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has less than five). State on the Title page the name of the publisher of the Modified Version, as the publisher. Preserve all the copyright notices of the Document. Add an appropriate copyright notice for your modifications adjacent to the other copyright notices. Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below. Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document's license notice. Include an unaltered copy of this License. Preserve the section entitled "History", and its title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section entitled "History" in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence. Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the "History" section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission. In any section entitled "Acknowledgements" or "Dedications", preserve the section's title, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein. Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles. Delete any section entitled "Endorsements". Such a section may not be included in the Modified Version. Do not retitle any existing section as "Endorsements" or to conflict in title with any Invariant Section. If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version's license notice. These titles must be distinct from any other section titles. You may add a section entitled "Endorsements", provided it contains nothing but endorsements of your Modified Version by various parties--for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard. You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one. The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version. COMBINING DOCUMENTS You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice. The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work. In the combination, you must combine any sections entitled "History" in the various original documents, forming one section entitled "History"; likewise combine any sections entitled "Acknowledgements", and any sections entitled "Dedications". You must delete all sections entitled "Endorsements." COLLECTIONS OF DOCUMENTS You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects. You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document. AGGREGATION WITH INDEPENDENT WORKS A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, does not as a whole count as a Modified Version of the Document, provided no compilation copyright is claimed for the compilation. Such a compilation is called an "aggregate", and this License does not apply to the other self-contained works thus compiled with the Document, on account of their being thus compiled, if they are not themselves derivative works of the Document. If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one quarter of the entire aggregate, the Document's Cover Texts may be placed on covers that surround only the Document within the aggregate. Otherwise they must appear on covers around the whole aggregate. TRANSLATION Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License provided that you also include the original English version of this License. In case of a disagreement between the translation and the original English version of this License, the original English version will prevail. TERMINATION You may not copy, modify, sublicense, or distribute the Document except as expressly provided for under this License. Any other attempt to copy, modify, sublicense or distribute the Document is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. FUTURE REVISIONS OF THIS LICENSE The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/copyleft/. Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License "or any later version" applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation. How to use this License for your documents To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page:
Copyright (c) YEAR YOUR NAME. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with the Invariant Sections being LIST THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST. A copy of the license is included in the section entitled "GNU Free Documentation License".
If you have no Invariant Sections, write "with no Invariant Sections" instead of saying which ones are invariant. If you have no Front-Cover Texts, write "no Front-Cover Texts" instead of "Front-Cover Texts being LIST"; likewise for Back-Cover Texts. If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software. iptraf-ng-1.1.4/Documentation/menus.html0000664000076400007640000000466012173477702020534 0ustar npajkovsnpajkovs Using the Menus
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Using the Menus

Menu items with a trailing ellipsis (...) either pop up a submenu with further items, or require additional information before it can complete the task and return to the menu. Menu items without an ellipsis execute immediately.

Use the Up and Down arrow keys on your keyboard to move the selection bar. Press Enter to execute the selected item. Alternatively, you can also directly press the highlighted letter of the item you want. This will immediately execute the option.

Figure 1. The IPTraf Main Menu

<<< PreviousHomeNext >>>
Command-line OptionsUpExiting IPTraf
iptraf-ng-1.1.4/Documentation/messages.html0000664000076400007640000005346312173477702021221 0ustar npajkovsnpajkovs Messages
IPTraf User's Manual
<<< PreviousNext >>>

Messages

IPTraf's messages are presented in two ways. In interactive mode, messages are displayed in a distictive message box. In daemon (background) mode, appropriate messages are written to the iptraf.log file in the IPTraf log directory (normally /var/log/iptraf.

IPTraf Messages

Unable to create config file

IPTraf cannot create the configuration file. The most likely cause of this is that you didn't properly install the program, and the necessary directory /var/local/iptraf does not exist. Can also be generated if you have a disk problem or if you have too many files open.

Unable to read config file

The configuration record cannot be read. You most likely have a disk problem.

Unable to write config file

The configuration file cannot be written. You either have a disk problem, or (more likely), your disk is full.

Enter an appropriate description for this filter

Enter something to clearly describe the filter you are defining.

Error loading filter list file

IPTraf cannot access the list of defined TCP or UDP filters. Can also be an indicator of a bad disk.

Error writing filter list file

The filter list file cannot be written to. You may have trouble accessing your filters.

Unable to read TCP/UDP/misc IP filter file

IPTraf cannot read the filter data off the file. Could be caused by a bad disk.

Error opening filter data file

IPTraf cannot open the filter file. Could be caused by a shortage of file descriptors or a bad disk.

Unable to write filter data

IPTraf cannot add the newly defined filter to the filter list. This may be due to a bad disk.

Cannot create filter data file

IPTraf cannot create the filter record file. The defined filter is lost.

Unable to save filter changes

IPTraf cannot save the changes you made to the filter. You probably have a disk error.

Unable to write filter state information

The current state of the filters cannot be saved. IPTraf will be unable to correctly reload the filters the next time it's started. This can be caused by a bad disk or improper installation.

Unable to save interface flags

IPTraf was unable to save the flags of the network interfaces. This is probably due to a bad installation or full filesystem.

Unable to retrieve saved interface flags

IPTraf was unable to retrieve the save interface flags. Probably again due to a bad installation or full filesystem.

protocol filter data file in use; try again later

Filter state file in use; try again later

Another IPTraf process is modifying the TCP, UDP or miscellaneous IP filter data or the filter state file and has locked the files or file. Try again once the other IPTraf process has terminated or completed its modifications and unlocked the files.

Unable to resolve hostname

The indicated host name in the filter cannot be resolved into an IP address. Check the local hosts database /etc/hosts or your machine's DNS configuration or DNS server. The filter parameters will not be used.

Unable to open host description file

IPTraf cannot open the file containing the descriptions for Ethernet or FDDI addresses. Could be due to a bad disk or a hit on the file descriptor limit.

Unable to write host description

IPTraf was unable to write the description record for this Ethernet or FDDI address. Could be due to a bad disk or corrupted filesystem.

No descriptions

You tried to edit or delete a description with no previous descriptions defined.

Cannot open log file

There is a problem opening the log file. There is most likely a problem with the disk, or there are too many open files.

Unable to obtain interface list

IPTraf was unable to retrieve the list of network interfaces from the /proc filesystem. This may be due to a badly configured kernel. IPTraf needs /proc filesystem support.

No active interfaces. Check their status or the /proc filesystem.

IPTraf found no active interfaces. Either all interfaces are down or the /proc/net/dev file was empty or unavailable. Activate at least one interface or check the /proc/net/dev file.

Unable to obtain interface parameters for interface

The system call to retrieve the interface's flags failed. Check your interface or kernel driver.

Promisc change failed for interface

The system call to change the promiscuous flag failed. Check your interface or its kernel driver.

Unable to open raw socket for flag change

IPTraf was unable to open the necessary socket for the promiscuous change operation. May be due to a shortage of file descriptors.

Unable to open socket for MTU determination

Returned by the facility for detailed interface statistics if the raw socket's opening sequence failed. The facility will abort.

Unable to open raw socket

IPTraf was unable to open the raw socket for packet capture. May be due to a shortage of file descriptors.

NoteReminder
 

IPTraf 2.x.x requires Linux kernel 2.2.x, with the Packet Socket option compiled in or installed as a module. IPTraf 2.x will return this error on a pre-2.2 kernel or on a 2.2 kernel without Packet Socket.

Unable to obtain interface MTU

The detailed statistics facility was unable to obtain the maximum transmission unit (MTU) for the selected interface. The facility will abort.

Specified interface not supported

The interface specified with the -i, -d, -s, -l, or -z command-line parameters is not supported by IPTraf.

Specified interface not active

The interface specified with the -i, -d, -s, -l, or -z command-line parameters is supported, but not currently activated.

Fatal: memory allocation error

May occur if you have too little memory to allocate for windows, the menu system, or dialog boxes. IPTraf tries to prevent further allocations if memory runs out during a monitor. However, this could also mean a bug if you're reasonably sure you're not out of memory. An instructional message on bug reporting follows this message.

NoteTechnical note
 

This is actually a response to the segmentation fault error (SIGSEGV).

This program can be run only by the system administrator

IPTraf normally does not allow anybody but uid 0 (root) to run it. This measure is included for safety reasons. See the section on recompiling the program below if you want to override this. This feature is built in, and not part of the configuration

Your TERM variable is not set

The TERM (terminal type) environment variable must be set to a valid terminal type so that the screen management routines can function properly. Set it to the appropriate terminal type. Linux consoles typically have their TERM variables set to linux.

Received TERM signal

Not related to the previous message. The TERM (terminate) signal is normally used to gracefully shut down a program. This message simply indicates that the TERM signal was caught and IPTraf is attempting to shut down as gracefully as possible.

Invalid option or missing parameter, use iptraf -h for help

The -i, -d, -s, -l, or -z options were specified but no interface was specified on the command line. These parameters require a valid interface name (or all for -i or -l). This message also appears if an unknown option is passed to the iptraf command.

Warning: unable to tag this process

IPTraf normally tags itself when it runs to prevent multiple instances of the statistical facilities from running. This message means the program was unable to create the necessary tag file. This may be due to a bad or improper installation. Try running the make install procedure or the Setup in the distribution's top-level directory.

Warning: unable to tag facility

IPTraf was unable to create the tag file for the facility you started. The facility will still run, but other instances of IPTraf that may be running simultaneously will allow the same facility to run. This may cause both instances of the facility to malfunction. This could be due to a bad disk or bad installation.

facility already running/listening on interface

The facility you tried to start is currently running on the indicated interface in another IPTraf process on the machine. This restriction is placed to prevent conflicts involving internal sockets or the log files.

General interface statistics already active in another process

Only one instance of the general interface statistics can run at a time.

Duplicate port/range entry

You entered a port number or range that was already added to the list of additional ports to be monitored by the TCP/UDP service monitor

No custom ports

There are no ports or port ranges earlier added. There's nothing to delete.

Can't start rvnamed; lookups will block

IPTraf cannot start the rvnamed daemon; probably due to a bad installation. IPTraf will fall back to blocking lookups.

Can't spawn new process; lookups will block

IPTraf cannot start a new process. This may be due to memory shortage. IPTraf will fall back to blocking lookups.

Fork error, IPTraf cannot run in background

IPTraf cannot start a new process, and can go into the background. This may be due to memory shortage. IPTraf aborts.

No memory for new filter entry

IPTraf was unable to allocate memory for a new filter entry. Most likely due to memory shortage.

Memory Low

This indicator appears if memory runs low due to a lot of entries in a facility. Should critical functions fail (window creation, internal allocation), the program could terminate with a segmentation violation.

NoteNote
 

Any message or indicator about low memory means that your system does not have enough memory to handle the entries. It is almost certain that sooner or later, IPTraf or other applications will abort due to the failure of important system calls or library functions. Memory must be added right away.

IPC Error

This indicator appears if an error occurs receiving data from the rvnamed program (IPC stands for Interprocess Communication). This indication should not occur under normal circumstances. Report instances of this condition and the circumstances under which it happens. You may also include data from the rvnamed.log file.

Error opening terminal: terminal

The screen management routines cannot find the terminfo entry for your terminal. IPTraf expects the terminfo database located in /usr/share/terminfo. This error could occur when your terminfo database is located somewhere else. See the section on controlling the terminfo search path.

This will end your IPTraf session

In interactive mode IPTraf asks you to confirm your exit command. Press Enter to return to the shell or any other key to cancel your command and return to the main menu.
<<< PreviousHomeNext >>>
Background Operation rvnamed Messages
iptraf-ng-1.1.4/Documentation/morelanmoninfo.html0000664000076400007640000000411312173477702022421 0ustar npajkovsnpajkovs Additional Information
IPTraf User's Manual
<<< PreviousLAN Station StatisticsNext >>>

Additional Information

The window can be scrolled with the Up and Down cursor keys. Press X or Q to return to the main menu (or the shell if this facility was started with the -l command-line option).

The output of this facility is affected by any applied IPTraf filter.

<<< PreviousHomeNext >>>
LAN Station StatisticsUpFilters
iptraf-ng-1.1.4/Documentation/netstats.html0000664000076400007640000001035412173477702021247 0ustar npajkovsnpajkovs Network Interface Statistics
IPTraf User's Manual
<<< PreviousNext >>>

Network Interface Statistics

There are two network interface statistics facilities: the general interface statistics, which displays a statistical summary of all attached interfaces, and the detailed interface statistics, which shows more statistical and load information about a single selected interface.

General Interface Statistics

The second menu option displays a list of attached network interfaces, and some general packet counts. Specifically, it displays counts of IP, non-IP, and bad IP packets (packets with IP checksum errors). It also includes an activity indicator, which shows the number of kilobits and packets the interface sees per second. All figures are for incoming and outgoing packets. (Again, considering promiscuous mode for LAN interfaces, which simply causes the machine to intercept all packets). This is useful for general monitoring of all attached interfaces. If byte counts and additional information are needed for a specific interface, the Detailed interface statistics option is also available.

The activity indicators can be toggled between kbits/s and kbytes/s with the Activity mode configuration option.

The general statistics window will dynamically add new entries as packets from newly-created interfaces (e.g. new PPP interfaces) are intercepted. Long lists can be scrolled with the Up, Down, PgUp, and PgDn keys.

This monitor is affected by IPTraf's filters as described in Chapter 7.

Copies of the statistics are written to the log file iface_stats_general.log at regular intervals if logging is enabled. See the Logging option int the Configuration chapter.

This facility can be started directly from the command line with the -g option to the iptraf command. When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.

Figure 1. The general interface statistics screen

You can press X or Q to return to the main menu.

<<< PreviousHomeNext >>>
Additional Information Detailed Interface Statistics
iptraf-ng-1.1.4/Documentation/nonipfilters.html0000664000076400007640000000367612173477702022127 0ustar npajkovsnpajkovs ARP, RARP, and other Non-IP Packet Filters
IPTraf User's Manual
<<< PreviousFiltersNext >>>

ARP, RARP, and other Non-IP Packet Filters

The Non-IP filter option toggles the display and logging of all non-IP packets, except ARP and RARP, which are toggled separately.

<<< PreviousHomeNext >>>
FiltersUpConfiguring IPTraf
iptraf-ng-1.1.4/Documentation/preface.html0000664000076400007640000000462312173477702021011 0ustar npajkovsnpajkovs About This Document
IPTraf User's Manual
<<< PreviousNext >>>

About This Document

This document contains the instructions on how to use the IPTraf network monitoring software version 3.0. This manual details the different statistical facilities, the user interface, and the important features of the software.

For Additional Information

See the included README file for summarized and late-breaking information. Also read the RELEASE-NOTES file for important new information about this new version. The CHANGES file contains a record of the changes made to the software since 1.0.0. README.rvnamed contains information on the rvnamed reverse resolution program. See the other README files for support and development information.

<<< PreviousHomeNext >>>
IPTraf User's Manual Document Conventions
iptraf-ng-1.1.4/Documentation/preparingtouse.html0000664000076400007640000000617712173477702022461 0ustar npajkovsnpajkovs Preparing to Use IPTraf
IPTraf User's Manual
<<< PreviousNext >>>

Preparing to Use IPTraf

This chapter provides information applicable to all of IPTraf's statistical monitors.

Number Display Notations

IPTraf initially returns exact counts of bytes and packets. However, as they grow larger, IPTraf begins displaying them in increasingly higher denominations.

A number standing alone with no suffix represents an exact count. A number with a K following is a kilo (thousand) figure. An M, G, and T suffix represents mega (million), giga (billion), and tera (trillion) respectively. The following table shows examples.

Table 1. Numeric Display Notations

1024067exactly 1024067
1024Kapproximately 1024000
1024Mapproximately 1024000000
1024Gapproximately 1024000000000
1024Tapproximately 1024000000000000

These notations apply to both packet and byte counts.

<<< PreviousHomeNext >>>
Exiting IPTraf Instances and Logging
iptraf-ng-1.1.4/Documentation/rvnamedmessages.html0000664000076400007640000001071612173477702022570 0ustar npajkovsnpajkovs rvnamed Messages
IPTraf User's Manual
<<< PreviousMessagesNext >>>

rvnamed Messages

As a daemon, rvnamed does not send messages to the screen. It writes its messages to the file rvnamed.log in the IPTraf log directory.

Unable to open child communication socket

rvnamed was unable to open the communication endpoint for data reception from the children it creates. This is highly unusual, and should it occur, report the circumstances.

Unable to open client communication socket

rvnamed was unable to open the communication endpoint for data exchange with the IPTraf program. This is highly unusual, and should it occur, report the circumstances.

Error binding client communication socket Error binding child communication socket

rvnamed was unable to assign a name to the indicated communication socket. This may be due to a bad, full, or corrupted filesystem.

Fatal error: no memory for descriptor monitoring

rvnamed ran out of memory. IPTraf will resort to blocking, and may freeze.

Error on fork, returning IP address

rvnamed had a problem spawning a copy of itself to resolve the IP address. rvnamed will simply return the IP address in its literal, dotted-decimal notation. IPTraf will still function normally. This may be due to lack of memory or a process limit hit.

Maximum child process limit reached

rvnamed has reached its maximum number of child processes. This is intended as a "brake" to prevent too many rvnamed children from hogging your computer's resources and possibly crashing it. Unless IPTraf is monitoring an extremely busy network without filters, this shouldn't happen, at least, not that often. If you notice this message, try applying filters or check your DNS server. Many times, this can happen when the DNS server goes down for whatever reason, and you have rvnamed children taking too long to resolve.
<<< PreviousHomeNext >>>
MessagesUpGNU Free Documentation License
iptraf-ng-1.1.4/Documentation/servmon.html0000664000076400007640000001422312173477702021072 0ustar npajkovsnpajkovs TCP and UDP Traffic Statistics
IPTraf User's Manual
<<< PreviousStatistical BreakdownsNext >>>

TCP and UDP Traffic Statistics

IPTraf also includes a facility that generates statistics on TCP and UDP traffic. This facility displays counts of all TCP and UDP packets with source or destination ports numbered less than 1024. Ports 1 to 1023 are reserved for the TCP/IP application protocols (well-known ports).

Figure 2. The TCP/UDP service monitor

The statistics window indicates the protocol (TCP or UDP), the port number, the total packets and bytes counted for this particular protocol/port combination, the packets and bytes destined for that protocol and port, and the packets and bytes coming from that protocol and port.

Byte counts include the IP header and payload only. The data link header is not included.

The protocol/port indicators are color-coded for easier identification on color terminals. TCP indicators are in yellow, UDP in bright green.

Some network applications or protocols may use port numbers higher than 1023. Examples of these include application proxy servers (HTTP proxy servers typically use values like 8000, 8080, 8888, and the like), and IRC (IRC servers commonly accept connections on ports 6660 to 6669). These ports are by default not included in the counts. If you do want to include a higher-numbered port in the statistics, you can add them yourself from the Configure.../Additional ports... menu item. See the section below.

If logging is enabled, The statistics are also written to a log file (the default name is tcp_udp_services-iface.log, where iface is the selected interface (for example, tcp_udp_services-eth0.log).

IPTraf computes the total, incoming, outgoing, and data rates of the protocol currently indicated by the facility's highlight bar. The data rates are indicated at the bottom of the screen. If logging is enabled, the average data rates since the start of the facility are placed in the log file.

The Up and Down cursor keys move the highlight bar. Pressing X or Ctrl+X exits and returns to the main menu (or the shell if it was started from the command line).

Sorting TCP/UDP Entries

Pressing the S key brings up a window which allows you to select the field by which the entries will be sorted. You can press R to sort by port, P to sort by total packets, B to sort by total bytes, T to sort by incoming packets (packets to), O to sort by incoming bytes (bytes to), F to sort by outgoing packets (packets from) and M to sort by outgoing bytes (bytes from). Pressing any other key cancels the sort.

Port numbers are sorted in ascending order (least first) but statistics are sorted in descending order (largest counts first).

As with the IP traffic monitor, sorting is performed only with this sequence. Automatic sorting is not performed so as not to affect performance.

Figure 3. The TCP/UDP monitor's sort criteria

Additional Information

IPTraf's filters affect the output of this facility. See Chapter 7, Filters for more information about filters.

If you wish to start this facility from the command line, you can use the -s option followed by an interface to monitor. For example,

iptraf -s eth0

brings up this module for traffic on eth0. The interface must be specified, or IPTraf will drop back to the shell.

When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.

<<< PreviousHomeNext >>>
Statistical BreakdownsUpLAN Station Statistics
iptraf-ng-1.1.4/Documentation/startstop.html0000664000076400007640000001143212173477702021443 0ustar npajkovsnpajkovs Starting and Stopping IPTraf
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Starting and Stopping IPTraf

After installation, you can start the program by simply entering

iptraf

at the shell prompt. You will see a copyright notice, with an instruction to press any key to get started. Just press any character key, and you will be immediately taken to the main menu. All major functions of the program are found there.

Entering the IPTraf command without any command-line parameters brings up the program's main menu. From there, you can select the facilities you want.

IPTraf determines and makes use of the maximum number of lines and columns on the terminal.

NoteNote
 

IPTraf does not have a SIGWINCH handler; it does not adjust itself when an xterm or some other X terminal is resized.

NoteTechnical note
 

IPTraf needs to refer to the terminfo database in /usr/share/terminfo. If the supplied executable program fails with Error opening terminal, your terminfo database may be located somewhere else. You can control the terminfo search path by using the TERMINFO environment variable. For example, if you're using the sh or bash shell, and your terminfo database is in /usr/lib/terminfo (typical for Slackware distributions), you can use the commands: 

TERMINFO=/usr/lib/terminfo
export TERMINFO

You can place these commands in your ~/.profile or the systemwide /etc/profile startup files.

You can also create a symbolic link named /usr/share/terminfo to let it point to your existing terminfo (assuming again your terminfo is in /usr/lib/terminfo):

ln -s /usr/lib/terminfo /usr/share/terminfo

Or you can recompile your program to use your existing ncurses library installation. If you do this, make sure you have ncurses 4.2 or later.

<<< PreviousHomeNext >>>
Upgrading from Earlier VersionsUpCommand-line Options
iptraf-ng-1.1.4/Documentation/statbreakdowns.html0000664000076400007640000000765112173477702022443 0ustar npajkovsnpajkovs Statistical Breakdowns
IPTraf User's Manual
<<< PreviousNext >>>

Statistical Breakdowns

Statistical breakdowns contain two facilities that break down traffic counts by either packet size or TCP/UDP port.

Packet Sizes

The packet size breakdown facility used to be incorporated into the detailed interface statistics. It has since been moved to its own facility. It is entered by selecting Statistical Breakdowns/By packet size.

The packet size breakdown takes the interface's Maximum Transmission Unit (MTU) size and divides it into 20 brackets, each bracket containing a range of sizes. As a packet is captured, its size is determined and the appropriate bracket is incremented.

This facility provides an idea as to the packet sizes passing over your network, and can aid in network (re)design decisions.

Figure 1. The packet size statistical breakdown

If logging is enabled, copies of the statistics are written at regular intervals to a log file. The default log file name is packet_size-iface.log where iface is the selected interface for this session (for example, packet_size-eth0.log).

IPTraf's filters do not affect this facility.

The packet size breakdown can also be invoked straight from the command line by specifying the -z iface parameter. The interface parameter is required. For example, this command runs the facility on interface eth0.

iptraf -z eth0

When started from the command line, the log filename and log interval can be specified with the -L and -I parameters respectively. See the Command-line Parameters section above for more information.

To exit, press X or Ctrl+X.

<<< PreviousHomeNext >>>
Detailed Interface Statistics TCP and UDP Traffic Statistics
iptraf-ng-1.1.4/Documentation/stylesheet-images/0000775000076400007640000000000012173477702022145 5ustar npajkovsnpajkovsiptraf-ng-1.1.4/Documentation/stylesheet-images/next.gif0000664000076400007640000000170412173477702023614 0ustar npajkovsnpajkovsGIF87a#÷„Œ!Œ!)”)1œ1BœBJ¥JR­Rc­ckµk„½„ŒÆŒ”Δ¥Î¥­Ö­µÞµÆÞÆÎçÎÖïÖçïçï÷ïÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ,#©+H° Áƒ*\È°¡Ã‚L(!âć %pQ† "8T@€€À(¦>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~€€€‚‚‚ƒƒƒ„„„………†††‡‡‡ˆˆˆ‰‰‰ŠŠŠ‹‹‹ŒŒŒŽŽŽ‘‘‘’’’“““”””•••–––———˜˜˜™™™ššš›››œœœžžžŸŸŸ   ¡¡¡¢¢¢£££¤¤¤¥¥¥¦¦¦§§§¨¨¨©©©ªªª«««¬¬¬­­­®®®¯¯¯°°°±±±²²²³³³´´´µµµ¶¶¶···¸¸¸¹¹¹ººº»»»¼¼¼½½½¾¾¾¿¿¿ÀÀÀÁÁÁÂÂÂÃÃÃÄÄÄÅÅÅÆÆÆÇÇÇÈÈÈÉÉÉÊÊÊËËËÌÌÌÍÍÍÎÎÎÏÏÏÐÐÐÑÑÑÒÒÒÓÓÓÔÔÔÕÕÕÖÖÖ×××ØØØÙÙÙÚÚÚÛÛÛÜÜÜÝÝÝÞÞÞßßßàààáááâââãããäääåååæææçççèèèéééêêêëëëìììíííîîîïïïðððñññòòòóóóôôôõõõööö÷÷÷øøøùùùúúúûûûüüüýýýþþþÿÿÿ,þÿ HðœAƒ*Ø«¥R:[˜ð1F¥¬{Çñœ1J”&R<÷ÐÅÎ(ÕZø®ÔÊ“[öªHi&L‚5 :+u³b)“öL¸S`Q‚ÆzÕRÚËÛA„ÿJ‹êí5k¥ÕræÍš3F„ F¤tnë9© · <—Ò˜³9M½u élF²ßQ£E‰”=5k-5öŽ¤·»Sîáz˜Ò¿wÖ=ëQb½sTö¸$eJ{Jq\³Ç«±=@žýWËšÀZ!×lž3ƦÂR±Æ<-%3!c[BŽ*òŸÓã'{ÙÆšxèÎá¯yýǨøÀ^” Süj l¿ÃÄŠQî9o;µ6‡‰$HÜÚ;iptraf-ng-1.1.4/Documentation/stylesheet-images/prev.gif0000664000076400007640000000166012173477702023613 0ustar npajkovsnpajkovsGIF87a#÷„Œ!Œ!)”)1œ1BœBJ¥JR­Rkµks½s„½„ŒÆŒ”Δ¥Î¥­Ö­ÆÞÆÎçÎÖïÖçïçï÷ïÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ,#•)H° Áƒ*\È°¡CƒH|ð°b‚P±¡‚( @‘":ü(P`DÀ@ œ4À‘¡ Œ¤€‚  ÐÀÓž>A,J¨‚¡$ õ(u Uœ0Ùð"A zh@’#X‡¤A¢@ H˜@W¥ß¿€; ;iptraf-ng-1.1.4/Documentation/stylesheet-images/tip.gif0000664000076400007640000000200512173477702023425 0ustar npajkovsnpajkovsGIF87a÷  !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~€€€‚‚‚ƒƒƒ„„„………†††‡‡‡ˆˆˆ‰‰‰ŠŠŠ‹‹‹ŒŒŒŽŽŽ‘‘‘’’’“““”””•••–––———˜˜˜™™™ššš›››œœœžžžŸŸŸ   ¡¡¡¢¢¢£££¤¤¤¥¥¥¦¦¦§§§¨¨¨©©©ªªª«««¬¬¬­­­®®®¯¯¯°°°±±±²²²³³³´´´µµµ¶¶¶···¸¸¸¹¹¹ººº»»»¼¼¼½½½¾¾¾¿¿¿ÀÀÀÁÁÁÂÂÂÃÃÃÄÄÄÅÅÅÆÆÆÇÇÇÈÈÈÉÉÉÊÊÊËËËÌÌÌÍÍÍÎÎÎÏÏÏÐÐÐÑÑÑÒÒÒÓÓÓÔÔÔÕÕÕÖÖÖ×××ØØØÙÙÙÚÚÚÛÛÛÜÜÜÝÝÝÞÞÞßßßàààáááâââãããäääåååæææçççèèèéééêêêëëëìììíííîîîïïïðððñññòòòóóóôôôõõõööö÷÷÷øøøùùùúúúûûûüüüýýýþþþÿÿÿ,êÿ HðœAƒ*xÎX)J¥"BtvoaÂ{½&ž»·±!%JÎ,2„èM¤3ˆïQêUQä¿s¥j)TÙK!Ìs W&tVªåÀ{{B¬ÁY°TI†¥ˆ¼7‚¥yF•¹Ð›Ñ…*‰^UÈhϪ k…„é“`Ö”xŽÒËž )åH»vä[¨?ÇÐ]ØömÝ÷ôªåëö&VÁ½¹ý'öð^…¥Bþ³êxpBÀ#ÏD¬°WÍVñ2 ±g-O¼z3&™ £ÖkQ«ÐÙk‘ý='Û˜ËÉ”=x"m‹çŠŒ|ü_@;iptraf-ng-1.1.4/Documentation/stylesheet-images/up.gif0000664000076400007640000000163212173477702023262 0ustar npajkovsnpajkovsGIF87a#÷„Œ!Œ!)”)1œ1BœBc­ckµk„½„ŒÆŒ”ΔµÞµÆÞÆÎçÎÖïÖçïçï÷ïÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ,##H° Áƒ*\Èpàƒ DhÀ`„† €Œˆ@ ƒ €D(’d ,(°`¥Á–KF@Pò›qîÌ©P‚Bàó¨Ã "0P“ÀƒTrL€ jNjjMÈs¬B|4˶m€;iptraf-ng-1.1.4/Documentation/timers.html0000664000076400007640000001471312173477702020710 0ustar npajkovsnpajkovs Timers
IPTraf User's Manual
<<< PreviousConfiguring IPTrafNext >>>

Timers

The Timers... submenu allows you to IPTraf's interval and timeout functions.

Figure 2. The Timers configuration submenu

TCP Timeout

This figure determines the amount of time (in minutes) a connection entry may remain idle before it becomes eligible for replacement by a new connection. The default is 15 minutes. You may want to reduce this on an isolated (not connected to the Internet) LAN or a LAN connected to the Internet with high-speed links. Just enter the new value and press Enter. You can press Ctrl+X to leave the current value unchanged.

Log Interval

This figure determines the number of minutes between logging of interface statistics, TCP/UDP figures, and LAN host statistics. The default is 60 minutes. This figure is meaningless if logging is disabled.

This configuration item can be overridden with the -I when a facility is directly invoked from the command line (not accessed via the main menu), and remains effective for that particular session. The configured value is not affected.

Screen Update Interval

This value determines the rate in seconds at which the screen is updated. The default is 0, which means the screen is updated as fast as possible, giving close-to-realtime reflection of network activity. However, this high-speed update can cause incredible amounts of traffic if IPTraf is run on a remote terminal (e.g. a Telnet or Secure Shell session). You can set this to a higher value, such as 1 or 2 seconds to slow down the updates.

This figure does not affect the rate of data capture. Only the screen refresh is affected. The figures are still updated as fast as possible, although the figure display will no longer be as close to realtime.

The default setting is 0, which shouldn't be a problem on the console. Set it to a slightly higher value on remote terminals or slow links. The setting affects all monitoring facilities.

NoteNote
 

Updating the screen is one of the slowest operations in a program. Older versions of IPTraf had a problem once network activity became very high. Because each packet caused a screen update, IPTraf began spending more time with the screen updates, causing a loss of packets once network activity reached a certain point.

However, since many users like rapid counts on their screen, a compromise was incorporated. Even when the screen update interval is set to 0, there is still a 50ms delay between screen updates (except the LAN station monitor, which has a 100 ms delay). This is still visually fast, but provides more time to the packet capture routine. Higher delays may result in better accuracy of counts and activity.

In any case, this setting only affects screen updates. Capture still proceeds as fast as possible.

TCP closed/idle persistence

This parameter determines the interval (in minutes) at which the IP Traffic Monitor clears from the TCP display window all closed, idle, and timed out entries. Enter 0 to keep such entries on the screen indefinitely, disappearing only when replaced by new connections.

NoteNote
 

The TCP timeout... option only tells IPTraf how long it should take before a connection should be considered idle and open to replacement by new connections. This does not determine how long it remains onscreen. The TCP closed/idle persistence... parameter flushes entries that have been closed or reset, or idle for the number of minutes defined by the TCP timeout... option.

<<< PreviousHomeNext >>>
Configuring IPTrafUpCustom Information
iptraf-ng-1.1.4/Documentation/updates.html0000664000076400007640000000437212173477702021052 0ustar npajkovsnpajkovs Screen Update Delays
IPTraf User's Manual
<<< PreviousPreparing to Use IPTrafNext >>>

Screen Update Delays

Older versions of IPTraf updated the screen as soon as a packet was received. However, screen update is one of the slowest operations the program performs. Since version 1.3, a configuration option has been available to control screen update speed.

See the Screen update interval... configuration option under the Configuration chapter of this manual.

<<< PreviousHomeNext >>>
Instances and LoggingUpSupported Network Interfaces
iptraf-ng-1.1.4/Documentation/upgrading.html0000664000076400007640000000450512173477702021363 0ustar npajkovsnpajkovs Upgrading from Earlier Versions
IPTraf User's Manual
<<< PreviousGetting StartedNext >>>

Upgrading from Earlier Versions

IPTraf 3.0 is a major revision from IPTraf 2.7. The filter subsystem has been completely redesigned and as such, is incompatible with previous filter formats. Therefore old IPTraf filters can no longer be used. The installation procedure for IPTraf 3.0 will rename the filter list files but not delete them.

If you install a distribution package (e.g. RPM, dpkg), old filters may still appear in the filter selection list but the new IPTraf version will be unable to load them.

<<< PreviousHomeNext >>>
InstallationUpStarting and Stopping IPTraf
iptraf-ng-1.1.4/Documentation/version0000664000076400007640000000000612173477702020115 0ustar npajkovsnpajkovs1.0.0 iptraf-ng-1.1.4/Documentation/version.awk0000664000076400007640000000002312173477702020675 0ustar npajkovsnpajkovs{print $1 "." $2} iptraf-ng-1.1.4/Documentation/x1077.html0000664000076400007640000000572612173477702020177 0ustar npajkovsnpajkovs Additional Information
IPTraf User's Manual
<<< PreviousThe IP Traffic MonitorNext >>>

Additional Information

When started from the main menu and logging is enabled, the IP traffic monitor prompts you for a log file name. The default name is ip_traffic-n.log (where n is what instance of the traffic monitor this is (1, 2, 3, and so on). (e.g. if this is the first instance, the default file name will be ip_traffic-1.log.)

When started with the -i parameter, the log filename can be specified with the -L parameter. See the Command-line Parameters section above for more information.

On busy networks, the display may become cluttered with traffic you're not interested in. To control the traffic monitor's output, you can apply a filter. See Chapter 7, Filters for more information on IPTraf's filters.

At any time, you can press X or Q to return to the main menu (or back to the shell if the monitor was started with iptraf -i).

<<< PreviousHomeNext >>>
Lower WindowUpNetwork Interface Statistics
iptraf-ng-1.1.4/FAQ0000664000076400007640000000733112173477703014237 0ustar npajkovsnpajkovsThis is the beginning of a FAQ for IPTraf. --- Q: Could you include support for interface? A: Please read the README.interfaces file for what is needed for a new interface type to be supported. Q: I try to start IPTraf but it tells me that is already active in another process. But I'm sure IPTraf isn't running at the time! A: Probably due to a faulty installation or abnormal termination. If you're sure you've installed the software properly, you may have stale lock files from a previous abort. Just issue the iptraf command with the -f parameter (iptraf -f). This will override stale locks and IPTraf should proceed normally. Q: I want to configure IPTraf but it tells me only the first instance can configure. A: Similar to the previous question. Issue the iptraf command with the -f parameter. NOTE: Versions prior to 2.6.2 did not properly erase stale lock files when IPTraf aborted due to an insufficient screen size. Q: Is there a way to make IPTraf run in the background and collect statistics to a log file? A: Prior to 2.1.0, there was no elegant way of doing so. Version 2.1.0 and later have the -B command-line parameter to force IPTraf to dump all its screen output into oblivion and move into the background. See the manual for details on background operation. Q: I get the error message "Unable to open raw socket". A: If you're using IPTraf 2.x, you must be running version 2.2.x of the Linux kernel. Furthermore, the "Packet Socket" driver must be installed. Most stock kernels include this driver already. Be sure to include it if you're compiling a custom kernel. Q: I'm getting a "cannot allocate memory" error but I've got loads of memory available. A: The "cannot allocate memory" error is a reponse to the "segmentation fault" condition (SIGSEGV). If you're sure it's not a memory condition on your machine, please report it to me, and if possible, include a gdb trace or strace output to help me debug. Q: Is there Web/HTTP/HTML/whatever version available? A: I've received several requests for this one. Perhaps in time, I've been caught up in some work and some personal stuff. Suggestions on implementation of such a feature are welcome. (Addition: I hope to get this incorporated into the next major release. Who knows? If I have the time, I might be able to WAP it in the near future :)) Q: It would be great if the statistics could be sorted. A: As of version 2.3, sorting is now available with the IP traffic monitor, TCP/UDP statistical breakdown, and LAN station monitor. Sorting is invoked by pressing the S key and selecting a sort criterion. (Note: versions 2.5.0 and later sorts the entries with the Quicksort algorithm, which significantly cuts down the time to sort.) Q: I want to run IPTraf from a Secure Shell terminal but the output of the program causes a heavy load on the network. What should I do? A: The output of the program is returned over the network, which in turn tells IPTraf about the new traffic, which IPTraf then outputs, which is then sent over the network... in other words, it's a feedback effect. The solution to this is to set the screen update interval to 1 second or more. To do that, go to Configuration... then select Timers... then Screen update interval... and enter the interval value in seconds. One second should be fine. Q: Does IPTraf run on FreeBSD? A: I wish it did. IPTraf was designed from the ground up to use the Linux PF_PACKET mechanism, not libpcap. The main reasons for doing this are less overhead and more control over the captured packets. Since Linux kernel 2.2, the raw socket API featured more goodies, like the direction of the packets. I hope to be able to successfully port to FreeBSD, but I do not have the resources to do so now. iptraf-ng-1.1.4/GEN-VERSION-FILE0000775000076400007640000000141112173477703016075 0ustar npajkovsnpajkovs#!/bin/bash GVF=VERSION-FILE DEF_VER=1.1.4 LF=' ' # First see if there is a version file (included in release tarballs), # then try git-describe, then default. if test -f version then VN=$(cat version) || VN="$DEF_VER" elif test -d .git -o -f .git && VN=$(git describe --tags --match "[0-9]*" --abbrev=4 HEAD 2>/dev/null) && case "$VN" in *$LF*) (exit 1) ;; [0-9]*) git update-index -q --refresh test -z "$(git diff-index --name-only HEAD --)" || VN="$VN-dirty" esac then VN=$(echo "$VN" | sed -e 's/-/./g'); else VN="$DEF_VER" fi VN=$(expr "$VN" : v*'\(.*\)') if test -r $GVF then VC=$(sed -e 's/^IPTRAF_VERSION = //' <$GVF) else VC=unset fi test "$VN" = "$VC" || { echo >&2 "IPTRAF_VERSION = $VN" echo "IPTRAF_VERSION = $VN" >$GVF } iptraf-ng-1.1.4/INSTALL0000664000076400007640000001705112173477703014736 0ustar npajkovsnpajkovsBasic Installation ================== These are generic installation instructions. The `configure' shell script attempts to guess correct values for various system-dependent variables used during compilation. It uses those values to create a `Makefile' in each directory of the package. It may also create one or more `.h' files containing system-dependent definitions. Finally, it creates a shell script `config.status' that you can run in the future to recreate the current configuration, a file `config.cache' that saves the results of its tests to speed up reconfiguring, and a file `config.log' containing compiler output (useful mainly for debugging `configure'). If you need to do unusual things to compile the package, please try to figure out how `configure' could check whether to do them, and mail diffs or instructions to the address given in the `README' so they can be considered for the next release. If at some point `config.cache' contains results you don't want to keep, you may remove or edit it. The file `configure.in' is used to create `configure' by a program called `autoconf'. You only need `configure.in' if you want to change it or regenerate `configure' using a newer version of `autoconf'. The simplest way to compile this package is: 1. `cd' to the directory containing the package's source code and type `./configure' to configure the package for your system. If you're using `csh' on an old version of System V, you might need to type `sh ./configure' instead to prevent `csh' from trying to execute `configure' itself. Running `configure' takes awhile. While running, it prints some messages telling which features it is checking for. 2. Type `make' to compile the package. 3. Optionally, type `make check' to run any self-tests that come with the package. 4. Type `make install' to install the programs and any data files and documentation. 5. You can remove the program binaries and object files from the source code directory by typing `make clean'. To also remove the files that `configure' created (so you can compile the package for a different kind of computer), type `make distclean'. There is also a `make maintainer-clean' target, but that is intended mainly for the package's developers. If you use it, you may have to get all sorts of other programs in order to regenerate files that came with the distribution. Compilers and Options ===================== Some systems require unusual options for compilation or linking that the `configure' script does not know about. You can give `configure' initial values for variables by setting them in the environment. Using a Bourne-compatible shell, you can do that on the command line like this: CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure Or on systems that have the `env' program, you can do it like this: env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure Compiling For Multiple Architectures ==================================== You can compile the package for more than one kind of computer at the same time, by placing the object files for each architecture in their own directory. To do this, you must use a version of `make' that supports the `VPATH' variable, such as GNU `make'. `cd' to the directory where you want the object files and executables to go and run the `configure' script. `configure' automatically checks for the source code in the directory that `configure' is in and in `..'. If you have to use a `make' that does not supports the `VPATH' variable, you have to compile the package for one architecture at a time in the source code directory. After you have installed the package for one architecture, use `make distclean' before reconfiguring for another architecture. Installation Names ================== By default, `make install' will install the package's files in `/usr/local/bin', `/usr/local/man', etc. You can specify an installation prefix other than `/usr/local' by giving `configure' the option `--prefix=PATH'. You can specify separate installation prefixes for architecture-specific files and architecture-independent files. If you give `configure' the option `--exec-prefix=PATH', the package will use PATH as the prefix for installing programs and libraries. Documentation and other data files will still use the regular prefix. In addition, if you use an unusual directory layout you can give options like `--bindir=PATH' to specify different values for particular kinds of files. Run `configure --help' for a list of the directories you can set and what kinds of files go in them. If the package supports it, you can cause programs to be installed with an extra prefix or suffix on their names by giving `configure' the option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. Optional Features ================= Some packages pay attention to `--enable-FEATURE' options to `configure', where FEATURE indicates an optional part of the package. They may also pay attention to `--with-PACKAGE' options, where PACKAGE is something like `gnu-as' or `x' (for the X Window System). The `README' should mention any `--enable-' and `--with-' options that the package recognizes. For packages that use the X Window System, `configure' can usually find the X include and library files automatically, but if it doesn't, you can use the `configure' options `--x-includes=DIR' and `--x-libraries=DIR' to specify their locations. Specifying the System Type ========================== There may be some features `configure' can not figure out automatically, but needs to determine by the type of host the package will run on. Usually `configure' can figure that out, but if it prints a message saying it can not guess the host type, give it the `--host=TYPE' option. TYPE can either be a short name for the system type, such as `sun4', or a canonical name with three fields: CPU-COMPANY-SYSTEM See the file `config.sub' for the possible values of each field. If `config.sub' isn't included in this package, then this package doesn't need to know the host type. If you are building compiler tools for cross-compiling, you can also use the `--target=TYPE' option to select the type of system they will produce code for and the `--build=TYPE' option to select the type of system on which you are compiling the package. Sharing Defaults ================ If you want to set default values for `configure' scripts to share, you can create a site shell script called `config.site' that gives default values for variables like `CC', `cache_file', and `prefix'. `configure' looks for `PREFIX/share/config.site' if it exists, then `PREFIX/etc/config.site' if it exists. Or, you can set the `CONFIG_SITE' environment variable to the location of the site script. A warning: not all `configure' scripts look for a site script. Operation Controls ================== `configure' recognizes the following options to control how it operates. `--cache-file=FILE' Use and save the results of the tests in FILE instead of `./config.cache'. Set FILE to `/dev/null' to disable caching, for debugging `configure'. `--help' Print a summary of the options to `configure', and exit. `--quiet' `--silent' `-q' Do not print messages saying which checks are being made. `--srcdir=DIR' Look for the package's source code in directory DIR. Usually `configure' can determine that directory automatically. `--version' Print the version of Autoconf used to generate the `configure' script, and exit. `configure' also accepts some other, not widely useful, options. iptraf-ng-1.1.4/LICENSE0000664000076400007640000004310512173477703014711 0ustar npajkovsnpajkovs GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. iptraf-ng-1.1.4/Makefile0000664000076400007640000002622612173477703015351 0ustar npajkovsnpajkovs# The default target of this Makefile is this all:: # Define V=1 to have a more verbose compile. # # Define NO_PANEL if you don't want to use -lpanel. # # Define NEEDS_NCURSES5 if you need linking with ncurses5. # # Define NEEDS_NCURSESW5 if you need linking with ncursesw5. # # Define NEEDS_NCURSES6 if you need linking with ncurses6. # # Define NEEDS_NCURSESW6 if you need linking with ncursesw6. VERSION-FILE: FORCE @$(SHELL_PATH) ./GEN-VERSION-FILE -include VERSION-FILE CFLAGS = -g -O2 -Wall -W -std=gnu99 LDFLAGS = ALL_CFLAGS = $(CPPFLAGS) $(CFLAGS) ALL_LDFLAGS = $(LDFLAGS) STRIP ?= strip prefix = $(HOME) sbindir_relative = sbin sbindir = $(prefix)/$(sbindir_relative) mandir = $(prefix)/share/man sharedir = $(prefix)/share localedir = $(sharedir)/locale lib = lib man8dir = $(mandir)/man8 # DESTDIR= pathsep = : export prefix bindir sharedir sysconfdir gitwebdir localedir CC = cc RM = rm -f INSTALL = install RPMBUILD = rpmbuild TAR = tar ### --- END CONFIGURATION SECTION --- # Those must not be GNU-specific; they are shared with perl/ which may # be built by a different compiler. (Note that this is an artifact now # but it still might be nice to keep that distinction.) BASIC_CFLAGS = -I. -Isrc/ BASIC_LDFLAGS = # Guard against environment variables iptraf-h := iptraf-o := rvnamed-o := rvnamed-h := ALL_PROGRAMS = # Empty... EXTRA_PROGRAMS = ALL_PROGRAMS += iptraf-ng rvnamed-ng ifndef SHELL_PATH SHELL_PATH = /bin/sh endif iptraf-h += src/tui/input.h iptraf-h += src/tui/labels.h iptraf-h += src/tui/listbox.h iptraf-h += src/tui/menurt.h iptraf-h += src/tui/msgboxes.h iptraf-h += src/tui/winops.h iptraf-h += src/iptraf-ng-compat.h iptraf-h += src/parse-options.h iptraf-h += src/packet.h iptraf-h += src/tcptable.h iptraf-h += src/othptab.h iptraf-h += src/ifstats.h iptraf-h += src/deskman.h iptraf-h += src/hostmon.h iptraf-h += src/fltedit.h iptraf-h += src/cidr.h iptraf-h += src/fltselect.h iptraf-h += src/ipfilter.h iptraf-h += src/fltmgr.h iptraf-h += src/ipfrag.h iptraf-h += src/serv.h iptraf-h += src/servname.h iptraf-h += src/timer.h iptraf-h += src/ifaces.h iptraf-h += src/error.h iptraf-h += src/revname.h iptraf-h += src/log.h iptraf-h += src/pktsize.h iptraf-h += src/landesc.h iptraf-h += src/dirs.h iptraf-h += src/getpath.h iptraf-h += src/options.h iptraf-h += src/promisc.h iptraf-h += src/parseproto.h iptraf-h += src/addproto.h iptraf-h += src/arphdr.h iptraf-h += src/attrs.h iptraf-h += src/fltdefs.h iptraf-h += src/logvars.h iptraf-h += src/list.h iptraf-h += src/counters.h iptraf-h += src/rate.h iptraf-h += src/built-in.h iptraf-h += src/sockaddr.h iptraf-o += src/tui/input.o iptraf-o += src/tui/labels.o iptraf-o += src/tui/listbox.o iptraf-o += src/tui/menurt.o iptraf-o += src/tui/msgboxes.o iptraf-o += src/tui/winops.o iptraf-o += src/error.o iptraf-o += src/log.o iptraf-o += src/getpath.o iptraf-o += src/parseproto.o iptraf-o += src/fltselect.o iptraf-o += src/ipfilter.o iptraf-o += src/fltmgr.o iptraf-o += src/ipfrag.o iptraf-o += src/serv.o iptraf-o += src/servname.o iptraf-o += src/timer.o iptraf-o += src/revname.o iptraf-o += src/pktsize.o iptraf-o += src/landesc.o iptraf-o += src/options.o iptraf-o += src/promisc.o iptraf-o += src/ifaces.o iptraf-o += src/usage.o iptraf-o += src/iptraf.o iptraf-o += src/itrafmon.o iptraf-o += src/wrapper.o iptraf-o += src/parse-options.o iptraf-o += src/packet.o iptraf-o += src/tcptable.o iptraf-o += src/othptab.o iptraf-o += src/ifstats.o iptraf-o += src/detstats.o iptraf-o += src/deskman.o iptraf-o += src/hostmon.o iptraf-o += src/fltedit.o iptraf-o += src/cidr.o iptraf-o += src/counters.o iptraf-o += src/rate.o iptraf-o += src/capture-pkt.o iptraf-o += src/sockaddr.o rvnamed-o += src/rvnamed.o rvnamed-o += src/getpath.o rvnamed-o += src/sockaddr.o rvnamed-o += src/usage.o -include config.mak.autogen -include config.mak ifndef sysconfdir ifeq ($(prefix),/usr) sysconfdir = /etc else sysconfdir = etc endif endif ifdef CHECK_HEADER_DEPENDENCIES COMPUTE_HEADER_DEPENDENCIES = no USE_COMPUTED_HEADER_DEPENDENCIES = endif ifndef COMPUTE_HEADER_DEPENDENCIES COMPUTE_HEADER_DEPENDENCIES = auto endif ifeq ($(COMPUTE_HEADER_DEPENDENCIES),auto) dep_check = $(shell $(CC) $(ALL_CFLAGS) \ -c -MF /dev/null -MMD -MP -x c /dev/null -o /dev/null 2>&1; \ echo $$?) ifeq ($(dep_check),0) override COMPUTE_HEADER_DEPENDENCIES = yes else override COMPUTE_HEADER_DEPENDENCIES = no endif endif ifeq ($(COMPUTE_HEADER_DEPENDENCIES),yes) USE_COMPUTED_HEADER_DEPENDENCIES = YesPlease else ifneq ($(COMPUTE_HEADER_DEPENDENCIES),no) $(error please set COMPUTE_HEADER_DEPENDENCIES to yes, no, or auto \ (not "$(COMPUTE_HEADER_DEPENDENCIES)")) endif endif ifndef NCURSES_LDFLAGS ifdef NEEDS_NCURSES5 NCURSES_CFLAGS := $(shell ncurses5-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncurses5-config --libs 2>/dev/null) ifndef NO_PANEL NCURSES_LDFLAGS += -lpanel endif endif endif ifndef NCURSES_LDFLAGS ifdef NEEDS_NCURSESW5 NCURSES_CFLAGS := $(shell ncursesw5-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncursesw5-config --libs 2>/dev/null) ifndef NO_PANEL NCURSES_LDFLAGS += -lpanel endif endif endif ifndef NCURSES_LDFLAGS ifdef NEEDS_NCURSES6 NCURSES_CFLAGS := $(shell ncurses6-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncurses6-config --libs 2>/dev/null) ifndef NO_PANEL NCURSES_LDFLAGS += -lpanel endif endif endif ifndef NCURSES_LDFLAGS ifdef NEEDS_NCURSESW6 NCURSES_CFLAGS := $(shell ncursesw6-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncursesw6-config --libs 2>/dev/null) ifndef NO_PANEL NCURSES_LDFLAGS += -lpanel endif endif endif # try find ncuses by autodetect ifndef NCURSES_LDFLAGS ifneq ($(shell ncursesw6-config --libs 2>/dev/null),) NCURSES_CFLAGS := $(shell ncursesw6-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncursesw6-config --libs 2>/dev/null) else ifneq ($(shell ncurses6-config --libs 2>/dev/null),) NCURSES_CFLAGS := $(shell ncurses6-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncurses6-config --libs 2>/dev/null) else ifneq ($(shell ncursesw5-config --libs 2>/dev/null),) NCURSES_CFLAGS := $(shell ncursesw5-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncursesw5-config --libs 2>/dev/null) else ifneq ($(shell ncurses5-config --libs 2>/dev/null),) NCURSES_CFLAGS := $(shell ncurses5-config --cflags 2>/dev/null) NCURSES_LDFLAGS := $(shell ncurses5-config --libs 2>/dev/null) endif ifneq ($(NCURSES_LDFLAGS),) ifndef NO_PANEL NCURSES_LDFLAGS += -lpanel endif endif endif QUIET_SUBDIR0 = +$(MAKE) -C # space to separate -C and subdir QUIET_SUBDIR1 = ifneq ($(findstring $(MAKEFLAGS),w),w) PRINT_DIR = --no-print-directory else # "make -w" NO_SUBDIR = : endif ifneq ($(findstring $(MAKEFLAGS),s),s) ifndef V QUIET_CC = @echo ' ' CC $@; QUIET_LINK = @echo ' ' LINK $@; QUIET_GEN = @echo ' ' GEN $@; QUIET_SUBDIR0 = +@subdir= QUIET_SUBDIR1 = ;$(NO_SUBDIR) echo ' ' SUBDIR $$subdir; \ $(MAKE) $(PRINT_DIR) -C $$subdir export V export QUIET_GEN export QUIET_BUILT_IN endif endif DESTDIR_SQ = $(subst ','\'',$(DESTDIR)) sbindir_SQ = $(subst ','\'',$(sbindir)) ALL_CFLAGS += $(BASIC_CFLAGS) ALL_LDFLAGS += $(BASIC_LDFLAGS) export TAR INSTALL DESTDIR SHELL_PATH ### Build rules SHELL = $(SHELL_PATH) #all:: shell_compatibility_test #please_set_SHELL_PATH_to_a_more_modern_shell: # @$$(:) #shell_compatibility_test: please_set_SHELL_PATH_to_a_more_modern_shell all:: $(ALL_PROGRAMS) iptraf-ng: $(iptraf-o) $(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ \ $(iptraf-o) $(ALL_LDFLAGS) $(NCURSES_LDFLAGS) src/deskman.o src/iptraf.o: VERSION-FILE src/deskman.o src/iptraf.o src/capture-pkt.o: EXTRA_CPPFLAGS = \ -DIPTRAF_VERSION='"$(IPTRAF_VERSION)"' \ -DIPTRAF_NAME='"iptraf-ng"' rvnamed-ng: $(rvnamed-o) $(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ \ $(rvnamed-o) $(ALL_LDFLAGS) configure: configure.ac $(QUIET_GEN)$(RM) $@ $<+ && \ sed -e 's/@@IPTRAF_VERSION@@/$(IPTRAF_VERSION)/g' \ $< > $<+ && \ autoconf -o $@ $<+ && \ $(RM) $<+ OBJECTS := $(sort $(iptraf-o) $(rvnamed-o)) dep_files := $(foreach f,$(OBJECTS),$(dir $f).depend/$(notdir $f).d) dep_dirs := $(addsuffix .depend,$(sort $(dir $(OBJECTS)))) ifeq ($(COMPUTE_HEADER_DEPENDENCIES),yes) $(dep_dirs): @mkdir -p $@ missing_dep_dirs := $(filter-out $(wildcard $(dep_dirs)),$(dep_dirs)) dep_file = $(dir $@).depend/$(notdir $@).d dep_args = -MF $(dep_file) -MMD -MP ifdef CHECK_HEADER_DEPENDENCIES $(error cannot compute header dependencies outside a normal build. \ Please unset CHECK_HEADER_DEPENDENCIES and try again) endif endif .SUFFIXES: ifdef PRINT_HEADER_DEPENDENCIES $(OBJECTS): %.o: %.c FORCE echo $^ ifndef CHECK_HEADER_DEPENDENCIES $(error cannot print header dependencies during a normal build. \ Please set CHECK_HEADER_DEPENDENCIES and try again) endif endif ifndef PRINT_HEADER_DEPENDENCIES ifdef CHECK_HEADER_DEPENDENCIES $(OBJECTS): %.o: %.c $(dep_files) FORCE @set -e; echo CHECK $@; \ missing_deps="$(missing_deps)"; \ if test "$$missing_deps"; \ then \ echo missing dependencies: $$missing_deps; \ false; \ fi endif endif ifndef CHECK_HEADER_DEPENDENCIES $(OBJECTS): %.o: %.c $(missing_dep_dirs) $(QUIET_CC)$(CC) -o $*.o -c $(dep_args) $(NCURSES_CFLAGS) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $< endif ifdef USE_COMPUTED_HEADER_DEPENDENCIES # Take advantage of gcc's on-the-fly dependency generation # See . dep_files_present := $(wildcard $(dep_files)) ifneq ($(dep_files_present),) include $(dep_files_present) endif else # Dependencies on header files, for platforms that do not support # the gcc -MMD option. # # Dependencies on automatically generated headers such as common-cmds.h # should _not_ be included here, since they are necessary even when # building an object for the first time. # # XXX. Please check occasionally that these include all dependencies # gcc detects! $(OBJECTS): $(iptraf-h) endif ### Maintainer's dist rules iptraf-ng.spec: iptraf-ng.spec.in sed -e 's/@@IPTRAF_VERSION@@/$(IPTRAF_VERSION)/g' < $< > $@+ mv $@+ $@ IPTRAF_TARNAME = iptraf-ng-$(IPTRAF_VERSION) dist: iptraf-ng.spec configure @mkdir -p $(IPTRAF_TARNAME) @cp iptraf-ng.spec configure $(IPTRAF_TARNAME) @cp --parents `git ls-files` $(IPTRAF_TARNAME) @echo $(IPTRAF_VERSION) > $(IPTRAF_TARNAME)/version $(TAR) cf $(IPTRAF_TARNAME).tar $(IPTRAF_TARNAME) @$(RM) -rf $(IPTRAF_TARNAME) gzip -f -9 $(IPTRAF_TARNAME).tar rpm: dist $(RPMBUILD) \ --define "_source_filedigest_algorithm md5" \ --define "_binary_filedigest_algorithm md5" \ -ta $(IPTRAF_TARNAME).tar.gz ## TODO: use asciidoc to generate mans ### Installation rules install: all @echo $(DESTDIR_SQ)$(man8dir) $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(sbindir_SQ)' $(INSTALL) $(ALL_PROGRAMS) '$(DESTDIR_SQ)$(sbindir_SQ)' $(INSTALL) -d -m 755 $(DESTDIR)$(man8dir) $(INSTALL) -m 644 src/iptraf-ng.8 $(DESTDIR)$(man8dir) $(INSTALL) -m 644 src/rvnamed-ng.8 $(DESTDIR)$(man8dir) ### Cleaning rules distclean: clean $(RM) configure clean: $(RM) src/*.o src/tui/*.o $(RM) $(ALL_PROGRAMS) $(RM) -r autom4te.cache $(RM) -r $(dep_dirs) $(RM) *.spec $(RM) $(IPTRAF_TARNAME).tar.gz $(RM) config.log config.mak.autogen config.mak.append config.status config.cache $(RM) VERSION-FILE .PHONY: gtags gtags: $(QUIET_GEN) gtags .PHONY: clean distclean all install FORCE iptraf-ng-1.1.4/README0000664000076400007640000000570612173477703014571 0ustar npajkovsnpajkovs========================================================================== IPTraf 3.0 README -------------------------------------------------------------------------- See the RELEASE-NOTES for important update information. See the INSTALL file for installation instructions. -------------------------------------------------------------------------- DESCRIPTION ----------- IPTraf is a console-based network monitoring program for Linux that displays information about IP traffic. It returns such information as: Current TCP connections UDP, ICMP, OSPF, and other types of IP packets Packet and byte counts on TCP connections IP, TCP, UDP, ICMP, non-IP, and other packet and byte counts TCP/UDP counts by ports Packet counts by packet sizes Packet and byte counts by IP address Interface activity Flag statuses on TCP packets LAN station statistics This program can be used to determine the type of traffic on your network, and what kind of service is the most heavily used on what machines, among others. IPTraf works on Ethernet, FDDI, ISDN, PLIP, loopback, and SLIP/PPP interfaces. Updates and announcements are at the iptraf-ng@lists.fedorahosted.org, see README.contact for more information. IMPORTANT CHANGES ----------------- Important changes are detailed in the RELEASE-NOTES file, please take some time to read it. There are some changes in the log file names, and the policies on multiple instances have been somewhat relaxed. DISTRIBUTION NOTICE ------------------- This is the general release of IPTraf. IPTraf has been incorporated into the Debian GNU/Linux, Turbolinux and S.u.S.E. distributions, as well as the Trinux security toolkit distribution and Red Hat Powertools. Linux distributions may have tailored the IPTraf package to suit their purposes. Direct questions, comments or inquiries about a distribution-specific package to its maintainer. SYSTEM REQUIREMENTS ------------------- IPTraf 2 and later requires at least Linux kernel 2.2. It uses the new PF_PACKET socket family as its capture mechanism. This feature is new to the 2.2 kernel. Make sure you have the Packet Socket driver compiled in or installed as a module, or IPTraf will fail (and so will others like it: tcpdump, netwatch, etc). IPTraf also requires glibc 2.1 or later. COPYING AND DISTRIBUTION ------------------------ This software is OSI Certified Open Source Software OSI Certified is a certification mark of the Open Source Initiative. Redistribution and modification of this software is permitted under the terms of the GNU General Public License. See the included LICENSE file for details. FOR FURTHER INFORMATION ----------------------- Full information is in the manual in the Documentation directory. See also the CHANGES file for a record of fixes and new features. Updates and announcements are in the IPTraf Web page indicated above. Other README files contain some other bits of information. The RELEASE-NOTES file contains important release-specific information. iptraf-ng-1.1.4/README.contact0000664000076400007640000000154512173477703016220 0ustar npajkovsnpajkovs============================================================================ CONTACT INFORMATION ---------------------------------------------------------------------------- ================== Individual Contact ~~~~~~~~~~~~~~~~~~ IPTraf was written and primarily maintained by Gerard Paul Java (riker@seul.org). Fork was made by Nikola Pajkovsky(npajkovs@redhat.com). =============== Web information ~~~~~~~~~~~~~~~ The official IPTraf sites are http://cebu.mozcom.com/riker/iptraf and http://iptraf.seul.org. IPTraf-ng sites is https://fedorahosted.org/iptraf-ng/ ============ Mailing list ~~~~~~~~~~~~ One mailing list is available: iptraf-ng@lists.fedorahosted.org Please register yourself here: https://fedorahosted.org/mailman/listinfo/iptraf-ng === IRC and Jabber ~~~ I'm reachable on irc channel iptraf-ng@irc.freenode.net or jabber nikis@isgeek.info iptraf-ng-1.1.4/README.indent0000664000076400007640000000072012173477703016040 0ustar npajkovsnpajkovsSources are indented using the GNU indent program with the following arguments: --k-and-r-style --indent-level8 --blank-lines-after-declarations --blank-lines-after-procedures --braces-on-if-line --cuddle-else --space-special-semicolon --no-space-after-function-call-names --no-blank-before-sizeof --no-space-after-parentheses --continue-at-parentheses --line-length80 --comment-line-length80 --honour-newlines --case-indentation0 --break-before-boolean-operator iptraf-ng-1.1.4/README.interfaces0000664000076400007640000000507712173477703016714 0ustar npajkovsnpajkovs============================================================================ Supported Interface Information as of version 2.8, July 2002 ---------------------------------------------------------------------------- IPTraf has been slowly improving with its interface support since its first release. IPTraf currently supports the following types of links: Local loopback Ethernet (10 and 100 Mbps) SLIP and variants Asynchronous PPP over analog telephone lines Synchronous PPP over digital ISDN lines ISDN using raw IP encapsulation ISDN using Cisco-HDLC encapsulation FDDI (now includes Ethernet-emulating interfces) Frame Relay FRAD/DLCI interfaces (new as of IPTraf 2.5.0) PLIP (Parallel Line IP) Token Ring DVB satellite-receive interfaces SBNI long-range modem interfaces Wireless LAN interfaces Free s/WAN logical interfaces IPsec logical interfaces Some tunnelling interfaces Some bridging interfaces ADDITIONAL INTERFACE SUPPORT As much as I would like to support every concievable interface in existence, we know that's just not possible. I myself do not have a lot of interface types. However, that does not mean I'm unwilling to support more. So here's the deal. If you'd like me to include support for a new type of interface I will need this information as much as possible: * Resulting link type in spkt_family after a recvfrom() on a (PF_PACKET, SOCK_RAW) socket (ARPHRD_ETHER, ARPHRD_PPP, etc). * Standard interface name for the type of network medium (eth0, eth1, ppp0, etc) after the recvfrom() mentioned above. * Packet structure. How many bytes are there in its data-link header (with Ethernet, there are 14, with FDDI, 21) as returned by recvfrom on a (PF_PACKET, SOCK_RAW) socket? * Pointers to other sources of information if possible. This is necessary for cases like ISDN, which claim to be ARPHRD_ETHER, but have completely different frame structures, so I needed the appropriate ioctl() information. Token Ring packets may have a RIF structure or not. These factors need to be taken into consideration. Then finally, if you come up with a request for support for a new interface, I'd really like an offer to have it tested, obviously, since I do not have the interface myself (for example, my country is primarily leased-line territory, and ISDN is only starting, and it isn't even in my city yet). If I do not receive an offer to test, then support cannot be included. Patches, even quick-and-dirty ones, are very much welcome. All information and patches will be fully credited in the CHANGES file. Looking forward to serving you. -- Gerard iptraf-ng-1.1.4/README.platforms0000664000076400007640000000167112173477703016574 0ustar npajkovsnpajkovs============================================================================ IPTraf Development Platform Information ---------------------------------------------------------------------------- As of IPTraf 2.8.0, development is primarily done on an Intel 1.6-GHz Pentium 4 development workstation, as well as a lower-end 400 MHz Pentium II. I have to make it clear that my development platform is Linux for the x86 family of processors *only*. I cannot always debug or troubleshoot quirks specific to non-x86 machines, as much as I would like to. However, I know I have to be accommodating so if you do give me a bug report, I will try my best to fix it, but I need: 1. All the information needed describing the bug 2. To the best extent possible, gdb or strace outputs. 3. An offer to test the fixes. Without these, especially #3, I cannot exert effort on the quirk. I'm sorry, but it's just impossible without the necessary machines. iptraf-ng-1.1.4/README.rvnamed0000664000076400007640000000502212173477703016213 0ustar npajkovsnpajkovs============================================================================ README DOCUMENT FOR RVNAMED ---------------------------------------------------------------------------- DESCRIPTION ----------- rvnamed is a supplementary program distributed with IPTraf 1.1 and later. This is a reverse name resolution daemon used by IPTraf to resolve IP addresses to host names in the background, keeping IPTraf from waiting until the lookup is completed. Starting with version 1.1.0, if Reverse Lookup is enabled in the Options menu, the IP Traffic Monitor will attempt to start rvnamed. If for some reason rvnamed is already running, IPTraf will use it immediately. Otherwise, it will attempt to start rvnamed. As of IPTraf 1.2.0, the rvnamed is placed together with the main IPTraf executable in /usr/local/bin. When the traffic monitor is done, IPTraf tells rvnamed to quit. PROTOCOL -------- rvnamed and IPTraf communicate with each other with the BSD UNIX domain socket IPC facility. They use datagram sockets. rvnamed recognizes only 4 types of messages: RVN_HELLO the Hello packet. This simply causes rvnamed to throw it back to IPTraf, telling it rvnamed is active. RVN_REQUEST a reverse lookup request. This message includes an IP address to resolve. When rvnamed receives this request, it checks its internal cache to see if this IP address is already resolved or being resolved. If it isn't in the cache yet, rvnamed forks off a copy which resolves in the background, while it returns the IP address in the meantime. Subsequent requests will get the IP address until such time that the child has completed the resolution, at which time, a request will get the host name in reply. RVN_REPLY rvnamed marks reply packets with this tag. Reply packets contain the resolved host name or the ASCII representation of the IP address, and an indicator of the state of the resolution for this address (NOTRESOLVED, RESOLVING, or RESOLVED). RVN_QUIT Tells rvnamed to terminate. The datagram structure and #define's are found in the rvnamed.h header file. Important rvnamed messages are written to /var/log/iptraf/rvnamed.log. IPTraf 2.5.0 and 2.6.0 refined rvnamed's operation by including timeouts for child processes (5 minutes) and better management of the internal IP address/FQDN cache. See the CHANGES file. To reduce overhead, IPTraf will query rvnamed only once per invocation of the IP traffic monitor. rvnamed should work properly with a correct installation. Report any problems to me at riker@seul.org. iptraf-ng-1.1.4/RELEASE-NOTES0000664000076400007640000001041212173477703015570 0ustar npajkovsnpajkovs=============================================================================== RELEASE NOTES FOR IPTRAF 3.0.0 ------------------------------------------------------------------------------- This file contains important release information for IPTraf 3.0.0. Please read it in full before running this new version for the first time. ------------------------------------------------------------------------------- CONTENTS OF THIS DOCUMENT ------------------------- UPGRADING TO IPTRAF 3.0. NEW FILTER BEHAVIOR BUG FIXES ADDITIONAL NETWORK INTERFACE SUPPORT DOCUMENTATION FORMAT CHANGES FILE FORMATS CODE CHANGES UPGRADING TO IPTRAF 3.0 ----------------------- IPTraf 3.0 is a major release. The most significant change is a completely redesigned IP filtering system. Starting with IPTraf 3.0, all IP traffic can be filtered with a unified set of filter rules, unlike previous versions wherein separate filters had to be defined for TCP, UDP, and all other IP traffic. The new filter design uses a single filter for IP traffic, which allows the user to specify, in addition to the addresses and ports, the IP protocols (TCP, UDP, ICMP, etc) to match. Because of the radical change in filter design, previous IPTraf filters will no longer work with IPTraf 3.0. Therefore the installation scripts will simply move the old filter lists to new files, and IP filters will have to be redefined. NEW FILTER BEHAVIOR ------------------- A. UNIFIED IP FILTERS IP traffic is now filtered with a single defined filter for all IP-type protocols (TCP, UDP, etc) unlike previous versions which used three separate filters for TCP, UDP, and all other IP traffic. This makes it easier to define filters for for all IP traffic to or from a certain host or network without having to define three distinct filters. This redesign breaks compatibility with previous versions of IPTraf. A. REVERSE MATCHING Until IPTraf 3.0, TCP and UDP filters automatically matched in both directions, for example, a filter defined to match 100.1.1.1/255.255.255.255 port 80 to 192.168.1.0/255.255.255.0 port 0 matched all packets flowing from host 10.1.1.1, port 80 to any host on the network 192.168.1.0, as well as packets coming from the network 192.168.1.0 to host 100.1.1.1 port 80. With IPTraf 3.0, this no longer is the case. Automatic reverse matching is done only in the IP traffic monitor's TCP window (because of TCP's full-duplex nature), but in all other places, automatic reverse matching is no longer done unless you set the "Match opposite" field in the filter definition dialog boxes to Y. The "Match opposite" fields in the filter dialog boxes allow you to match packets flowing in the opposite direction without having to define another filter. This is useful for such things as ICMP echo request/echo reply packets (pings), UDP DNS queries, and other things that come in "pairs". Or you can turn them off for more precise measurement of incoming and outgoing data rates. However as earlier stated, the "Match opposite" field in TCP filters are ignored in the IP traffic monitor's TCP window, because reverse matching is always performed there. C. MISCELLANEOUS IP PROTOCOLS The filter rule definition dialog contains some fields that match common IP protocols. However a longer field is provided for additional protocols to match. You can enter here a comma-separated list of individual protocol numbers or ranges (e.g. 49, 69, 88-100, 110). BUG FIXES --------- IPTraf 3.0 fixes a minor bug where Token Ring interfaces' promiscuous modes were not toggled by the Force Promiscuous configuration option. Window borders don't appear in color when IPTraf is compiled under Red Hat Linux 7.3, possibly others. The window support library has been updated to fix this problem. Minor user interface quirks have also been fixed. ADDITIONAL NETWORK INTERFACE SUPPORT ------------------------------------ Support for tun and brg (tunnelling and bridging) interfaces has been added to this version. PROTOCOL RECOGNITION -------------------- For not-so-common IP protocols, IPTraf's IP traffic monitor looks up the /etc/services file to determine the protocol names. More common protocols (ICMP, UDP) are looked up internally. L2TP, IPSec Authentication, and IPSec Encrypted Payload packets have been added to IPTraf's internal recognition. iptraf-ng-1.1.4/config.mak.in0000664000076400007640000000072712173477703016253 0ustar npajkovsnpajkovs# git Makefile configuration, included in main Makefile # @configure_input@ CC = @CC@ CFLAGS = @CFLAGS@ CPPFLAGS = @CPPFLAGS@ LDFLAGS = @LDFLAGS@ TAR = @TAR@ #INSTALL = @INSTALL@ # needs install-sh or install.sh in sources prefix = @prefix@ bindir = @bindir@ sbindir = @sbindir@ datarootdir = @datarootdir@ sysconfdir = @sysconfdir@ mandir=@mandir@ srcdir = @srcdir@ VPATH = @srcdir@ export mandir export srcdir VPATH ASCIIDOC7=@ASCIIDOC7@ NO_NCURSES=@NO_NCURSES@ iptraf-ng-1.1.4/configure.ac0000664000076400007640000001473512173477703016201 0ustar npajkovsnpajkovs# -*- Autoconf -*- # Process this file with autoconf to produce a configure script. AC_PREREQ(2.59) AC_INIT([iptraf-ng], [@@IPTRAF_VERSION@@], [iptraf-ng@fedorahosted.org]) AC_CONFIG_SRCDIR([src/iptraf.c]) config_file=config.mak.autogen config_append=config.mak.append config_in=config.mak.in echo "# ${config_append}. Generated by configure." > "${config_append}" ## Definitions of macros # CONF_APPEND_LINE(LINE) # -------------------------- # Append LINE to file ${config_append} AC_DEFUN([CONF_APPEND_LINE], [echo "$1" >> "${config_append}"])# CONF_APPEND_LINE # # ARG_SET_PATH(PROGRAM) # ------------------------- # Provide --with-PROGRAM=PATH option to set PATH to PROGRAM # Optional second argument allows setting NO_PROGRAM=YesPlease if # --without-PROGRAM version used. AC_DEFUN([ARG_SET_PATH], [AC_ARG_WITH([$1], [AS_HELP_STRING([--with-$1=PATH], [provide PATH to $1])], [CONF_APPEND_PATH($1,$2)],[]) ])# ARG_SET_PATH # # CONF_APPEND_PATH(PROGRAM) # ------------------------------ # Parse --with-PROGRAM=PATH option to set PROGRAM_PATH=PATH # Used by ARG_SET_PATH(PROGRAM) # Optional second argument allows setting NO_PROGRAM=YesPlease if # --without-PROGRAM is used. AC_DEFUN([CONF_APPEND_PATH], [PROGRAM=m4_toupper($1); \ if test "$withval" = "no"; then \ if test -n "$2"; then \ m4_toupper($1)_PATH=$withval; \ AC_MSG_NOTICE([Disabling use of ${PROGRAM}]); \ CONF_APPEND_LINE(NO_${PROGRAM}=YesPlease); \ CONF_APPEND_LINE(${PROGRAM}_PATH=); \ else \ AC_MSG_ERROR([You cannot use git without $1]); \ fi; \ else \ if test "$withval" = "yes"; then \ AC_MSG_WARN([You should provide path for --with-$1=PATH]); \ else \ m4_toupper($1)_PATH=$withval; \ AC_MSG_NOTICE([Setting m4_toupper($1)_PATH to $withval]); \ CONF_APPEND_LINE(${PROGRAM}_PATH=$withval); \ fi; \ fi; \ ]) # CONF_APPEND_PATH # # PARSE_WITH(PACKAGE) # ----------------------- # For use in AC_ARG_WITH action-if-found, for packages default ON. # * Set NO_PACKAGE=YesPlease for --without-PACKAGE # * Set PACKAGEDIR=PATH for --with-PACKAGE=PATH # * Unset NO_PACKAGE for --with-PACKAGE without ARG AC_DEFUN([PARSE_WITH], [PACKAGE=m4_toupper($1); \ if test "$withval" = "no"; then \ m4_toupper(NO_$1)=YesPlease; \ elif test "$withval" = "yes"; then \ m4_toupper(NO_$1)=; \ else \ m4_toupper(NO_$1)=; \ m4_toupper($1)DIR=$withval; \ AC_MSG_NOTICE([Setting m4_toupper($1)DIR to $withval]); \ CONF_APPEND_LINE(${PACKAGE}DIR=$withval); \ fi \ ])# PARSE_WITH # # PARSE_WITH_SET_MAKE_VAR(WITHNAME, VAR, HELP_TEXT) # --------------------- # Set VAR to the value specied by --with-WITHNAME. # No verification of arguments is performed, but warnings are issued # if either 'yes' or 'no' is specified. # HELP_TEXT is presented when --help is called. # This is a direct way to allow setting variables in the Makefile. AC_DEFUN([PARSE_WITH_SET_MAKE_VAR], [AC_ARG_WITH([$1], [AS_HELP_STRING([--with-$1=VALUE], $3)], if test -n "$withval"; then \ if test "$withval" = "yes" -o "$withval" = "no"; then \ AC_MSG_WARN([You likely do not want either 'yes' or 'no' as] [a value for $1 ($2). Maybe you do...?]); \ fi; \ \ AC_MSG_NOTICE([Setting $2 to $withval]); \ CONF_APPEND_LINE($2=$withval); \ fi)])# PARSE_WITH_SET_MAKE_VAR dnl dnl CHECK_FUNC(FUNCTION, IFTRUE, IFFALSE) dnl ----------------------------------------- dnl Similar to AC_CHECK_FUNC, but on systems that do not generate dnl warnings for missing prototypes (e.g. FreeBSD when compiling without dnl -Wall), it does not work. By looking for function definition in dnl libraries, this problem can be worked around. AC_DEFUN([CHECK_FUNC],[AC_CHECK_FUNC([$1],[ AC_SEARCH_LIBS([$1],, [$2],[$3]) ],[$3])]) dnl dnl STASH_FLAGS(BASEPATH_VAR) dnl ----------------------------- dnl Allow for easy stashing of LDFLAGS and CPPFLAGS before running dnl tests that may want to take user settings into account. AC_DEFUN([STASH_FLAGS],[ if test -n "$1"; then old_CPPFLAGS="$CPPFLAGS" old_LDFLAGS="$LDFLAGS" CPPFLAGS="-I$1/include $CPPFLAGS" LDFLAGS="-L$1/$lib $LDFLAGS" fi ]) dnl dnl UNSTASH_FLAGS(BASEPATH_VAR) dnl ----------------------------- dnl Restore the stashed *FLAGS values. AC_DEFUN([UNSTASH_FLAGS],[ if test -n "$1"; then CPPFLAGS="$old_CPPFLAGS" LDFLAGS="$old_LDFLAGS" fi ]) ## Site configuration related to programs (before tests) ## --with-PACKAGE[=ARG] and --without-PACKAGE # # Set lib to alternative name of lib directory (e.g. lib64) AC_ARG_WITH([lib], [AS_HELP_STRING([--with-lib=ARG], [ARG specifies alternative name for lib directory])], [if test "$withval" = "no" || test "$withval" = "yes"; then \ AC_MSG_WARN([You should provide name for --with-lib=ARG]); \ else \ lib=$withval; \ AC_MSG_NOTICE([Setting lib to '$lib']); \ CONF_APPEND_LINE(lib=$withval); \ fi; \ ],[]) if test -z "$lib"; then AC_MSG_NOTICE([Setting lib to 'lib' (the default)]) lib=lib fi # # Define NO_CURL if you do not have curl installed. git-http-pull and # git-http-push are not built, and you cannot use http:// and https:// # transports. # # Define CURLDIR=/foo/bar if your curl header and library files are in # /foo/bar/include and /foo/bar/lib directories. AC_ARG_WITH(ncurses, AS_HELP_STRING([--with-ncurses],[support http(s):// transports (default is YES)]) AS_HELP_STRING([], [ARG can be also prefix for curl library and headers]), PARSE_WITH(ncurses)) ## Checks for programs. AC_MSG_NOTICE([CHECKS for programs]) # AC_PROG_CC([cc gcc]) AC_C_INLINE case $ac_cv_c_inline in inline | yes | no) ;; *) AC_SUBST([INLINE], [$ac_cv_c_inline]) ;; esac #AC_PROG_INSTALL # needs install-sh or install.sh in sources AC_CHECK_TOOLS(AR, [gar ar], :) AC_CHECK_PROGS(TAR, [gtar tar]) AC_CHECK_PROGS(ASCIIDOC, [asciidoc]) if test -n "$ASCIIDOC"; then AC_MSG_CHECKING([for asciidoc version]) asciidoc_version=`$ASCIIDOC --version 2>/dev/null` case "${asciidoc_version}" in asciidoc' '7*) ASCIIDOC7=YesPlease AC_MSG_RESULT([${asciidoc_version} > 7]) ;; asciidoc' '8*) ASCIIDOC7= AC_MSG_RESULT([${asciidoc_version}]) ;; *) ASCIIDOC7= AC_MSG_RESULT([${asciidoc_version} (unknown)]) ;; esac fi AC_SUBST(ASCIIDOC7) ## Checks for libraries. AC_MSG_NOTICE([CHECKS for libraries]) if test -z "$NO_NCURSES"; then STASH_FLAGS($NCURSESSDIR) AC_CHECK_LIB([ncurses], [initscr], [NO_NCURSES=], [NO_NCURSES=YesPlease]) UNSTASH_FLAGS($NCURSESDIR) AC_SUBST(NO_NCURSES) fi CFLAGS="$CFLAGS -W -Wall -std=gnu99 -pedantic" ## Output files AC_CONFIG_FILES(["${config_file}":"${config_in}":"${config_append}"]) AC_OUTPUT iptraf-ng-1.1.4/iptraf-ng-logrotate.conf0000664000076400007640000000020712173477703020434 0ustar npajkovsnpajkovs# Logrotate file for iptraf /var/log/iptraf/*.log { compress delaycompress missingok notifempty rotate 4 create 0600 root root } iptraf-ng-1.1.4/iptraf-ng.spec.in0000664000076400007640000000503112173477703017050 0ustar npajkovsnpajkovsSummary: A console-based network monitoring utility Name: iptraf-ng Version: @@IPTRAF_VERSION@@ Release: 1%{?dist} Source0: https://fedorahosted.org/releases/i/p/iptraf-ng/%{name}-%{version}.tar.gz Source1: iptraf-ng-logrotate.conf URL: https://fedorahosted.org/iptraf-ng/ License: GPLv2+ Group: Applications/System BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: ncurses-devel Obsoletes: iptraf < 3.1 Provides: iptraf = 3.1 %description IPTraf-ng is a console-based network monitoring utility. IPTraf gathers data like TCP connection packet and byte counts, interface statistics and activity indicators, TCP/UDP traffic breakdowns, and LAN station packet and byte counts. IPTraf-ng features include an IP traffic monitor which shows TCP flag information, packet and byte counts, ICMP details, OSPF packet types, and oversized IP packet warnings; interface statistics showing IP, TCP, UDP, ICMP, non-IP and other IP packet counts, IP checksum errors, interface activity and packet size counts; a TCP and UDP service monitor showing counts of incoming and outgoing packets for common TCP and UDP application ports, a LAN statistics module that discovers active hosts and displays statistics about their activity; TCP, UDP and other protocol display filters so you can view just the traffic you want; logging; support for Ethernet, FDDI, ISDN, SLIP, PPP, and loopback interfaces; and utilization of the built-in raw socket interface of the Linux kernel, so it can be used on a wide variety of supported network cards. %prep %setup -q %build %configure make %{?_smp_mflags} %install rm -rf $RPM_BUILD_ROOT make install DESTDIR=$RPM_BUILD_ROOT # remove everything besides the html and pictures in Documentation find Documentation -type f | grep -v '\.html$\|\.png$\|/stylesheet' | \ xargs rm -f install -D -m 0644 -p %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/iptraf-ng install -d -m 0755 $RPM_BUILD_ROOT%{_localstatedir}/{lock,log,lib}/iptraf-ng %clean rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root,-) %doc CHANGES FAQ LICENSE README* RELEASE-NOTES %doc Documentation %{_sbindir}/iptraf-ng %{_sbindir}/rvnamed-ng %{_mandir}/man8/iptraf-ng.8* %{_mandir}/man8/rvnamed-ng.8* %{_localstatedir}/lock/iptraf-ng %{_localstatedir}/log/iptraf-ng %{_localstatedir}/lib/iptraf-ng %config(noreplace) %{_sysconfdir}/logrotate.d/iptraf-ng %changelog * Wed Jan 11 2011 Nikola Pajkovsky - 1.1.0-1 - Initialization build iptraf-ng-1.1.4/src/0000775000076400007640000000000012173477703014470 5ustar npajkovsnpajkovsiptraf-ng-1.1.4/src/addproto.h0000664000076400007640000000066212173477703016461 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_ADDPROTO_H #define IPTRAF_NG_ADDPROTO_H #ifndef IPPROTO_IGP #define IPPROTO_IGP 9 #endif #ifndef IPPROTO_IGRP #define IPPROTO_IGRP 88 #endif #ifndef IPPROTO_OSPFIGP #define IPPROTO_OSPFIGP 89 #endif #ifndef IPPROTO_GRE #define IPPROTO_GRE 47 #endif #ifndef IPPROTO_IPSEC_AH #define IPPROTO_IPSEC_AH 51 #endif #ifndef IPPROTO_IPSEC_ESP #define IPPROTO_IPSEC_ESP 50 #endif #endif /* IPTRAF_NG_ADDPROTO_H */ iptraf-ng-1.1.4/src/arphdr.h0000664000076400007640000000144412173477703016124 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_ARPHDR_H #define IPTRAF_NG_ARPHDR_H /* * arp header format, stolen from the Linux include files. */ struct arp_hdr { unsigned short ar_hrd; /* format of hardware address */ unsigned short ar_pro; /* format of protocol address */ unsigned char ar_hln; /* length of hardware address */ unsigned char ar_pln; /* length of protocol address */ unsigned short ar_op; /* ARP opcode (command) */ /* * Ethernet looks like this : This bit is variable sized however... */ unsigned char ar_sha[ETH_ALEN]; /* sender hardware address */ unsigned char ar_sip[4]; /* sender IP address */ unsigned char ar_tha[ETH_ALEN]; /* target hardware address */ unsigned char ar_tip[4]; /* target IP address */ }; #endif /* IPTRAF_NG_ARPHDR_H */ iptraf-ng-1.1.4/src/attrs.h0000664000076400007640000000144312173477703016000 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_ATTRS_H #define IPTRAF_NG_ATTRS_H /* Attribute variables */ extern int STDATTR; extern int HIGHATTR; extern int BOXATTR; extern int ACTIVEATTR; extern int BARSTDATTR; extern int BARHIGHATTR; extern int BARPTRATTR; extern int DLGTEXTATTR; extern int DLGHIGHATTR; extern int DLGBOXATTR; extern int DESCATTR; extern int STATUSBARATTR; extern int IPSTATATTR; extern int IPSTATLABELATTR; extern int DESKTEXTATTR; extern int PTRATTR; extern int FIELDATTR; extern int ERRBOXATTR; extern int ERRTXTATTR; extern int ERRRESPATTR; extern int OSPFATTR; extern int UDPATTR; extern int IGPATTR; extern int IGMPATTR; extern int IGRPATTR; extern int ARPATTR; extern int GREATTR; extern int UNKNIPATTR; extern int UNKNATTR; extern int IPV6ATTR; extern int ICMPV6ATTR; #endif /* IPTRAF_NG_ATTRS_H */ iptraf-ng-1.1.4/src/built-in.h0000664000076400007640000000035612173477703016370 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #ifndef IPTRAF_NG_BUILT_IN_H #define IPTRAF_NG_BUILT_IN_H int cmd_capture(int argc, char **argv); #endif iptraf-ng-1.1.4/src/capture-pkt.c0000664000076400007640000000301412173477703017071 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" #include "built-in.h" #include "parse-options.h" #include "ifaces.h" #include "packet.h" static const char *const capture_usage[] = { IPTRAF_NAME " capture [-c] ", NULL }; static int cap_nr_pkt = 1, help_opt; static char *ofilename; static struct options capture_options[] = { OPT__HELP(&help_opt), OPT_GROUP(""), OPT_INTEGER('c', "capture", &cap_nr_pkt, "capture packets"), OPT_STRING('o', "output", &ofilename, "file", "save captured packet into "), OPT_END() }; int cmd_capture(int argc, char **argv) { parse_opts(argc, argv, capture_options, capture_usage); argv += optind; if (help_opt || !*argv || argv[1]) parse_usage_and_die(capture_usage, capture_options); char *dev = argv[0]; int fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (fd < 0) die_errno("Unable to obtain monitoring socket"); if (dev_bind_ifname(fd, dev) < 0) perror("Unable to bind device on the socket"); FILE *fp = NULL; if (ofilename) { fp = fopen(ofilename, "wb"); if (!fp) die_errno("fopen"); } PACKET_INIT(p); int captured = 0; for (;;) { if (packet_get(fd, &p, NULL, NULL) == -1) die_errno("fail to get packet"); if (!p.pkt_len) continue; printf("."); fflush(stdout); if (fp) fwrite(&p, sizeof(p), 1, fp); if (++captured == cap_nr_pkt) break; } printf("\n"); close(fd); if (fp) fclose(fp); return 0; } iptraf-ng-1.1.4/src/cidr.c0000664000076400007640000000413712173477703015562 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" // TODO: full rewrite /* * Returns a binary subnet mask based on the number of mask bits. The * dotted-decimal notation may be obtained with inet_ntoa. */ unsigned long cidr_get_mask(unsigned int maskbits) { struct in_addr mask; if (maskbits == 0) return 0; inet_aton("255.255.255.255", &mask); mask.s_addr = htonl(mask.s_addr << (32 - maskbits)); return mask.s_addr; } /* * Returns a subnet mask in dotted-decimal notation given the number of * 1-bits in the mask. */ char *cidr_get_quad_mask(unsigned int maskbits) { struct in_addr addr; addr.s_addr = cidr_get_mask(maskbits); return inet_ntoa(addr); } /* * Returns the number of 1-bits in the given binary subnet mask in * network byte order. */ unsigned int cidr_get_maskbits(unsigned long mask) { unsigned int i = 32; if (mask == 0) return 0; mask = ntohl(mask); while (mask % 2 == 0) { mask >>= 1; i--; } return i; } /* * Splits a CIDR-style address/mask string into its constituent address and * mask parts. In case of absent or invalid input in the mask part, 255 is * returned in *maskbits (255 is invalid for an IPv4 address). */ void cidr_split_address(char *cidr_addr, char *addresspart, unsigned int *maskbits) { char maskpart[4]; char *endptr; char *slashptr; char address_buffer[80]; if (strchr(cidr_addr, '/') == NULL) { strncpy(addresspart, cidr_addr, 80); *maskbits = 255; return; } memset(address_buffer, 0, 80); memset(addresspart, 0, 80); memset(maskpart, 0, 4); strncpy(address_buffer, cidr_addr, 80); slashptr = strchr(address_buffer, '/'); /* * Cut out the mask part and move past the slash */ *slashptr = '\0'; slashptr++; /* * Copy out the address and mask parts into their buffers. */ strncpy(addresspart, address_buffer, 80); strncpy(maskpart, slashptr, 4); if (maskpart[0] != '\0') { *maskbits = strtoul(maskpart, &endptr, 10); if (*endptr != '\0') *maskbits = 255; } else *maskbits = 255; return; } iptraf-ng-1.1.4/src/cidr.h0000664000076400007640000000050312173477703015560 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_CIDR_H #define IPTRAF_NG_CIDR_H unsigned long cidr_get_mask(unsigned int maskbits); char *cidr_get_quad_mask(unsigned int maskbits); unsigned int cidr_get_maskbits(unsigned long mask); void cidr_split_address(char *cidr_addr, char *addresspart, unsigned int *maskbits); #endif /* IPTRAF_NG_CIDR_H */ iptraf-ng-1.1.4/src/counters.c0000664000076400007640000000113012173477703016471 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "counters.h" void update_pkt_counter(struct pkt_counter *count, int bytes) { if (count) { count->pc_packets++; count->pc_bytes += bytes; } } void update_proto_counter(struct proto_counter *proto_counter, int outgoing, int bytes) { if (proto_counter) { update_pkt_counter(&proto_counter->proto_total, bytes); if (outgoing) update_pkt_counter(&proto_counter->proto_out, bytes); else update_pkt_counter(&proto_counter->proto_in, bytes); } } iptraf-ng-1.1.4/src/counters.h0000664000076400007640000000071312173477703016504 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_COUNTERS_H #define IPTRAF_NG_COUNTERS_H struct pkt_counter { unsigned long long pc_packets; unsigned long long pc_bytes; }; struct proto_counter { struct pkt_counter proto_total; struct pkt_counter proto_in; struct pkt_counter proto_out; }; void update_pkt_counter(struct pkt_counter *count, int bytes); void update_proto_counter(struct proto_counter *proto_counter, int outgoing, int bytes); #endif /* IPTRAF_NG_COUNTERS_H */ iptraf-ng-1.1.4/src/deskman.c0000664000076400007640000001613612173477703016265 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** deskman.c - desktop management routines ***/ #include "iptraf-ng-compat.h" #include "tui/labels.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "deskman.h" #include "options.h" /* Attribute variables */ int STDATTR; int HIGHATTR; int BOXATTR; int ACTIVEATTR; int BARSTDATTR; int BARHIGHATTR; int BARPTRATTR; int DLGTEXTATTR; int DLGBOXATTR; int DLGHIGHATTR; int DESCATTR; int STATUSBARATTR; int IPSTATLABELATTR; int IPSTATATTR; int DESKTEXTATTR; int PTRATTR; int FIELDATTR; int ERRBOXATTR; int ERRTXTATTR; int OSPFATTR; int UDPATTR; int IGPATTR; int IGMPATTR; int IGRPATTR; int GREATTR; int ARPATTR; int UNKNIPATTR; int UNKNATTR; int IPV6ATTR; int ICMPV6ATTR; /* draw the basic desktop common to my screen-oriented programs */ void draw_desktop(void) { int row; /* counter for desktop construction */ char sp_buf[10]; sprintf(sp_buf, "%%%dc", COLS); scrollok(stdscr, 0); attrset(STATUSBARATTR); move(0, 0); printw(sp_buf, ' '); /* these two print the top n' bottom */ move(LINES - 1, 0); printw(sp_buf, ' '); /* lines */ attrset(FIELDATTR); for (row = 1; row <= LINES - 2; row++) { /* draw the background */ move(row, 0); printw(sp_buf, ' '); } refresh(); } void about(void) { WINDOW *win; PANEL *panel; int ch; win = newwin(18, 62, (LINES - 17) / 2, (COLS - 62) / 2); panel = new_panel(win); tx_stdwinset(win); wtimeout(win, -1); wattrset(win, BOXATTR); tx_colorwin(win); tx_box(win, ACS_VLINE, ACS_HLINE); wattrset(win, STDATTR); mvwprintw(win, 1, 2, IPTRAF_NAME); mvwprintw(win, 2, 2, "An IP Network Statistics Utility"); mvwprintw(win, 3, 2, "Version %s", IPTRAF_VERSION); mvwprintw(win, 5, 2, "Written by Gerard Paul Java"); mvwprintw(win, 6, 2, "Copyright (c) Gerard Paul Java 1997-2004"); mvwprintw(win, 8, 2, "This program is open-source software released"); mvwprintw(win, 9, 2, "under the terms of the GNU General Public"); mvwprintw(win, 10, 2, "Public License Version 2 or any later version."); mvwprintw(win, 11, 2, "See the included LICENSE file for details."); mvwprintw(win, 13, 2, "IPv6 support by Markus Ullmann "); mvwprintw(win, 14, 2, "inspired by 2.7.0 diff by Guy Martin "); wattrset(win, HIGHATTR); mvwprintw(win, 16, 2, ANYKEY_MSG); update_panels(); doupdate(); do { ch = wgetch(win); if (ch == 12) tx_refresh_screen(); } while (ch == 12); del_panel(panel); delwin(win); update_panels(); doupdate(); } void show_sort_statwin(WINDOW ** statwin, PANEL ** panel) { *statwin = newwin(5, 30, (LINES - 5) / 2, (COLS - 30) / 2); *panel = new_panel(*statwin); wattrset(*statwin, BOXATTR); tx_colorwin(*statwin); tx_box(*statwin, ACS_VLINE, ACS_HLINE); wattrset(*statwin, STDATTR); mvwprintw(*statwin, 2, 2, "Sorting, please wait..."); } void printipcerr(void) { attrset(ERRTXTATTR); mvprintw(0, 68, " IPC Error "); } void stdkeyhelp(WINDOW * win) { tx_printkeyhelp("Enter", "-accept ", win, DLGHIGHATTR, DLGTEXTATTR); tx_printkeyhelp("Ctrl+X", "-cancel", win, DLGHIGHATTR, DLGTEXTATTR); } void sortkeyhelp(void) { tx_printkeyhelp("S", "-sort ", stdscr, HIGHATTR, STATUSBARATTR); } void stdexitkeyhelp(void) { tx_printkeyhelp("X", "-exit", stdscr, HIGHATTR, STATUSBARATTR); tx_coloreol(); } void scrollkeyhelp(void) { tx_printkeyhelp("Up/Down/PgUp/PgDn", "-scroll window ", stdscr, HIGHATTR, STDATTR); } void tabkeyhelp(WINDOW * win) { tx_printkeyhelp("Tab", "-next field ", win, DLGHIGHATTR, DLGTEXTATTR); } void indicate(char *message) { char sp_buf[10]; attrset(STATUSBARATTR); sprintf(sp_buf, "%%%dc", COLS); mvprintw(LINES - 1, 0, sp_buf, ' '); mvprintw(LINES - 1, 1, message); refresh(); } void printlargenum(unsigned long long i, WINDOW * win) { if (i < 100000000) /* less than 100 million */ wprintw(win, "%9llu", i); else if (i < 1000000000) /* less than 1 billion */ wprintw(win, "%8lluk", i / 1000); else if (i < 1000000000000ULL) /* less than 1 trillion */ wprintw(win, "%8lluM", i / 1000000); else if (i < 1000000000000000ULL) /* less than 1000 trillion */ wprintw(win, "%8lluG", i / 1000000000ULL); else wprintw(win, "%8lluT", i / 1000000000000ULL); } int screen_update_needed(const struct timeval *now, const struct timeval *last) { unsigned long msecs = timeval_diff_msec(now, last); if (options.updrate == 0) { if (msecs >= DEFAULT_UPDATE_DELAY) return 1; else return 0; } else { if (msecs >= (options.updrate * 1000UL)) return 1; else return 0; } } void standardcolors(int color) { if ((color) && (has_colors())) { init_pair(1, COLOR_BLUE, COLOR_WHITE); init_pair(2, COLOR_BLACK, COLOR_CYAN); init_pair(3, COLOR_CYAN, COLOR_BLUE); init_pair(4, COLOR_YELLOW, COLOR_RED); init_pair(5, COLOR_WHITE, COLOR_RED); init_pair(6, COLOR_BLUE, COLOR_CYAN); init_pair(7, COLOR_BLUE, COLOR_WHITE); init_pair(9, COLOR_RED, COLOR_WHITE); init_pair(10, COLOR_GREEN, COLOR_BLUE); init_pair(11, COLOR_CYAN, COLOR_BLACK); init_pair(12, COLOR_RED, COLOR_CYAN); init_pair(14, COLOR_YELLOW, COLOR_BLUE); init_pair(15, COLOR_YELLOW, COLOR_BLACK); init_pair(16, COLOR_WHITE, COLOR_CYAN); init_pair(17, COLOR_YELLOW, COLOR_CYAN); init_pair(18, COLOR_GREEN, COLOR_BLACK); init_pair(19, COLOR_WHITE, COLOR_BLUE); STDATTR = COLOR_PAIR(14) | A_BOLD; HIGHATTR = COLOR_PAIR(3) | A_BOLD; BOXATTR = COLOR_PAIR(3); ACTIVEATTR = COLOR_PAIR(10) | A_BOLD; BARSTDATTR = COLOR_PAIR(15) | A_BOLD; BARHIGHATTR = COLOR_PAIR(11) | A_BOLD; BARPTRATTR = COLOR_PAIR(18) | A_BOLD; DESCATTR = COLOR_PAIR(2); DLGTEXTATTR = COLOR_PAIR(2); DLGBOXATTR = COLOR_PAIR(6); DLGHIGHATTR = COLOR_PAIR(12); STATUSBARATTR = STDATTR; IPSTATLABELATTR = COLOR_PAIR(2); IPSTATATTR = COLOR_PAIR(12); DESKTEXTATTR = COLOR_PAIR(7); PTRATTR = COLOR_PAIR(10) | A_BOLD; FIELDATTR = COLOR_PAIR(1); ERRBOXATTR = COLOR_PAIR(5) | A_BOLD; ERRTXTATTR = COLOR_PAIR(4) | A_BOLD; OSPFATTR = COLOR_PAIR(2); UDPATTR = COLOR_PAIR(9); IGPATTR = COLOR_PAIR(12); IGMPATTR = COLOR_PAIR(10) | A_BOLD; IGRPATTR = COLOR_PAIR(16) | A_BOLD; ARPATTR = COLOR_PAIR(5) | A_BOLD; GREATTR = COLOR_PAIR(1); UNKNIPATTR = COLOR_PAIR(19) | A_BOLD; ICMPV6ATTR = COLOR_PAIR(19) | A_BOLD; IPV6ATTR = COLOR_PAIR(19); UNKNATTR = COLOR_PAIR(4) | A_BOLD; } else { STDATTR = A_REVERSE; HIGHATTR = A_REVERSE; BOXATTR = A_REVERSE; ACTIVEATTR = A_BOLD; BARSTDATTR = A_NORMAL; BARHIGHATTR = A_BOLD; BARPTRATTR = A_NORMAL; DESCATTR = A_BOLD; DLGBOXATTR = A_REVERSE; DLGTEXTATTR = A_REVERSE; DLGHIGHATTR = A_BOLD; STATUSBARATTR = A_REVERSE; IPSTATLABELATTR = A_REVERSE; IPSTATATTR = A_STANDOUT; DESKTEXTATTR = A_NORMAL; PTRATTR = A_REVERSE; FIELDATTR = A_BOLD; ERRBOXATTR = A_BOLD; ERRTXTATTR = A_NORMAL; OSPFATTR = A_REVERSE; UDPATTR = A_BOLD; IGPATTR = A_REVERSE; IGMPATTR = A_REVERSE; IGRPATTR = A_REVERSE; ARPATTR = A_BOLD; GREATTR = A_BOLD; UNKNIPATTR = A_BOLD; ICMPV6ATTR = A_REVERSE; UNKNATTR = A_BOLD; } tx_init_error_attrs(ERRBOXATTR, ERRTXTATTR, ERRBOXATTR); tx_init_info_attrs(BOXATTR, STDATTR, HIGHATTR); } iptraf-ng-1.1.4/src/deskman.h0000664000076400007640000000132212173477703016261 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_DESKMAN_H #define IPTRAF_NG_DESKMAN_H /* deskman.h - header file for deskman.c */ void draw_desktop(void); void about(void); void printipcerr(void); void printkeyhelp(char *keytext, char *desc, WINDOW * win, int highattr, int textattr); void stdkeyhelp(WINDOW * win); void sortkeyhelp(void); void tabkeyhelp(WINDOW * win); void scrollkeyhelp(void); void stdexitkeyhelp(void); void indicate(char *message); void printlargenum(unsigned long long i, WINDOW * win); int screen_update_needed(const struct timeval *now, const struct timeval *last); void infobox(char *text, char *prompt); void standardcolors(int color); void show_sort_statwin(WINDOW **, PANEL **); #endif /* IPTRAF_NG_DESKMAN_H */ iptraf-ng-1.1.4/src/detstats.c0000664000076400007640000003714012173477703016474 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** detstats.c - the interface statistics module ***/ #include "iptraf-ng-compat.h" #include "tui/winops.h" #include "counters.h" #include "ifaces.h" #include "fltdefs.h" #include "packet.h" #include "options.h" #include "log.h" #include "dirs.h" #include "deskman.h" #include "attrs.h" #include "serv.h" #include "timer.h" #include "logvars.h" #include "promisc.h" #include "error.h" #include "detstats.h" #include "rate.h" struct ifcounts { struct proto_counter total; struct pkt_counter bcast; struct pkt_counter bad; struct proto_counter ipv4; struct proto_counter ipv6; struct proto_counter nonip; struct proto_counter tcp; struct proto_counter udp; struct proto_counter icmp; struct proto_counter other; }; /* USR1 log-rotation signal handlers */ static void rotate_dstat_log(int s __unused) { rotate_flag = 1; strcpy(target_logname, current_logfile); signal(SIGUSR1, rotate_dstat_log); } static void writedstatlog(char *ifname, unsigned long peakactivity, unsigned long peakpps, unsigned long peakactivity_in, unsigned long peakpps_in, unsigned long peakactivity_out, unsigned long peakpps_out, struct ifcounts *ts, unsigned long nsecs, FILE *fd) { char atime[TIME_TARGET_MAX]; genatime(time(NULL), atime); fprintf(fd, "\n*** Detailed statistics for interface %s, generated %s\n\n", ifname, atime); fprintf(fd, "Total: \t%llu packets, %llu bytes\n", ts->total.proto_total.pc_packets, ts->total.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->total.proto_in.pc_packets, ts->total.proto_in.pc_bytes, ts->total.proto_out.pc_packets, ts->total.proto_out.pc_bytes); fprintf(fd, "IP: \t%llu packets, %llu bytes\n", ts->ipv4.proto_total.pc_packets, ts->ipv4.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->ipv4.proto_in.pc_packets, ts->ipv4.proto_in.pc_bytes, ts->ipv4.proto_out.pc_packets, ts->ipv4.proto_out.pc_bytes); fprintf(fd, "TCP: %llu packets, %llu bytes\n", ts->tcp.proto_total.pc_packets, ts->tcp.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->tcp.proto_in.pc_packets, ts->tcp.proto_in.pc_bytes, ts->tcp.proto_out.pc_packets, ts->tcp.proto_out.pc_bytes); fprintf(fd, "UDP: %llu packets, %llu bytes\n", ts->udp.proto_total.pc_packets, ts->udp.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->udp.proto_in.pc_packets, ts->udp.proto_in.pc_bytes, ts->udp.proto_out.pc_packets, ts->udp.proto_out.pc_bytes); fprintf(fd, "ICMP: %llu packets, %llu bytes\n", ts->icmp.proto_total.pc_packets, ts->icmp.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->icmp.proto_in.pc_packets, ts->icmp.proto_in.pc_bytes, ts->icmp.proto_out.pc_packets, ts->icmp.proto_out.pc_bytes); fprintf(fd, "Other IP: %llu packets, %llu bytes\n", ts->other.proto_total.pc_packets, ts->other.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->other.proto_in.pc_packets, ts->other.proto_in.pc_bytes, ts->other.proto_out.pc_packets, ts->other.proto_out.pc_bytes); fprintf(fd, "Non-IP: %llu packets, %llu bytes\n", ts->nonip.proto_total.pc_packets, ts->nonip.proto_total.pc_bytes); fprintf(fd, "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n", ts->nonip.proto_in.pc_packets, ts->nonip.proto_in.pc_bytes, ts->nonip.proto_out.pc_packets, ts->nonip.proto_out.pc_bytes); fprintf(fd, "Broadcast: %llu packets, %llu bytes\n", ts->bcast.pc_packets, ts->bcast.pc_bytes); if (nsecs > 5) { char bps_string[64]; char pps_string[64]; fprintf(fd, "\nAverage rates:\n"); rate_print(ts->total.proto_total.pc_bytes / nsecs, bps_string, sizeof(bps_string)); rate_print_pps(ts->total.proto_total.pc_packets / nsecs, pps_string, sizeof(pps_string)); fprintf(fd, " Total:\t%s, %s\n", bps_string, pps_string); rate_print(ts->total.proto_in.pc_bytes / nsecs, bps_string, sizeof(bps_string)); rate_print_pps(ts->total.proto_in.pc_packets / nsecs, pps_string, sizeof(pps_string)); fprintf(fd, " Incoming:\t%s, %s\n", bps_string, pps_string); rate_print(ts->total.proto_out.pc_bytes / nsecs, bps_string, sizeof(bps_string)); rate_print_pps(ts->total.proto_out.pc_packets / nsecs, pps_string, sizeof(pps_string)); fprintf(fd, " Outgoing:\t%s, %s\n", bps_string, pps_string); rate_print(peakactivity, bps_string, sizeof(bps_string)); rate_print_pps(peakpps, pps_string, sizeof(pps_string)); fprintf(fd, "\nPeak total activity: %s, %s\n", bps_string, pps_string); rate_print(peakactivity_in, bps_string, sizeof(bps_string)); rate_print_pps(peakpps_in, pps_string, sizeof(pps_string)); fprintf(fd, "Peak incoming rate: %s, %s\n", bps_string, pps_string); rate_print(peakactivity_out, bps_string, sizeof(bps_string)); rate_print_pps(peakpps_out, pps_string, sizeof(pps_string)); fprintf(fd, "Peak outgoing rate: %s, %s\n\n", bps_string, pps_string); } fprintf(fd, "IP checksum errors: %llu\n\n", ts->bad.pc_packets); fprintf(fd, "Running time: %lu seconds\n", nsecs); fflush(fd); } static void printdetlabels(WINDOW * win) { wattrset(win, BOXATTR); mvwprintw(win, 2, 14, " Total Total Incoming Incoming Outgoing Outgoing"); mvwprintw(win, 3, 14, "Packets Bytes Packets Bytes Packets Bytes"); wattrset(win, STDATTR); mvwprintw(win, 4, 2, "Total:"); mvwprintw(win, 5, 2, "IPv4:"); mvwprintw(win, 6, 2, "IPv6:"); mvwprintw(win, 7, 2, "TCP:"); mvwprintw(win, 8, 2, "UDP:"); mvwprintw(win, 9, 2, "ICMP:"); mvwprintw(win, 10, 2, "Other IP:"); mvwprintw(win, 11, 2, "Non-IP:"); mvwprintw(win, 14, 2, "Total rates:"); mvwprintw(win, 17, 2, "Incoming rates:"); mvwprintw(win, 20, 2, "Outgoing rates:"); mvwprintw(win, 14, 45, "Broadcast packets:"); mvwprintw(win, 15, 45, "Broadcast bytes:"); mvwprintw(win, 19, 45, "IP checksum errors:"); update_panels(); doupdate(); } static void printstatrow(WINDOW * win, int row, unsigned long long total, unsigned long long btotal, unsigned long long total_in, unsigned long long btotal_in, unsigned long long total_out, unsigned long long btotal_out) { wmove(win, row, 12); printlargenum(total, win); wmove(win, row, 23); printlargenum(btotal, win); wmove(win, row, 35); printlargenum(total_in, win); wmove(win, row, 46); printlargenum(btotal_in, win); wmove(win, row, 58); printlargenum(total_out, win); wmove(win, row, 69); printlargenum(btotal_out, win); } static void printstatrow_proto(WINDOW *win, int row, struct proto_counter *proto_counter) { printstatrow(win, row, proto_counter->proto_total.pc_packets, proto_counter->proto_total.pc_bytes, proto_counter->proto_in.pc_packets, proto_counter->proto_in.pc_bytes, proto_counter->proto_out.pc_packets, proto_counter->proto_out.pc_bytes); } static void printdetails(struct ifcounts *ifcounts, WINDOW * win) { wattrset(win, HIGHATTR); /* Print totals on the IP protocols */ printstatrow_proto(win, 4, &ifcounts->total); printstatrow_proto(win, 5, &ifcounts->ipv4); printstatrow_proto(win, 6, &ifcounts->ipv6); printstatrow_proto(win, 7, &ifcounts->tcp); printstatrow_proto(win, 8, &ifcounts->udp); printstatrow_proto(win, 9, &ifcounts->icmp); printstatrow_proto(win, 10, &ifcounts->other); /* Print non-IP totals */ printstatrow_proto(win, 11, &ifcounts->nonip); /* Broadcast totals */ wmove(win, 14, 67); printlargenum(ifcounts->bcast.pc_packets, win); wmove(win, 15, 67); printlargenum(ifcounts->bcast.pc_bytes, win); /* Bad packet count */ mvwprintw(win, 19, 68, "%8lu", ifcounts->bad.pc_packets); } /* * The detailed interface statistics function */ void detstats(char *iface, time_t facilitytime) { int logging = options.logging; WINDOW *statwin; PANEL *statpanel; int pkt_result = 0; FILE *logfile = NULL; unsigned int iplen = 0; struct ifcounts ifcounts; int ch; struct timeval tv; struct timeval start_tv; struct timeval updtime; time_t starttime; time_t now; time_t statbegin; time_t startlog; struct proto_counter span; struct rate rate; struct rate rate_in; struct rate rate_out; unsigned long peakactivity = 0; unsigned long peakactivity_in = 0; unsigned long peakactivity_out = 0; struct rate pps_rate; struct rate pps_rate_in; struct rate pps_rate_out; unsigned long peakpps = 0; unsigned long peakpps_in = 0; unsigned long peakpps_out = 0; int fd; if (!dev_up(iface)) { err_iface_down(); return; } LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, iface); promisc_set_list(&promisc); } move(LINES - 1, 1); stdexitkeyhelp(); statwin = newwin(LINES - 2, COLS, 1, 0); statpanel = new_panel(statwin); tx_stdwinset(statwin); wtimeout(statwin, -1); wattrset(statwin, BOXATTR); tx_colorwin(statwin); tx_box(statwin, ACS_VLINE, ACS_HLINE); wmove(statwin, 0, 1); wprintw(statwin, " Statistics for %s ", iface); wattrset(statwin, STDATTR); update_panels(); doupdate(); memset(&ifcounts, 0, sizeof(struct ifcounts)); if (logging) { if (strcmp(current_logfile, "") == 0) { snprintf(current_logfile, 64, "%s-%s.log", DSTATLOG, iface); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_dstat_log); rotate_flag = 0; writelog(logging, logfile, "******** Detailed interface statistics started ********"); } printdetlabels(statwin); printdetails(&ifcounts, statwin); update_panels(); doupdate(); memset(&span, 0, sizeof(span)); rate_alloc(&rate, 5); rate_alloc(&rate_in, 5); rate_alloc(&rate_out, 5); rate_alloc(&pps_rate, 5); rate_alloc(&pps_rate_in, 5); rate_alloc(&pps_rate_out, 5); gettimeofday(&tv, NULL); start_tv = tv; updtime = tv; starttime = startlog = statbegin = tv.tv_sec; leaveok(statwin, TRUE); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(dev_bind_ifname(fd, iface) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; PACKET_INIT(pkt); /* * Data-gathering loop */ while (!exitloop) { gettimeofday(&tv, NULL); now = tv.tv_sec; if ((now - starttime) >= 1) { char buf[64]; unsigned long activity, activity_in, activity_out; unsigned long pps, pps_in, pps_out; unsigned long msecs; wattrset(statwin, BOXATTR); printelapsedtime(statbegin, now, LINES - 3, 1, statwin); msecs = timeval_diff_msec(&tv, &start_tv); rate_add_rate(&rate, span.proto_total.pc_bytes, msecs); activity = rate_get_average(&rate); rate_add_rate(&rate_in, span.proto_in.pc_bytes, msecs); activity_in = rate_get_average(&rate_in); rate_add_rate(&rate_out, span.proto_out.pc_bytes, msecs); activity_out = rate_get_average(&rate_out); rate_add_rate(&pps_rate, span.proto_total.pc_packets, msecs); pps = rate_get_average(&pps_rate); rate_add_rate(&pps_rate_in, span.proto_in.pc_packets, msecs); pps_in = rate_get_average(&pps_rate_in); rate_add_rate(&pps_rate_out, span.proto_out.pc_packets, msecs); pps_out = rate_get_average(&pps_rate_out); memset(&span, 0, sizeof(span)); starttime = now; start_tv = tv; wattrset(statwin, HIGHATTR); rate_print(activity, buf, sizeof(buf)); mvwprintw(statwin, 14, 19, "%s", buf); rate_print_pps(pps, buf, sizeof(buf)); mvwprintw(statwin, 15, 19, "%s", buf); rate_print(activity_in, buf, sizeof(buf)); mvwprintw(statwin, 17, 19, "%s", buf); rate_print_pps(pps_in, buf, sizeof(buf)); mvwprintw(statwin, 18, 19, "%s", buf); rate_print(activity_out, buf, sizeof(buf)); mvwprintw(statwin, 20, 19, "%s", buf); rate_print_pps(pps_out, buf, sizeof(buf)); mvwprintw(statwin, 21, 19, "%s", buf); if (activity > peakactivity) peakactivity = activity; if (activity_in > peakactivity_in) peakactivity_in = activity_in; if (activity_out > peakactivity_out) peakactivity_out = activity_out; if (pps > peakpps) peakpps = pps; if (pps_in > peakpps_in) peakpps_in = pps_in; if (pps_out > peakpps_out) peakpps_out = pps_out; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writedstatlog(iface, peakactivity, peakpps, peakactivity_in, peakpps_in, peakactivity_out, peakpps_out, &ifcounts, time(NULL) - statbegin, logfile); startlog = now; } } if (screen_update_needed(&tv, &updtime)) { printdetails(&ifcounts, statwin); update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, statwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } switch (ch) { case ERR: /* no key ready, do nothing */ break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'Q': case 'q': case 'X': case 'x': case 24: case 27: exitloop = 1; break; } if (pkt.pkt_len <= 0) continue; int outgoing; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, options.v6inv4asv6); if (pkt_result != PACKET_OK && pkt_result != MORE_FRAGMENTS) continue; outgoing = (pkt.pkt_pkttype == PACKET_OUTGOING); update_proto_counter(&ifcounts.total, outgoing, pkt.pkt_len); if (pkt.pkt_pkttype == PACKET_BROADCAST) { update_pkt_counter(&ifcounts.bcast, pkt.pkt_len); } update_proto_counter(&span, outgoing, pkt.pkt_len); /* account network layer protocol */ switch(pkt.pkt_protocol) { case ETH_P_IP: if (pkt_result == CHECKSUM_ERROR) { update_pkt_counter(&ifcounts.bad, pkt.pkt_len); continue; } iplen = ntohs(pkt.iphdr->tot_len); update_proto_counter(&ifcounts.ipv4, outgoing, iplen); break; case ETH_P_IPV6: iplen = ntohs(pkt.ip6_hdr->ip6_plen) + 40; update_proto_counter(&ifcounts.ipv6, outgoing, iplen); break; default: update_proto_counter(&ifcounts.nonip, outgoing, iplen); continue; } __u8 ip_protocol = pkt_ip_protocol(&pkt); /* account transport layer protocol */ switch (ip_protocol) { case IPPROTO_TCP: update_proto_counter(&ifcounts.tcp, outgoing, iplen); break; case IPPROTO_UDP: update_proto_counter(&ifcounts.udp, outgoing, iplen); break; case IPPROTO_ICMP: case IPPROTO_ICMPV6: update_proto_counter(&ifcounts.icmp, outgoing, iplen); break; default: update_proto_counter(&ifcounts.other, outgoing, iplen); break; } } err_close: close(fd); err: rate_destroy(&pps_rate_out); rate_destroy(&pps_rate_in); rate_destroy(&pps_rate); rate_destroy(&rate_out); rate_destroy(&rate_in); rate_destroy(&rate); if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } if (logging) { signal(SIGUSR1, SIG_DFL); writedstatlog(iface, peakactivity, peakpps, peakactivity_in, peakpps_in, peakactivity_out, peakpps_out, &ifcounts, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** Detailed interface statistics stopped ********"); fclose(logfile); } del_panel(statpanel); delwin(statwin); strcpy(current_logfile, ""); pkt_cleanup(); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/detstats.h0000664000076400007640000000021712173477703016474 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_DETSTATS_H #define IPTRAF_NG_DETSTATS_H void detstats(char *iface, time_t facilitytime); #endif /* IPTRAF_NG_DETSTATS_H */ iptraf-ng-1.1.4/src/dirs.h0000664000076400007640000000663512173477703015614 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_DIRS_H #define IPTRAF_NG_DIRS_H // TODO: full rewrite #include "getpath.h" /* * IPTraf working file and directory definitions */ /*** *** Directory definitions. The definitions in the Makefile now override *** these directives. ***/ /* * The IPTraf working directory */ #ifndef WORKDIR #define WORKDIR "/var/lib/iptraf-ng" #endif #ifndef LOGDIR #define LOGDIR "/var/log/iptraf-ng" #endif /* * Lock directory. * * !!!!!!! WARNING !!!!!!!! * DO NOT LET THIS REFER TO AN EXISTING/SYSTEM DIRECTORY!!!! THE LOCK * OVERRIDE (iptraf -f) WILL ERASE ALL FILES HERE! */ #ifndef LOCKDIR #define LOCKDIR "/var/lock/iptraf-ng" #endif /*** *** Directory environment variables. Overrides built in definitions. *** You may suit this to your preferences. ***/ /* * Environment variable for IPTraf working directory. Overrides builtin. */ #define WORKDIR_ENV "IPTRAF_WORK_PATH" /* * Environment variable for LOGDIR */ #define LOGDIR_ENV "IPTRAF_LOG_PATH" /*** *** Filename definitions. They depend on the directory definitions *** above. ***/ /* * The IPTraf instance identification file. IPTraf is running if this * file is present, and is deleted afterwards. As of this version, this * file is used to restrict configuration to only the first instance. */ #define IPTIDFILE get_path(T_LOCKDIR, "iptraf.tag") /* * The IPTraf facility identification files. These are used to identify which * facilities are running, allowing only one instance any of them to run * on a network interface. */ #define IPMONIDFILE get_path(T_LOCKDIR, "iptraf-ipmon.tag") #define GSTATIDFILE get_path(T_LOCKDIR, "iptraf-genstat.tag") #define DSTATIDFILE get_path(T_LOCKDIR, "iptraf-detstat.tag") #define TCPUDPIDFILE get_path(T_LOCKDIR, "iptraf-tcpudp.tag") #define LANMONIDFILE get_path(T_LOCKDIR, "iptraf-lanmon.tag") #define FLTIDFILE get_path(T_LOCKDIR, "iptraf-filters.tag") #define OTHIPFLTIDFILE get_path(T_LOCKDIR, "iptraf-othipfltchg.tag") #define PKTSIZEIDFILE get_path(T_LOCKDIR, "iptraf-packetsize.tag") #define PROCCOUNTFILE get_path(T_LOCKDIR, "iptraf-processcount.dat") #define ITRAFMONCOUNTFILE get_path(T_LOCKDIR, "iptraf-itrafmoncount.dat") #define LANMONCOUNTFILE get_path(T_LOCKDIR, "iptraf-lanmoncount.dat") #define PROMISCLISTFILE get_path(T_WORKDIR, "iptraf-promisclist.tmp") #define OTHIPFLNAME get_path(T_WORKDIR, "othipfilters.dat") /* * The filter data file for other protocols */ #define FLTSTATEFILE get_path(T_WORKDIR, "savedfilters.dat") /* * The IPTraf configuration data file */ #define CONFIGFILE get_path(T_WORKDIR, "iptraf.cfg") /* * The IPTraf log files */ #define IPMONLOG get_path(T_LOGDIR, "ip_traffic") #define GSTATLOG get_path(T_LOGDIR, "iface_stats_general.log") #define DSTATLOG get_path(T_LOGDIR, "iface_stats_detailed") #define TCPUDPLOG get_path(T_LOGDIR, "tcp_udp_services") #define LANLOG get_path(T_LOGDIR, "lan_statistics") #define PKTSIZELOG get_path(T_LOGDIR, "packet_size") #define DAEMONLOG get_path(T_LOGDIR, "daemon.log") /* * The additional TCP/UDP ports file */ #define PORTFILE get_path(T_WORKDIR, "ports.dat") /* * The Ethernet and FDDI host description files */ #define ETHFILE get_path(T_WORKDIR, "ethernet.desc") #define FDDIFILE get_path(T_WORKDIR, "fddi.desc") /* * The rvnamed log file */ #define RVNDLOGFILE get_path(T_LOGDIR, "rvnamed-ng.log") #ifndef PATH_MAX #define PATH_MAX 4095 #endif #endif /* IPTRAF_NG_DIRS_H */ iptraf-ng-1.1.4/src/error.c0000664000076400007640000000070112173477703015763 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** error.c - Error-handling subroutines ***/ #include "iptraf-ng-compat.h" #include "log.h" #include "tui/msgboxes.h" void write_error(char *msg, ...) { va_list vararg; va_start(vararg, msg); if (daemonized) write_daemon_err(msg, vararg); else tui_error_va(ANYKEY_MSG, msg, vararg); va_end(vararg); } iptraf-ng-1.1.4/src/error.h0000664000076400007640000000020512173477703015767 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_ERROR_H #define IPTRAF_NG_ERROR_H void write_error(char *msg, ...) __printf(1,2); #endif /* IPTRAF_NG_ERROR_H */ iptraf-ng-1.1.4/src/fltdefs.h0000664000076400007640000000225412173477703016273 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_FLTDEFS_H #define IPTRAF_NG_FLTDEFS_H /*** fltdefs.h - declarations for the TCP, UDP, and misc IP filters ***/ #define FLT_FILENAME_MAX 40 #define FLT_RESOLVE 1 #define FLT_DONTRESOLVE 0 #define F_ALL_IP 0 #define F_TCP 6 #define F_UDP 17 #define F_OTHERIP 59 #define F_ICMP 1 #define F_IGMP 2 #define F_OSPF 89 #define F_IGP 9 #define F_IGRP 88 #define F_GRE 47 #define F_L2TP 115 #define F_IPSEC_AH 51 #define F_IPSEC_ESP 50 #define MATCH_OPPOSITE_ALWAYS 1 #define MATCH_OPPOSITE_USECONFIG 2 /* * IP filter parameter entry */ struct hostparams { char s_fqdn[45]; char d_fqdn[45]; char s_mask[20]; char d_mask[20]; in_port_t sport1; in_port_t sport2; in_port_t dport1; in_port_t dport2; int filters[256]; char protolist[70]; char reverse; char match_opposite; }; struct filterent { struct hostparams hp; unsigned long saddr; unsigned long daddr; unsigned long smask; unsigned long dmask; unsigned int index; struct filterent *next_entry; struct filterent *prev_entry; }; struct filterlist { struct filterent *head; struct filterent *tail; unsigned int lastpos; }; #endif /* IPTRAF_NG_FLTDEFS_H */ iptraf-ng-1.1.4/src/fltedit.c0000664000076400007640000003042512173477703016273 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** fltedit.c - the filter editing Facility ***/ #include "iptraf-ng-compat.h" #include "tui/labels.h" #include "tui/menurt.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "fltdefs.h" #include "fltmgr.h" #include "ipfilter.h" #include "dirs.h" #include "getpath.h" #include "attrs.h" #include "deskman.h" #include "error.h" #include "cidr.h" void init_filter_table(struct filterlist *fl) { fl->head = fl->tail = NULL; } /* * Loads the filter from the filter file */ int loadfilter(char *filename, struct filterlist *fl, int resolve) { struct filterent *fe; int pfd; unsigned int idx = 0; int br; int resolv_err = 0; init_filter_table(fl); pfd = open(filename, O_RDONLY); if (pfd < 0) { write_error("Error opening IP filter data file"); fl->head = NULL; return 1; } do { fe = xmalloc(sizeof(struct filterent)); br = read(pfd, &(fe->hp), sizeof(struct hostparams)); if (br > 0) { fe->index = idx; if (resolve) { fe->saddr = nametoaddr(fe->hp.s_fqdn, &resolv_err); fe->daddr = nametoaddr(fe->hp.d_fqdn, &resolv_err); if (resolv_err) { free(fe); continue; } fe->smask = inet_addr(fe->hp.s_mask); fe->dmask = inet_addr(fe->hp.d_mask); } if (fl->head == NULL) { fl->head = fe; fe->prev_entry = NULL; } else { fl->tail->next_entry = fe; fe->prev_entry = fl->tail; } fe->next_entry = NULL; fl->tail = fe; idx++; } else { free(fe); } } while (br > 0); if (br == 0) close(pfd); return 0; } void savefilter(char *filename, struct filterlist *fl) { struct filterent *fe = fl->head; int pfd; int bw; pfd = open(filename, O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR); while (fe != NULL) { bw = write(pfd, &(fe->hp), sizeof(struct hostparams)); if (bw < 0) { tui_error(ANYKEY_MSG, "Unable to save filter changes"); return; } fe = fe->next_entry; } close(pfd); } void print_hostparam_line(struct filterent *fe, int idx, WINDOW * win, int attr) { struct in_addr binmask; wattrset(win, attr); scrollok(win, 0); mvwprintw(win, idx, 0, "%78c", ' '); mvwaddnstr(win, idx, 1, fe->hp.s_fqdn, 20); if (inet_aton(fe->hp.s_mask, &binmask) == 0) inet_aton("255.255.255.255", &binmask); wprintw(win, "/%u", cidr_get_maskbits(binmask.s_addr)); if (fe->hp.sport2 == 0) wprintw(win, ":%u", fe->hp.sport1); else wprintw(win, ":%u-%u", fe->hp.sport1, fe->hp.sport2); wmove(win, idx, 34); if (fe->hp.match_opposite != 'Y') wprintw(win, "-->"); else wprintw(win, "<->"); mvwaddnstr(win, idx, 38, fe->hp.d_fqdn, 15); if (inet_aton(fe->hp.d_mask, &binmask) == 0) inet_aton("255.255.255.255", &binmask); wprintw(win, "/%u", cidr_get_maskbits(binmask.s_addr)); if (fe->hp.dport2 == 0) wprintw(win, ":%u", fe->hp.dport1); else wprintw(win, ":%u-%u", fe->hp.dport1, fe->hp.dport2); mvwprintw(win, idx, 76, "%c", toupper(fe->hp.reverse)); wmove(win, idx, 0); } void update_hp_screen(struct filterent *firstvisible, WINDOW * win) { struct filterent *ftmp = firstvisible; int i; wattrset(win, STDATTR); if (firstvisible == NULL) { mvwprintw(win, 0, 0, "%78c", ' '); wmove(win, 0, 0); return; } scrollok(win, 0); for (i = 0; i <= 12; i++) { if (ftmp != NULL) { print_hostparam_line(ftmp, i, win, STDATTR); ftmp = ftmp->next_entry; } else { mvwprintw(win, i, 0, "%78c", ' '); wmove(win, i, 0); } } scrollok(win, 1); } void modify_host_parameters(struct filterlist *fl) { WINDOW *bwin; PANEL *bpanel; WINDOW *win; PANEL *panel; struct filterent *fe; struct filterent *ftemp; struct filterent *firstvisible = NULL; unsigned int idx = 0; int endloop_local = 0; int ch; int gh_aborted = 0; char s_portstr1[8]; char d_portstr1[8]; char s_portstr2[8]; char d_portstr2[8]; char inexstr[2]; char matchop[2]; bwin = newwin(15, 80, (LINES - 15) / 2, (COLS - 80) / 2); bpanel = new_panel(bwin); win = newwin(13, 78, (LINES - 13) / 2, (COLS - 78) / 2); panel = new_panel(win); wattrset(bwin, BOXATTR); tx_box(bwin, ACS_VLINE, ACS_HLINE); mvwprintw(bwin, 0, 2, " Source "); mvwprintw(bwin, 0, 38, " Destination "); mvwprintw(bwin, 0, 74, " I/E "); mvwprintw(bwin, 14, 1, " Filter Data "); tx_stdwinset(win); scrollok(win, 0); wattrset(win, STDATTR); tx_colorwin(win); move(LINES - 1, 1); tx_printkeyhelp("Up/Down", "-move ptr ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("I", "-insert ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("A", "-add to list ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("D", "-delete ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("Enter", "-edit ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("X/Ctrl+X", "-exit", stdscr, HIGHATTR, STATUSBARATTR); update_panels(); doupdate(); firstvisible = fl->head; update_hp_screen(firstvisible, win); idx = 0; fe = firstvisible; update_panels(); doupdate(); do { if (fe != NULL) { print_hostparam_line(fe, idx, win, BARSTDATTR); } ch = wgetch(win); if (fe != NULL) print_hostparam_line(fe, idx, win, STDATTR); switch (ch) { case KEY_UP: if (fl->head != NULL) { if (fe->prev_entry != NULL) { if (idx > 0) idx--; else { scrollok(win, 1); wscrl(win, -1); firstvisible = firstvisible->prev_entry; } fe = fe->prev_entry; } } break; case KEY_DOWN: if (fl->head != NULL) { if (fe->next_entry != NULL) { if (idx < 12) idx++; else { scrollok(win, 1); wscrl(win, 1); firstvisible = firstvisible->next_entry; } fe = fe->next_entry; } } break; case 'i': case 'I': case KEY_IC: ftemp = xmallocz(sizeof(struct filterent)); gethostparams(&(ftemp->hp), "", "", "", "", "", "", "", "", "I", "N", &gh_aborted); if (gh_aborted) { free(ftemp); continue; } if (fl->head == NULL) { ftemp->next_entry = ftemp->prev_entry = NULL; fl->head = fl->tail = ftemp; firstvisible = fl->head; idx = 0; } else { ftemp->next_entry = fe; ftemp->prev_entry = fe->prev_entry; /* * Point firstvisible at new entry if we inserted at the * top of the list. */ if (ftemp->prev_entry == NULL) { fl->head = ftemp; firstvisible = ftemp; } else fe->prev_entry->next_entry = ftemp; fe->prev_entry = ftemp; } if (ftemp->next_entry == NULL) fl->tail = ftemp; fe = ftemp; update_hp_screen(firstvisible, win); break; case 'a': case 'A': case 1: ftemp = xmallocz(sizeof(struct filterent)); gethostparams(&(ftemp->hp), "", "", "", "", "", "", "", "", "I", "N", &gh_aborted); if (gh_aborted) { free(ftemp); continue; } /* * Add new node to the end of the list (or to the head if the * list is empty. */ if (fl->tail != NULL) { fl->tail->next_entry = ftemp; ftemp->prev_entry = fl->tail; } else { fl->head = ftemp; fl->tail = ftemp; ftemp->prev_entry = ftemp->next_entry = NULL; firstvisible = fl->head; fe = ftemp; idx = 0; } ftemp->next_entry = NULL; fl->tail = ftemp; update_hp_screen(firstvisible, win); break; case 'd': case 'D': case KEY_DC: if (fl->head != NULL) { /* * Move firstvisible down if it's pointing to the target * entry. */ if (firstvisible == fe) firstvisible = fe->next_entry; /* * Detach target node from list. */ if (fe->next_entry != NULL) fe->next_entry->prev_entry = fe->prev_entry; else fl->tail = fe->prev_entry; if (fe->prev_entry != NULL) fe->prev_entry->next_entry = fe->next_entry; else fl->head = fe->next_entry; /* * Move pointer up if we're deleting the last entry. * The list tail pointer has since been moved to the * previous entry. */ if (fe->prev_entry == fl->tail) { ftemp = fe->prev_entry; /* * Move screen pointer up. Really adjust the index if * the pointer is anywhere below the top of the screen. */ if (idx > 0) idx--; else { /* * Otherwise scroll the list down, and adjust the * firstvisible pointer to point to the entry * previous to the target. */ if (ftemp != NULL) { firstvisible = ftemp; } } } else /* * If we reach this point, we're deleting from before * the tail of the list. In that case, we point the * screen pointer at the entry following the target. */ ftemp = fe->next_entry; free(fe); fe = ftemp; update_hp_screen(firstvisible, win); } break; case 13: if (fe != NULL) { sprintf(s_portstr1, "%u", fe->hp.sport1); sprintf(s_portstr2, "%u", fe->hp.sport2); sprintf(d_portstr1, "%u", fe->hp.dport1); sprintf(d_portstr2, "%u", fe->hp.dport2); inexstr[0] = toupper(fe->hp.reverse); inexstr[1] = '\0'; matchop[0] = toupper(fe->hp.match_opposite); matchop[1] = '\0'; gethostparams(&(fe->hp), fe->hp.s_fqdn, fe->hp.s_mask, s_portstr1, s_portstr2, fe->hp.d_fqdn, fe->hp.d_mask, d_portstr1, d_portstr2, inexstr, matchop, &gh_aborted); update_hp_screen(firstvisible, win); } break; case 'x': case 'X': case 'q': case 'Q': case 27: case 24: endloop_local = 1; break; case 'l': case 'L': tx_refresh_screen(); break; } update_panels(); doupdate(); } while (!endloop_local); del_panel(panel); delwin(win); del_panel(bpanel); delwin(bwin); update_panels(); doupdate(); } /* * Remove a currently applied filter from memory */ void destroyfilter(struct filterlist *fl) { struct filterent *fe; struct filterent *cfe; if (fl->head != NULL) { fe = fl->head; cfe = fl->head->next_entry; do { free(fe); fe = cfe; if (cfe != NULL) cfe = cfe->next_entry; } while (fe != NULL); fl->head = fl->tail = NULL; } } void definefilter(int *aborted) { struct filterfileent ffile; char fntemp[14]; struct filterlist fl; int pfd; int bw; get_filter_description(ffile.desc, aborted, ""); if (*aborted) return; genname(time(NULL), fntemp); pfd = open(get_path(T_WORKDIR, fntemp), O_CREAT | O_WRONLY | O_TRUNC, S_IRUSR | S_IWUSR); if (pfd < 0) { tui_error(ANYKEY_MSG, "Cannot create filter data file"); *aborted = 1; return; } close(pfd); pfd = open(OTHIPFLNAME, O_CREAT | O_WRONLY | O_APPEND, S_IRUSR | S_IWUSR); if (pfd < 0) { listfileerr(1); return; } strcpy(ffile.filename, fntemp); bw = write(pfd, &ffile, sizeof(struct filterfileent)); if (bw < 0) listfileerr(2); close(pfd); init_filter_table(&fl); modify_host_parameters(&fl); savefilter(get_path(T_WORKDIR, fntemp), &fl); destroyfilter(&fl); } /* * Edit an existing filter */ void editfilter(int *aborted) { char filename[FLT_FILENAME_MAX]; struct filterlist fl; struct ffnode *flist; struct ffnode *ffile; struct filterfileent *ffe; if (loadfilterlist(&flist) == 1) { listfileerr(1); destroyfilterlist(flist); return; } pickafilter(flist, &ffile, aborted); if ((*aborted)) { destroyfilterlist(flist); return; } ffe = &(ffile->ffe); get_filter_description(ffe->desc, aborted, ffe->desc); if (*aborted) { destroyfilterlist(flist); return; } strncpy(filename, get_path(T_WORKDIR, ffe->filename), FLT_FILENAME_MAX - 1); if (loadfilter(filename, &fl, FLT_DONTRESOLVE)) return; modify_host_parameters(&fl); save_filterlist(flist); /* This also destroys it */ savefilter(filename, &fl); destroyfilter(&fl); } /* * Delete a filter record from the disk */ void delfilter(int *aborted) { struct ffnode *fltfile; struct ffnode *fltlist; if (loadfilterlist(&fltlist) == 1) { *aborted = 1; listfileerr(1); destroyfilterlist(fltlist); return; } pickafilter(fltlist, &fltfile, aborted); if (*aborted) return; unlink(get_path(T_WORKDIR, fltfile->ffe.filename)); if (fltfile->prev_entry == NULL) { fltlist = fltlist->next_entry; if (fltlist != NULL) fltlist->prev_entry = NULL; } else { fltfile->prev_entry->next_entry = fltfile->next_entry; if (fltfile->next_entry != NULL) fltfile->next_entry->prev_entry = fltfile->prev_entry; } free(fltfile); save_filterlist(fltlist); *aborted = 0; } iptraf-ng-1.1.4/src/fltedit.h0000664000076400007640000000054012173477703016273 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_FLTEDIT_H #define IPTRAF_NG_FLTEDIT_H void definefilter(int *aborted); int loadfilter(char *filename, struct filterlist *fl, int resolve); void savefilter(char *filename, struct filterlist *fl); void destroyfilter(struct filterlist *fl); void editfilter(int *aborted); void delfilter(int *aborted); #endif /* IPTRAF_NG_FLTEDIT_H */ iptraf-ng-1.1.4/src/fltmgr.c0000664000076400007640000001646012173477703016136 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** fltmgr.c - filter list management routines ***/ #include "iptraf-ng-compat.h" #include "tui/input.h" #include "tui/labels.h" #include "tui/listbox.h" #include "tui/menurt.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "attrs.h" #include "deskman.h" #include "dirs.h" #include "fltdefs.h" #include "fltmgr.h" #include "error.h" void makestdfiltermenu(struct MENU *menu) { tx_initmenu(menu, 9, 31, (LINES - 8) / 2, (COLS - 31) / 2 + 15, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(menu, " ^D^efine new filter...", "Defines a new set of IP filter parameters"); tx_additem(menu, " ^A^pply filter...", "Applies a defined filter"); tx_additem(menu, " Detac^h^ filter", "Removes the currently applied filter"); tx_additem(menu, " ^E^dit filter...", "Modifies existing filter data"); tx_additem(menu, " Dele^t^e filter...", "Removes an IP filter from the filter list"); tx_additem(menu, NULL, NULL); tx_additem(menu, " E^x^it menu", "Returns to the main menu"); } /* * Generate a string representation of a number to be used as a name. */ void genname(unsigned long n, char *m) { sprintf(m, "%lu", n); } void listfileerr(int code) { if (code == 1) write_error("Error loading filter list file"); else write_error("Error writing filter list file"); } unsigned long int nametoaddr(char *ascname, int *err) { unsigned long int result; struct hostent *he; char imsg[45]; struct in_addr inp; int resolv_err = 0; resolv_err = inet_aton(ascname, &inp); if (resolv_err == 0) { snprintf(imsg, 44, "Resolving %s", ascname); indicate(imsg); he = gethostbyname(ascname); if (he != NULL) bcopy((he->h_addr_list)[0], &result, he->h_length); else { write_error("Unable to resolve %s", ascname); *err = 1; return (-1); } } else result = inp.s_addr; return (result); *err = 0; } int loadfilterlist(struct ffnode **fltfile) { int pfd = 0; int result = 0; struct ffnode *ffiles = NULL; struct ffnode *ptemp; struct ffnode *tail = NULL; struct ffnode *insert_point = NULL; /* new node is inserted *above* this */ int br; pfd = open(OTHIPFLNAME, O_RDONLY); if (pfd < 0) { *fltfile = NULL; return 1; } do { ptemp = xmalloc(sizeof(struct ffnode)); br = read(pfd, &(ptemp->ffe), sizeof(struct filterfileent)); if (br > 0) { if (ffiles == NULL) { /* * Create single-node list should initial list pointer be empty */ ffiles = ptemp; ffiles->prev_entry = ffiles->next_entry = NULL; tail = ffiles; } else { /* * Find appropriate point for insertion into sorted list. */ insert_point = ffiles; while (insert_point != NULL) { if (strcasecmp (insert_point->ffe.desc, ptemp->ffe.desc) < 0) insert_point = insert_point->next_entry; else break; } /* * Insert new node depending on whether insert_point = top of list; * middle of list; end of list. */ if (insert_point == NULL) { /* Case 1: end of list; if insert_point is NULL, we get it out of the way first */ tail->next_entry = ptemp; ptemp->prev_entry = tail; tail = ptemp; ptemp->next_entry = NULL; } else if (insert_point->prev_entry == NULL) { /* Case 2: top of list */ insert_point->prev_entry = ptemp; ffiles = ptemp; ffiles->prev_entry = NULL; ffiles->next_entry = insert_point; insert_point->prev_entry = ffiles; } else { /* Case 3: middle of list */ ptemp->prev_entry = insert_point->prev_entry; ptemp->next_entry = insert_point; insert_point->prev_entry->next_entry = ptemp; insert_point->prev_entry = ptemp; } } } else { free(ptemp); if (br < 0) result = 1; } } while (br > 0); close(pfd); *fltfile = ffiles; if (ffiles == NULL) result = 1; return result; } void destroyfilterlist(struct ffnode *fltlist) { struct ffnode *fftemp; if (fltlist != NULL) { fftemp = fltlist->next_entry; do { free(fltlist); fltlist = fftemp; if (fftemp != NULL) fftemp = fftemp->next_entry; } while (fltlist != NULL); } } void save_filterlist(struct ffnode *fltlist) { struct ffnode *fltfile; struct ffnode *ffntemp; int fd; int bw; fd = open(OTHIPFLNAME, O_WRONLY | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR); if (fd < 0) { listfileerr(2); return; } fltfile = fltlist; while (fltfile != NULL) { bw = write(fd, &(fltfile->ffe), sizeof(struct filterfileent)); if (bw < 0) { listfileerr(2); return; } ffntemp = fltfile; fltfile = fltfile->next_entry; free(ffntemp); } close(fd); } void operate_select(struct ffnode *ffiles, struct ffnode **item, int *aborted) { struct ffnode *pptr; int ch; struct scroll_list list; tx_listkeyhelp(STDATTR, HIGHATTR); update_panels(); doupdate(); pptr = ffiles; tx_init_listbox(&list, 60, 10, (COLS - 60) / 2 - 2, (LINES - 10) / 2 - 2, STDATTR, BOXATTR, BARSTDATTR, HIGHATTR); tx_set_listbox_title(&list, "Select Filter", 1); while (pptr != NULL) { tx_add_list_entry(&list, (char *) pptr, pptr->ffe.desc); pptr = pptr->next_entry; } tx_show_listbox(&list); tx_operate_listbox(&list, &ch, aborted); if (!(*aborted)) *item = (struct ffnode *) list.textptr->nodeptr; tx_close_listbox(&list); tx_destroy_list(&list); } void pickafilter(struct ffnode *ffiles, struct ffnode **fltfile, int *aborted) { operate_select(ffiles, fltfile, aborted); update_panels(); doupdate(); } char *pickfilterbyname(struct ffnode *ffiles, char *filtername) { struct ffnode *ftmp = ffiles; static char filterfile[160]; while (ftmp != NULL) { if (strcmp(ftmp->ffe.desc, filtername) == 0) { strncpy(filterfile, ftmp->ffe.filename, 40); return filterfile; } ftmp = ftmp->next_entry; } return NULL; } void selectfilter(struct filterfileent *ffe, int *aborted) { struct ffnode *fltfile; struct ffnode *ffiles; if (loadfilterlist(&ffiles)) { listfileerr(1); *aborted = 1; destroyfilterlist(ffiles); return; } pickafilter(ffiles, &fltfile, aborted); if (!(*aborted)) *ffe = fltfile->ffe; destroyfilterlist(ffiles); } void get_filter_description(char *description, int *aborted, char *pre_edit) { struct FIELDLIST descfield; int dlgwintop; WINDOW *dlgwin; PANEL *dlgpanel; dlgwintop = (LINES - 9) / 2; dlgwin = newwin(7, 42, dlgwintop, (COLS - 42) / 2 - 10); dlgpanel = new_panel(dlgwin); wattrset(dlgwin, DLGBOXATTR); tx_colorwin(dlgwin); tx_box(dlgwin, ACS_VLINE, ACS_HLINE); wattrset(dlgwin, DLGTEXTATTR); wmove(dlgwin, 2, 2); wprintw(dlgwin, "Enter a description for this filter"); wmove(dlgwin, 5, 2); stdkeyhelp(dlgwin); update_panels(); doupdate(); tx_initfields(&descfield, 1, 35, dlgwintop + 3, (COLS - 42) / 2 - 8, DLGTEXTATTR, FIELDATTR); tx_addfield(&descfield, 33, 0, 0, pre_edit); do { tx_fillfields(&descfield, aborted); if ((descfield.list->buf[0] == '\0') && (!(*aborted))) tui_error(ANYKEY_MSG, "Enter an appropriate description for this filter"); } while ((descfield.list->buf[0] == '\0') && (!(*aborted))); if (!(*aborted)) strcpy(description, descfield.list->buf); tx_destroyfields(&descfield); del_panel(dlgpanel); delwin(dlgwin); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/fltmgr.h0000664000076400007640000000166612173477703016145 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_FLTMGR_H #define IPTRAF_NG_FLTMGR_H /*** fltmgr.h - filter list management routine prototypes ***/ struct filterfileent { char desc[35]; char filename[40]; }; struct ffnode { struct filterfileent ffe; struct ffnode *next_entry; struct ffnode *prev_entry; }; void makestdfiltermenu(struct MENU *menu); void makemainfiltermenu(struct MENU *menu); int loadfilterlist(struct ffnode **fltfile); void save_filterlist(struct ffnode *fltlist); void pickafilter(struct ffnode *files, struct ffnode **fltfile, int *aborted); char *pickfilterbyname(struct ffnode *fltlist, char *filename); void selectfilter(struct filterfileent *ffe, int *aborted); void destroyfilterlist(struct ffnode *fltlist); void get_filter_description(char *description, int *aborted, char *pre_edit); void genname(unsigned long n, char *m); unsigned long int nametoaddr(char *ascname, int *err); void listfileerr(int code); #endif /* IPTRAF_NG_FLTMGR_H */ iptraf-ng-1.1.4/src/fltselect.c0000664000076400007640000000741312173477703016626 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** fltselect.c - a menu-based module that allows selection of other protocols to display ***/ #include "iptraf-ng-compat.h" #include "tui/menurt.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "addproto.h" #include "dirs.h" #include "fltdefs.h" #include "fltselect.h" #include "fltedit.h" #include "fltmgr.h" #include "ipfilter.h" #include "deskman.h" #include "attrs.h" struct filterstate ofilter; void makemainfiltermenu(struct MENU *menu) { tx_initmenu(menu, 8, 18, (LINES - 8) / 2, (COLS - 31) / 2, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(menu, " ^I^P...", "Manages IP packet filters"); tx_additem(menu, " ^A^RP", "Toggles Address Resolution Protocol filter"); tx_additem(menu, " ^R^ARP", "Toggles Reverse ARP filter"); tx_additem(menu, " ^N^on-IP", "Toggles filter for all other non-IP packets"); tx_additem(menu, NULL, NULL); tx_additem(menu, " E^x^it menu", "Returns to the filter management menu"); } void setfilters(unsigned int row) { int aborted; switch (row) { case 1: ipfilterselect(&aborted); break; case 2: ofilter.arp = ~ofilter.arp; break; case 3: ofilter.rarp = ~ofilter.rarp; break; case 4: ofilter.nonip = ~ofilter.nonip; break; } } void toggleprotodisplay(WINDOW *win, unsigned int row) { wmove(win, row, 2); switch (row) { case 1: if (ofilter.filtercode == 0) wprintw(win, "No IP filter active"); else wprintw(win, "IP filter active "); break; case 2: if (ofilter.arp) wprintw(win, "ARP visible "); else wprintw(win, "ARP not visible"); break; case 3: if (ofilter.rarp) wprintw(win, "RARP visible "); else wprintw(win, "RARP not visible"); break; case 4: if (ofilter.nonip) wprintw(win, "Non-IP visible "); else wprintw(win, "Non-IP not visible"); break; } } /* * Filter for non-IP packets */ int nonipfilter(unsigned int protocol) { int result = 0; switch (protocol) { case ETH_P_ARP: result = ofilter.arp; break; case ETH_P_RARP: result = ofilter.rarp; break; default: result = ofilter.nonip; break; } return result; } void config_filters(void) { struct MENU menu; WINDOW *statwin; PANEL *statpanel; int row; int aborted; statwin = newwin(6, 30, (LINES - 8) / 2, (COLS - 15) / 2 + 10); statpanel = new_panel(statwin); wattrset(statwin, BOXATTR); tx_colorwin(statwin); tx_box(statwin, ACS_VLINE, ACS_HLINE); tx_stdwinset(statwin); wmove(statwin, 0, 1); wprintw(statwin, " Filter Status "); wattrset(statwin, STDATTR); for (row = 1; row <= 4; row++) toggleprotodisplay(statwin, row); makemainfiltermenu(&menu); row = 1; do { tx_showmenu(&menu); tx_operatemenu(&menu, &row, &aborted); setfilters(row); toggleprotodisplay(statwin, row); } while (row != 6); tx_destroymenu(&menu); del_panel(statpanel); delwin(statwin); update_panels(); doupdate(); } void setodefaults(void) { memset(&ofilter, 0, sizeof(struct filterstate)); ofilter.filtercode = 0; } void loadfilters(void) { int pfd; int br; pfd = open(FLTSTATEFILE, O_RDONLY); /* open filter state file */ if (pfd < 0) { setodefaults(); return; } br = read(pfd, &ofilter, sizeof(struct filterstate)); if (br < 0) setodefaults(); close(pfd); /* * Reload IP filter if one was previously applied */ if (ofilter.filtercode != 0) loadfilter(ofilter.filename, &ofilter.fl, FLT_RESOLVE); } void savefilters(void) { int pfd; int bw; pfd = open(FLTSTATEFILE, O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR); bw = write(pfd, &ofilter, sizeof(struct filterstate)); if (bw < 1) tui_error(ANYKEY_MSG, "Unable to write filter state information"); close(pfd); } iptraf-ng-1.1.4/src/fltselect.h0000664000076400007640000000075312173477703016633 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_FLTSELECT_H #define IPTRAF_NG_FLTSELECT_H /*** othfilter.h - declarations for the non-TCP filter module ***/ #include "fltdefs.h" struct filterstate { char filename[FLT_FILENAME_MAX]; int filtercode; struct filterlist fl; unsigned int arp:1, rarp:1, nonip:1, padding:13; }; extern struct filterstate ofilter; void config_filters(void); void loadfilters(void); void savefilters(void); int nonipfilter(unsigned int protocol); #endif /* IPTRAF_NG_FLTSELECT_H */ iptraf-ng-1.1.4/src/getpath.c0000664000076400007640000000133112173477703016266 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ // TODO: full rewrite #include "iptraf-ng-compat.h" #include "dirs.h" char *get_path(int dirtype, char *file) { static char path[PATH_MAX]; char *ptr = NULL; char *dir, *env = NULL; switch (dirtype) { case T_WORKDIR: dir = WORKDIR; env = WORKDIR_ENV; break; case T_LOGDIR: dir = LOGDIR; env = LOGDIR_ENV; break; case T_LOCKDIR: dir = LOCKDIR; break; default: return file; } if ((dirtype != T_LOCKDIR) && (ptr = getenv(env)) != NULL) dir = ptr; if (dir == NULL || *dir == '\0') return file; snprintf(path, PATH_MAX - 1, "%s/%s", dir, file); return path; } iptraf-ng-1.1.4/src/getpath.h0000664000076400007640000000032412173477703016274 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_GETPATH_H #define IPTRAF_NG_GETPATH_H #define T_WORKDIR 1 #define T_LOGDIR 2 #define T_EXECDIR 3 #define T_LOCKDIR 4 char *get_path(int dirtype, char *file); #endif /* IPTRAF_NG_GETPATH_H */ iptraf-ng-1.1.4/src/hostmon.c0000664000076400007640000005704712173477703016340 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** hostmon.c - Host traffic monitor Discovers LAN hosts and displays packet statistics for them ***/ #include "iptraf-ng-compat.h" #include "tui/labels.h" #include "tui/winops.h" #include "dirs.h" #include "deskman.h" #include "fltdefs.h" #include "packet.h" #include "ifaces.h" #include "hostmon.h" #include "attrs.h" #include "log.h" #include "timer.h" #include "landesc.h" #include "options.h" #include "logvars.h" #include "promisc.h" #include "error.h" #include "rate.h" #define SCROLLUP 0 #define SCROLLDOWN 1 struct ethtabent { int type; union { struct { unsigned long long inpcount; unsigned long long inbcount; unsigned long long inippcount; unsigned long inspanbr; unsigned long long outpcount; unsigned long long outbcount; unsigned long long outippcount; unsigned long outspanbr; struct rate inrate; struct rate outrate; } figs; struct { char eth_addr[ETH_ALEN]; char ascaddr[18]; char desc[65]; char ifname[IFNAMSIZ]; int withdesc; int printed; unsigned int linktype; } desc; } un; unsigned int index; struct ethtabent *prev_entry; struct ethtabent *next_entry; }; struct ethtab { struct ethtabent *head; struct ethtabent *tail; struct ethtabent *firstvisible; struct ethtabent *lastvisible; unsigned long count; unsigned long entcount; int units; WINDOW *borderwin; PANEL *borderpanel; WINDOW *tabwin; PANEL *tabpanel; }; /* * SIGUSR1 logfile rotation handler */ static void rotate_lanlog(int s __unused) { rotate_flag = 1; strcpy(target_logname, current_logfile); signal(SIGUSR1, rotate_lanlog); } static void writeethlog(struct ethtabent *list, unsigned long nsecs, FILE *fd) { char atime[TIME_TARGET_MAX]; struct ethtabent *ptmp = list; genatime(time(NULL), atime); fprintf(fd, "\n*** LAN traffic log, generated %s\n\n", atime); while (ptmp != NULL) { if (ptmp->type == 0) { if (ptmp->un.desc.linktype == ARPHRD_ETHER) fprintf(fd, "\nEthernet address: %s", ptmp->un.desc.ascaddr); else if (ptmp->un.desc.linktype == ARPHRD_FDDI) fprintf(fd, "\nFDDI address: %s", ptmp->un.desc.ascaddr); if (ptmp->un.desc.withdesc) fprintf(fd, " (%s)", ptmp->un.desc.desc); fprintf(fd, "\n"); } else { fprintf(fd, "\tIncoming total %llu packets, %llu bytes; %llu IP packets\n", ptmp->un.figs.inpcount, ptmp->un.figs.inbcount, ptmp->un.figs.inippcount); fprintf(fd, "\tOutgoing total %llu packets, %llu bytes; %llu IP packets\n", ptmp->un.figs.outpcount, ptmp->un.figs.outbcount, ptmp->un.figs.outippcount); fprintf(fd, "\tAverage rates: "); char buf_in[32]; char buf_out[32]; rate_print(ptmp->un.figs.inbcount / nsecs, buf_in, sizeof(buf_in)); rate_print(ptmp->un.figs.outbcount / nsecs, buf_out, sizeof(buf_out)); fprintf(fd, "%s incoming, %s outgoing\n", buf_in, buf_out); if (nsecs > 5) { rate_print(rate_get_average(&ptmp->un.figs.inrate), buf_in, sizeof(buf_in)); rate_print(rate_get_average(&ptmp->un.figs.outrate), buf_out, sizeof(buf_out)); fprintf(fd, "\tLast 5-second rates: %s incoming, %s outgoing\n", buf_in, buf_out); } } ptmp = ptmp->next_entry; } fprintf(fd, "\nRunning time: %lu seconds\n", nsecs); fflush(fd); } static void initethtab(struct ethtab *table) { table->head = table->tail = NULL; table->firstvisible = table->lastvisible = NULL; table->count = table->entcount = 0; table->borderwin = newwin(LINES - 2, COLS, 1, 0); table->borderpanel = new_panel(table->borderwin); table->tabwin = newwin(LINES - 4, COLS - 2, 2, 1); table->tabpanel = new_panel(table->tabwin); wattrset(table->borderwin, BOXATTR); tx_box(table->borderwin, ACS_VLINE, ACS_HLINE); wmove(table->borderwin, 0, 5 * COLS / 80); wprintw(table->borderwin, " PktsIn "); wmove(table->borderwin, 0, 16 * COLS / 80); wprintw(table->borderwin, " IP In "); wmove(table->borderwin, 0, 24 * COLS / 80); wprintw(table->borderwin, " BytesIn "); wmove(table->borderwin, 0, 34 * COLS / 80); wprintw(table->borderwin, " InRate "); wmove(table->borderwin, 0, 42 * COLS / 80); wprintw(table->borderwin, " PktsOut "); wmove(table->borderwin, 0, 53 * COLS / 80); wprintw(table->borderwin, " IP Out "); wmove(table->borderwin, 0, 61 * COLS / 80); wprintw(table->borderwin, " BytesOut "); wmove(table->borderwin, 0, 70 * COLS / 80); wprintw(table->borderwin, " OutRate "); wmove(table->borderwin, LINES - 3, 40); wprintw(table->borderwin, " InRate and OutRate are in %s ", dispmode(options.actmode)); wattrset(table->tabwin, STDATTR); tx_colorwin(table->tabwin); tx_stdwinset(table->tabwin); wtimeout(table->tabwin, -1); update_panels(); doupdate(); } static struct ethtabent *addethnode(struct ethtab *table) { struct ethtabent *ptemp; ptemp = xmalloc(sizeof(struct ethtabent)); if (table->head == NULL) { ptemp->prev_entry = NULL; table->head = ptemp; table->firstvisible = ptemp; } else { ptemp->prev_entry = table->tail; table->tail->next_entry = ptemp; } table->tail = ptemp; ptemp->next_entry = NULL; table->count++; ptemp->index = table->count; if (table->count <= (unsigned) LINES - 4) table->lastvisible = ptemp; return ptemp; } void convmacaddr(char *addr, char *result) { u_int8_t *ptmp = (u_int8_t *) addr; sprintf(result, "%02x:%02x:%02x:%02x:%02x:%02x", *ptmp, *(ptmp + 1), *(ptmp + 2), *(ptmp + 3), *(ptmp + 4), *(ptmp + 5)); } static struct ethtabent *addethentry(struct ethtab *table, unsigned int linktype, char *ifname, char *addr, struct eth_desc *list) { struct ethtabent *ptemp; ptemp = addethnode(table); if (ptemp == NULL) return NULL; ptemp->type = 0; memcpy(&(ptemp->un.desc.eth_addr), addr, ETH_ALEN); strcpy(ptemp->un.desc.desc, ""); convmacaddr(addr, ptemp->un.desc.ascaddr); ptemp->un.desc.linktype = linktype; struct eth_desc *desc = NULL; list_for_each_entry(desc, &list->hd_list, hd_list) if (!strcasecmp(desc->hd_mac, ptemp->un.desc.ascaddr)) strcpy(ptemp->un.desc.desc, desc->hd_desc); strcpy(ptemp->un.desc.ifname, ifname); if (strcmp(ptemp->un.desc.desc, "") == 0) ptemp->un.desc.withdesc = 0; else ptemp->un.desc.withdesc = 1; ptemp->un.desc.printed = 0; ptemp = addethnode(table); if (ptemp == NULL) return NULL; ptemp->type = 1; ptemp->un.figs.inpcount = 0; ptemp->un.figs.outpcount = 0; ptemp->un.figs.inspanbr = ptemp->un.figs.outspanbr = 0; ptemp->un.figs.inippcount = ptemp->un.figs.outippcount = 0; ptemp->un.figs.inbcount = ptemp->un.figs.outbcount = 0; rate_alloc(&ptemp->un.figs.inrate, 5); rate_alloc(&ptemp->un.figs.outrate, 5); table->entcount++; wmove(table->borderwin, LINES - 3, 1); wprintw(table->borderwin, " %u entries ", table->entcount); return ptemp; } static struct ethtabent *in_ethtable(struct ethtab *table, unsigned int linktype, char *addr) { struct ethtabent *ptemp = table->head; while (ptemp != NULL) { if ((ptemp->type == 0) && (memcmp(addr, ptemp->un.desc.eth_addr, ETH_ALEN) == 0) && (ptemp->un.desc.linktype == linktype)) return ptemp->next_entry; ptemp = ptemp->next_entry; } return NULL; } static void updateethent(struct ethtabent *entry, int pktsize, int is_ip, int inout) { if (inout == 0) { entry->un.figs.inpcount++; entry->un.figs.inbcount += pktsize; entry->un.figs.inspanbr += pktsize; if (is_ip) entry->un.figs.inippcount++; } else { entry->un.figs.outpcount++; entry->un.figs.outbcount += pktsize; entry->un.figs.outspanbr += pktsize; if (is_ip) entry->un.figs.outippcount++; } } static void printethent(struct ethtab *table, struct ethtabent *entry, unsigned int idx) { unsigned int target_row; if ((entry->index < idx) || (entry->index > idx + LINES - 5)) return; target_row = entry->index - idx; if (entry->type == 0) { wmove(table->tabwin, target_row, 1); wattrset(table->tabwin, STDATTR); if (entry->un.desc.linktype == ARPHRD_ETHER) wprintw(table->tabwin, "Ethernet"); else if (entry->un.desc.linktype == ARPHRD_FDDI) wprintw(table->tabwin, "FDDI"); wprintw(table->tabwin, " HW addr: %s", entry->un.desc.ascaddr); if (entry->un.desc.withdesc) wprintw(table->tabwin, " (%s)", entry->un.desc.desc); wprintw(table->tabwin, " on %s ", entry->un.desc.ifname); entry->un.desc.printed = 1; } else { wattrset(table->tabwin, PTRATTR); wmove(table->tabwin, target_row, 1); waddch(table->tabwin, ACS_LLCORNER); wattrset(table->tabwin, HIGHATTR); /* Inbound traffic counts */ wmove(table->tabwin, target_row, 2 * COLS / 80); printlargenum(entry->un.figs.inpcount, table->tabwin); wmove(table->tabwin, target_row, 12 * COLS / 80); printlargenum(entry->un.figs.inippcount, table->tabwin); wmove(table->tabwin, target_row, 22 * COLS / 80); printlargenum(entry->un.figs.inbcount, table->tabwin); /* Outbound traffic counts */ wmove(table->tabwin, target_row, 40 * COLS / 80); printlargenum(entry->un.figs.outpcount, table->tabwin); wmove(table->tabwin, target_row, 50 * COLS / 80); printlargenum(entry->un.figs.outippcount, table->tabwin); wmove(table->tabwin, target_row, 60 * COLS / 80); printlargenum(entry->un.figs.outbcount, table->tabwin); } } static void destroyethtab(struct ethtab *table) { struct ethtabent *ptemp = table->head; struct ethtabent *cnext = NULL; if (table->head != NULL) cnext = table->head->next_entry; while (ptemp != NULL) { if (ptemp->type == 1) { rate_destroy(&ptemp->un.figs.outrate); rate_destroy(&ptemp->un.figs.inrate); } free(ptemp); ptemp = cnext; if (cnext != NULL) cnext = cnext->next_entry; } } static void hostmonhelp(void) { move(LINES - 1, 1); scrollkeyhelp(); sortkeyhelp(); stdexitkeyhelp(); } static void printrates(struct ethtab *table, unsigned int target_row, struct ethtabent *ptmp) { char buf[32]; rate_print_no_units(rate_get_average(&ptmp->un.figs.inrate), buf, sizeof(buf)); wmove(table->tabwin, target_row, 32 * COLS / 80); wprintw(table->tabwin, "%s", buf); rate_print_no_units(rate_get_average(&ptmp->un.figs.outrate), buf, sizeof(buf)); wmove(table->tabwin, target_row, 69 * COLS / 80); wprintw(table->tabwin, "%s", buf); } static void updateethrates(struct ethtab *table, unsigned long msecs, unsigned int idx) { struct ethtabent *ptmp = table->head; unsigned int target_row = 0; if (table->lastvisible == NULL) return; while (ptmp != NULL) { if (ptmp->type == 1) { rate_add_rate(&ptmp->un.figs.inrate, ptmp->un.figs.inspanbr, msecs); ptmp->un.figs.inspanbr = 0; rate_add_rate(&ptmp->un.figs.outrate, ptmp->un.figs.outspanbr, msecs); ptmp->un.figs.outspanbr = 0; if ((ptmp->index >= idx) && (ptmp->index <= idx + LINES - 5)) { wattrset(table->tabwin, HIGHATTR); target_row = ptmp->index - idx; printrates(table, target_row, ptmp); } } ptmp = ptmp->next_entry; } } static void refresh_hostmon_screen(struct ethtab *table, unsigned int idx) { struct ethtabent *ptmp = table->firstvisible; wattrset(table->tabwin, STDATTR); tx_colorwin(table->tabwin); while ((ptmp != NULL) && (ptmp->prev_entry != table->lastvisible)) { printethent(table, ptmp, idx); ptmp = ptmp->next_entry; } update_panels(); doupdate(); } static void scrollethwin(struct ethtab *table, int direction, unsigned int *idx) { char sp_buf[10]; sprintf(sp_buf, "%%%dc", COLS - 2); wattrset(table->tabwin, STDATTR); if (direction == SCROLLUP) { if (table->lastvisible != table->tail) { wscrl(table->tabwin, 1); table->lastvisible = table->lastvisible->next_entry; table->firstvisible = table->firstvisible->next_entry; (*idx)++; wmove(table->tabwin, LINES - 5, 0); scrollok(table->tabwin, 0); wprintw(table->tabwin, sp_buf, ' '); scrollok(table->tabwin, 1); printethent(table, table->lastvisible, *idx); if (table->lastvisible->type == 1) printrates(table, LINES - 5, table->lastvisible); } } else { if (table->firstvisible != table->head) { wscrl(table->tabwin, -1); table->lastvisible = table->lastvisible->prev_entry; table->firstvisible = table->firstvisible->prev_entry; (*idx)--; wmove(table->tabwin, 0, 0); wprintw(table->tabwin, sp_buf, ' '); printethent(table, table->firstvisible, *idx); if (table->firstvisible->type == 1) printrates(table, 0, table->firstvisible); } } } static void pageethwin(struct ethtab *table, int direction, unsigned int *idx) { int i = 1; if (direction == SCROLLUP) { while ((i <= LINES - 7) && (table->lastvisible != table->tail)) { i++; table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->lastvisible->next_entry; (*idx)++; } } else { while ((i <= LINES - 7) && (table->firstvisible != table->head)) { i++; table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; (*idx)--; } } refresh_hostmon_screen(table, *idx); } static void show_hostsort_keywin(WINDOW ** win, PANEL ** panel) { *win = newwin(13, 35, (LINES - 10) / 2, COLS - 40); *panel = new_panel(*win); wattrset(*win, DLGBOXATTR); tx_colorwin(*win); tx_box(*win, ACS_VLINE, ACS_HLINE); wattrset(*win, DLGTEXTATTR); mvwprintw(*win, 2, 2, "Select sort criterion"); wmove(*win, 4, 2); tx_printkeyhelp("P", " - total packets in", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 5, 2); tx_printkeyhelp("I", " - IP packets in", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 6, 2); tx_printkeyhelp("B", " - total bytes in", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 7, 2); tx_printkeyhelp("K", " - total packets out", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 8, 2); tx_printkeyhelp("O", " - IP packets out", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 9, 2); tx_printkeyhelp("Y", " - total bytes out", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 10, 2); tx_printkeyhelp("Any other key", " - cancel sort", *win, DLGHIGHATTR, DLGTEXTATTR); update_panels(); doupdate(); } /* * Swap two host table entries. */ static void swaphostents(struct ethtab *list, struct ethtabent *p1, struct ethtabent *p2) { register unsigned int tmp; struct ethtabent *p1prevsaved; struct ethtabent *p2nextsaved; if (p1 == p2) return; tmp = p1->index; p1->index = p2->index; p2->index = tmp; p1->next_entry->index = p1->index + 1; p2->next_entry->index = p2->index + 1; if (p1->prev_entry != NULL) p1->prev_entry->next_entry = p2; else list->head = p2; if (p2->next_entry->next_entry != NULL) p2->next_entry->next_entry->prev_entry = p1->next_entry; else list->tail = p1->next_entry; p2nextsaved = p2->next_entry->next_entry; p1prevsaved = p1->prev_entry; if (p1->next_entry->next_entry == p2) { p2->next_entry->next_entry = p1; p1->prev_entry = p2->next_entry; } else { p2->next_entry->next_entry = p1->next_entry->next_entry; p1->prev_entry = p2->prev_entry; p2->prev_entry->next_entry = p1; p1->next_entry->next_entry->prev_entry = p2->next_entry; } p2->prev_entry = p1prevsaved; p1->next_entry->next_entry = p2nextsaved; } static unsigned long long ql_getkey(struct ethtabent *entry, int ch) { unsigned long long result = 0; switch (ch) { case 'P': result = entry->next_entry->un.figs.inpcount; break; case 'I': result = entry->next_entry->un.figs.inippcount; break; case 'B': result = entry->next_entry->un.figs.inbcount; break; case 'K': result = entry->next_entry->un.figs.outpcount; break; case 'O': result = entry->next_entry->un.figs.outippcount; break; case 'Y': result = entry->next_entry->un.figs.outbcount; break; } return result; } static struct ethtabent *ql_partition(struct ethtab *table, struct ethtabent **low, struct ethtabent **high, int ch) { struct ethtabent *pivot = *low; struct ethtabent *left = *low; struct ethtabent *right = *high; struct ethtabent *ptmp; unsigned long long pivot_value; pivot_value = ql_getkey(pivot, ch); while (left->index < right->index) { while ((ql_getkey(left, ch) >= pivot_value) && (left->next_entry->next_entry != NULL)) left = left->next_entry->next_entry; while (ql_getkey(right, ch) < pivot_value) right = right->prev_entry->prev_entry; if (left->index < right->index) { swaphostents(table, left, right); if (*low == left) *low = right; if (*high == right) *high = left; ptmp = left; left = right; right = ptmp; } } swaphostents(table, pivot, right); if (*low == pivot) *low = right; if (*high == right) *high = pivot; return pivot; } /* * Quicksort routine for the LAN station monitor */ static void quicksort_lan_entries(struct ethtab *table, struct ethtabent *low, struct ethtabent *high, int ch) { struct ethtabent *pivot; if ((high == NULL) || (low == NULL)) return; if (high->index > low->index) { pivot = ql_partition(table, &low, &high, ch); if (pivot->prev_entry != NULL) quicksort_lan_entries(table, low, pivot->prev_entry->prev_entry, ch); quicksort_lan_entries(table, pivot->next_entry->next_entry, high, ch); } } static void sort_hosttab(struct ethtab *list, unsigned int *idx, int command) { struct ethtabent *ptemp1; int idxtmp; if (!list->head) return; command = toupper(command); if ((command != 'P') && (command != 'I') && (command != 'B') && (command != 'K') && (command != 'O') && (command != 'Y')) return; quicksort_lan_entries(list, list->head, list->tail->prev_entry, command); ptemp1 = list->firstvisible = list->head; *idx = 1; idxtmp = 0; tx_colorwin(list->tabwin); while ((ptemp1) && (idxtmp <= LINES - 4)) { printethent(list, ptemp1, *idx); idxtmp++; if (idxtmp <= LINES - 4) list->lastvisible = ptemp1; ptemp1 = ptemp1->next_entry; } } /* * The LAN station monitor */ void hostmon(time_t facilitytime, char *ifptr) { int logging = options.logging; struct ethtab table; struct ethtabent *entry; char scratch_saddr[ETH_ALEN]; char scratch_daddr[ETH_ALEN]; unsigned int idx = 1; int is_ip; int ch; char *ifname = ifptr; struct timeval tv; struct timeval tv_rate; time_t now = 0; time_t statbegin = 0; time_t startlog = 0; struct timeval updtime; struct eth_desc *list = NULL; FILE *logfile = NULL; int pkt_result; WINDOW *sortwin; PANEL *sortpanel; int keymode = 0; int fd; if (ifptr && !dev_up(ifptr)) { err_iface_down(); return; } LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, ifptr); promisc_set_list(&promisc); } hostmonhelp(); initethtab(&table); /* Ethernet description list */ struct eth_desc *elist = load_eth_desc(ARPHRD_ETHER); /* FDDI description list */ struct eth_desc *flist = load_eth_desc(ARPHRD_FDDI); if (logging) { if (strcmp(current_logfile, "") == 0) { strncpy(current_logfile, gen_instance_logname(LANLOG, getpid()), 80); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_lanlog); rotate_flag = 0; writelog(logging, logfile, "******** LAN traffic monitor started ********"); } leaveok(table.tabwin, TRUE); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(ifptr && dev_bind_ifname(fd, ifptr) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; gettimeofday(&tv, NULL); tv_rate = tv; updtime = tv; statbegin = startlog = tv.tv_sec; PACKET_INIT(pkt); do { gettimeofday(&tv, NULL); now = tv.tv_sec; unsigned long msecs = timeval_diff_msec(&tv, &tv_rate); if (msecs >= 1000) { printelapsedtime(statbegin, now, LINES - 3, 15, table.borderwin); updateethrates(&table, msecs, idx); tv_rate = tv; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writeethlog(table.head, now - statbegin, logfile); startlog = now; } } if (screen_update_needed(&tv, &updtime)) { update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, table.tabwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch != ERR) { if (keymode == 0) { switch (ch) { case KEY_UP: scrollethwin(&table, SCROLLDOWN, &idx); break; case KEY_DOWN: scrollethwin(&table, SCROLLUP, &idx); break; case KEY_PPAGE: case '-': pageethwin(&table, SCROLLDOWN, &idx); break; case KEY_NPAGE: case ' ': pageethwin(&table, SCROLLUP, &idx); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 's': case 'S': show_hostsort_keywin(&sortwin, &sortpanel); keymode = 1; break; case 'q': case 'Q': case 'x': case 'X': case 27: case 24: exitloop = 1; } } else if (keymode == 1) { del_panel(sortpanel); delwin(sortwin); sort_hosttab(&table, &idx, ch); keymode = 0; } } if (pkt.pkt_len <= 0) continue; char ifnamebuf[IFNAMSIZ]; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, 0); if (pkt_result != PACKET_OK) continue; if (!ifptr) { /* we're capturing on "All interfaces", */ /* so get the name of the interface */ /* of this packet */ int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf); if (r != 0) { write_error("Unable to get interface name"); break; /* can't get interface name, get out! */ } ifname = ifnamebuf; } /* get HW addresses */ switch (pkt.pkt_hatype) { case ARPHRD_ETHER: { memcpy(scratch_saddr, pkt.ethhdr->h_source, ETH_ALEN); memcpy(scratch_daddr, pkt.ethhdr->h_dest, ETH_ALEN); list = elist; break; } case ARPHRD_FDDI: { memcpy(scratch_saddr, pkt.fddihdr->saddr, FDDI_K_ALEN); memcpy(scratch_daddr, pkt.fddihdr->daddr, FDDI_K_ALEN); list = flist; break; } default: /* unknown link protocol */ continue; } switch(pkt.pkt_protocol) { case ETH_P_IP: case ETH_P_IPV6: is_ip = 1; break; default: is_ip = 0; break; } /* Check source address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_saddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_saddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 1); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } /* Check destination address entry */ entry = in_ethtable(&table, pkt.pkt_hatype, scratch_daddr); if (!entry) entry = addethentry(&table, pkt.pkt_hatype, ifname, scratch_daddr, list); if (entry != NULL) { updateethent(entry, pkt.pkt_len, is_ip, 0); if (!entry->prev_entry->un.desc.printed) printethent(&table, entry->prev_entry, idx); printethent(&table, entry, idx); } } while (!exitloop); err_close: close(fd); err: if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } if (logging) { signal(SIGUSR1, SIG_DFL); writeethlog(table.head, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** LAN traffic monitor stopped ********"); fclose(logfile); } del_panel(table.tabpanel); delwin(table.tabwin); del_panel(table.borderpanel); delwin(table.borderwin); update_panels(); doupdate(); destroyethtab(&table); free_eth_desc(elist); free_eth_desc(flist); strcpy(current_logfile, ""); } iptraf-ng-1.1.4/src/hostmon.h0000664000076400007640000000026712173477703016335 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_HOSTMON_H #define IPTRAF_NG_HOSTMON_H void convmacaddr(char *addr, char *result); void hostmon(time_t facilitytime, char *ifptr); #endif /* IPTRAF_NG_HOSTMON_H */ iptraf-ng-1.1.4/src/ifaces.c0000664000076400007640000001171712173477703016075 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** ifaces.c - routine that determines whether a given interface is supported by IPTraf ***/ #include "iptraf-ng-compat.h" #include "error.h" /* * Open /proc/net/dev and move file pointer past the two table header lines * at the top of the file. */ FILE *open_procnetdev(void) { FILE *fd; char buf[161]; fd = fopen("/proc/net/dev", "r"); /* * Read and discard the table header lines in the file */ if (fd != NULL) { fgets(buf, 160, fd); fgets(buf, 160, fd); } return fd; } /* * Get the next interface from /proc/net/dev. */ int get_next_iface(FILE * fd, char *ifname, int n) { char buf[161]; strcpy(ifname, ""); if (!feof(fd)) { strcpy(buf, ""); fgets(buf, 160, fd); if (strcmp(buf, "") != 0) { memset(ifname, 0, n); strncpy(ifname, skip_whitespace(strtok(buf, ":")), n); if (ifname[n - 1] != '\0') strcpy(ifname, ""); return 1; } } return 0; } int dev_up(char *iface) { int fd; int ir; struct ifreq ifr; fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); strcpy(ifr.ifr_name, iface); ir = ioctl(fd, SIOCGIFFLAGS, &ifr); close(fd); if ((ir != 0) || (!(ifr.ifr_flags & IFF_UP))) return 0; return 1; } void err_iface_down(void) { write_error("Specified interface not active"); } int dev_get_ifindex(const char *iface) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr; strcpy(ifr.ifr_name, iface); int ir = ioctl(fd, SIOCGIFINDEX, &ifr); /* need to preserve errno across call to close() */ int saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) { errno = saved_errno; return ir; } return ifr.ifr_ifindex; } int dev_get_mtu(const char *iface) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr; strcpy(ifr.ifr_name, iface); int ir = ioctl(fd, SIOCGIFMTU, &ifr); /* need to preserve errno across call to close() */ int saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) { errno = saved_errno; return ir; } return ifr.ifr_mtu; } int dev_get_flags(const char *iface) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr; strcpy(ifr.ifr_name, iface); int ir = ioctl(fd, SIOCGIFFLAGS, &ifr); /* need to preserve errno across call to close() */ int saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) { errno = saved_errno; return ir; } return ifr.ifr_flags; } int dev_set_flags(const char *iface, int flags) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr; strcpy(ifr.ifr_name, iface); int ir = ioctl(fd, SIOCGIFFLAGS, &ifr); if (ir == -1) goto err; ifr.ifr_flags |= flags; ir = ioctl(fd, SIOCSIFFLAGS, &ifr); int saved_errno; err: /* need to preserve errno across call to close() */ saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) errno = saved_errno; return ir; } int dev_clear_flags(const char *iface, int flags) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr; strcpy(ifr.ifr_name, iface); int ir = ioctl(fd, SIOCGIFFLAGS, &ifr); if (ir == -1) goto err; ifr.ifr_flags &= ~flags; ir = ioctl(fd, SIOCSIFFLAGS, &ifr); int saved_errno; err: /* need to preserve errno across call to close() */ saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) errno = saved_errno; return ir; } int dev_get_ifname(int ifindex, char *ifname) { int fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP); if (fd == -1) return fd; struct ifreq ifr = { .ifr_ifindex = ifindex }; int ir = ioctl(fd, SIOCGIFNAME, &ifr); /* need to preserve errno across call to close() */ int saved_errno = errno; close(fd); /* bug out if ioctl() failed */ if (ir != 0) { errno = saved_errno; return ir; } strncpy(ifname, ifr.ifr_name, IFNAMSIZ); return ir; } int dev_bind_ifindex(int fd, const int ifindex) { struct sockaddr_ll fromaddr; socklen_t addrlen = sizeof(fromaddr); fromaddr.sll_family = AF_PACKET; fromaddr.sll_protocol = htons(ETH_P_ALL); fromaddr.sll_ifindex = ifindex; return bind(fd, (struct sockaddr *) &fromaddr, addrlen); } int dev_bind_ifname(int fd, const char const *ifname) { int ir; struct ifreq ifr; strcpy(ifr.ifr_name, ifname); ir = ioctl(fd, SIOCGIFINDEX, &ifr); if (ir) return ir; return dev_bind_ifindex(fd, ifr.ifr_ifindex); } char *gen_iface_msg(char *ifptr) { static char if_msg[20]; if (ifptr == NULL) strcpy(if_msg, "all interfaces"); else strncpy(if_msg, ifptr, 20); return if_msg; } int dev_promisc_flag(const char *dev_name) { int flags = dev_get_flags(dev_name); if (flags < 0) { write_error("Unable to obtain interface parameters for %s", dev_name); return -1; } if (flags & IFF_PROMISC) return -1; return flags; } iptraf-ng-1.1.4/src/ifaces.h0000664000076400007640000000145112173477703016074 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_IFACES_H #define IPTRAF_NG_IFACES_H #define dev_set_promisc(dev) dev_set_flags((dev), IFF_PROMISC) #define dev_clr_promisc(dev) dev_clear_flags((dev), IFF_PROMISC) FILE *open_procnetdev(void); int get_next_iface(FILE * fd, char *ifname, int n); int dev_up(char *iface); void err_iface_down(void); int dev_get_ifindex(const char *iface); int dev_get_mtu(const char *iface); int dev_get_flags(const char *iface); int dev_set_flags(const char *iface, int flags); int dev_clear_flags(const char *iface, int flags); int dev_get_ifname(int ifindex, char *ifname); int dev_bind_ifindex(const int fd, const int ifindex); int dev_bind_ifname(const int fd, const char const *ifname); char *gen_iface_msg(char *ifptr); int dev_promisc_flag(const char *dev_name); #endif /* IPTRAF_NG_IFACES_H */ iptraf-ng-1.1.4/src/ifstats.c0000664000076400007640000003702412173477703016317 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** ifstats.c - the interface statistics module ***/ #include "iptraf-ng-compat.h" #include "tui/labels.h" #include "tui/listbox.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "ifaces.h" #include "fltdefs.h" #include "packet.h" #include "options.h" #include "log.h" #include "dirs.h" #include "deskman.h" #include "attrs.h" #include "serv.h" #include "timer.h" #include "logvars.h" #include "promisc.h" #include "error.h" #include "ifstats.h" #include "rate.h" #define SCROLLUP 0 #define SCROLLDOWN 1 struct iflist { char ifname[IFNAMSIZ]; int ifindex; unsigned int encap; unsigned long long iptotal; unsigned long long ip6total; unsigned long badtotal; unsigned long long noniptotal; unsigned long long total; unsigned int spanbr; unsigned long br; struct rate rate; unsigned long peakrate; unsigned int index; struct iflist *prev_entry; struct iflist *next_entry; }; struct iftab { struct iflist *head; struct iflist *tail; struct iflist *firstvisible; struct iflist *lastvisible; WINDOW *borderwin; PANEL *borderpanel; WINDOW *statwin; PANEL *statpanel; }; /* * USR1 log-rotation signal handlers */ static void rotate_gstat_log(int s __unused) { rotate_flag = 1; strcpy(target_logname, GSTATLOG); signal(SIGUSR1, rotate_gstat_log); } static void writegstatlog(struct iftab *table, unsigned long nsecs, FILE *fd) { struct iflist *ptmp = table->head; char atime[TIME_TARGET_MAX]; genatime(time(NULL), atime); fprintf(fd, "\n*** General interface statistics log generated %s\n\n", atime); while (ptmp != NULL) { fprintf(fd, "%s: %llu total, %llu IP, %llu non-IP, %lu IP checksum errors", ptmp->ifname, ptmp->total, ptmp->iptotal, ptmp->noniptotal, ptmp->badtotal); if (nsecs > 5) { char buf[64]; rate_print(ptmp->br / nsecs, buf, sizeof(buf)); fprintf(fd, ", average activity %s", buf); rate_print(ptmp->peakrate, buf, sizeof(buf)); fprintf(fd, ", peak activity %s", buf); rate_print(rate_get_average(&ptmp->rate), buf, sizeof(buf)); fprintf(fd, ", last 5-second average activity %s", buf); } fprintf(fd, "\n"); ptmp = ptmp->next_entry; } fprintf(fd, "\n%lu seconds running time\n", nsecs); fflush(fd); } /* * Function to check if an interface is already in the interface list. * This eliminates duplicate interface entries due to aliases */ static int ifinlist(struct iflist *list, char *ifname) { struct iflist *ptmp = list; int result = 0; while ((ptmp != NULL) && (result == 0)) { result = (strcmp(ifname, ptmp->ifname) == 0); ptmp = ptmp->next_entry; } return result; } /* * Initialize the list of interfaces. This linked list is used in the * selection boxes as well as in the general interface statistics screen. * * This function parses the /proc/net/dev file and grabs the interface names * from there. The SIOGIFFLAGS ioctl() call is used to determine whether the * interfaces are active. Inactive interfaces are omitted from selection * lists. */ static void initiflist(struct iflist **list) { char ifname[IFNAMSIZ]; *list = NULL; FILE *fd = open_procnetdev(); if (fd == NULL) { tui_error(ANYKEY_MSG, "Unable to obtain interface list"); return; } while (get_next_iface(fd, ifname, sizeof(ifname))) { if (!*ifname) continue; if (ifinlist(*list, ifname)) /* ignore entry if already in */ continue; /* interface list */ /* * Check if the interface is actually up running. This prevents * inactive devices in /proc/net/dev from actually appearing in * interface lists used by IPTraf. */ if (!dev_up(ifname)) continue; int ifindex = dev_get_ifindex(ifname); if (ifindex < 0) continue; /* * At this point, the interface is now sure to be up and running. */ struct iflist *itmp = xmallocz(sizeof(struct iflist)); strcpy(itmp->ifname, ifname); itmp->ifindex = ifindex; rate_alloc(&itmp->rate, 5); /* make the linked list sorted by ifindex */ struct iflist *cur = *list, *last = NULL; while (cur != NULL && cur->ifindex < ifindex) { last = cur; cur = cur->next_entry; } itmp->prev_entry = last; itmp->next_entry = cur; if (cur) cur->prev_entry = itmp; if (last) last->next_entry = itmp; else *list = itmp; } fclose(fd); /* let the index follow the sorted linked list */ unsigned int index = 1; struct iflist *cur; for (cur = *list; cur != NULL; cur = cur->next_entry) cur->index = index++; } static struct iflist *positionptr(struct iflist *iflist, const int ifindex) { struct iflist *ptmp = iflist; struct iflist *last = ptmp; while ((ptmp != NULL) && (ptmp->ifindex != ifindex)) { last = ptmp; ptmp = ptmp->next_entry; } /* no interface was found, try to create new one */ if (ptmp == NULL) { struct iflist *itmp = xmallocz(sizeof(struct iflist)); itmp->ifindex = ifindex; itmp->index = last->index + 1; int r = dev_get_ifname(ifindex, itmp->ifname); if (r != 0) { write_error("Error getting interface name"); return(NULL); } /* last can't be NULL otherwise we will have empty iflist */ last->next_entry = itmp; itmp->prev_entry = last; itmp->next_entry = NULL; ptmp = itmp; } return(ptmp); } static void destroyiflist(struct iflist *list) { struct iflist *ctmp; struct iflist *ptmp; if (list != NULL) { ptmp = list; ctmp = ptmp->next_entry; do { rate_destroy(&ptmp->rate); free(ptmp); ptmp = ctmp; if (ctmp != NULL) ctmp = ctmp->next_entry; } while (ptmp != NULL); } } static void no_ifaces_error(void) { write_error("No active interfaces. Check their status or the /proc filesystem"); } static void updaterates(struct iftab *table, unsigned long msecs) { struct iflist *ptmp = table->head; unsigned long rate; while (ptmp != NULL) { rate_add_rate(&ptmp->rate, ptmp->spanbr, msecs); rate = rate_get_average(&ptmp->rate); if (rate > ptmp->peakrate) ptmp->peakrate = rate; ptmp->spanbr = 0; ptmp = ptmp->next_entry; } } static void showrates(struct iftab *table) { struct iflist *ptmp = table->firstvisible; unsigned int idx = table->firstvisible->index; unsigned long rate; char buf[64]; wattrset(table->statwin, HIGHATTR); do { rate = rate_get_average(&ptmp->rate); rate_print(rate, buf, sizeof(buf)); wmove(table->statwin, ptmp->index - idx, 63 * COLS / 80); wprintw(table->statwin, "%s", buf); ptmp = ptmp->next_entry; } while (ptmp != table->lastvisible->next_entry); } static void printifentry(struct iflist *ptmp, WINDOW * win, unsigned int idx) { unsigned int target_row; if ((ptmp->index < idx) || (ptmp->index > idx + (LINES - 5))) return; target_row = ptmp->index - idx; wattrset(win, STDATTR); wmove(win, target_row, 1); wprintw(win, "%s", ptmp->ifname); wattrset(win, HIGHATTR); wmove(win, target_row, 14 * COLS / 80); printlargenum(ptmp->total, win); wmove(win, target_row, 24 * COLS / 80); printlargenum(ptmp->iptotal, win); wmove(win, target_row, 34 * COLS / 80); printlargenum(ptmp->ip6total, win); wmove(win, target_row, 44 * COLS / 80); printlargenum(ptmp->noniptotal, win); wmove(win, target_row, 53 * COLS / 80); wprintw(win, "%7lu", ptmp->badtotal); } static void print_if_entries(struct iftab *table) { struct iflist *ptmp = table->firstvisible; unsigned int i = 1; unsigned int winht = LINES - 4; do { printifentry(ptmp, table->statwin, table->firstvisible->index); if (i <= winht) table->lastvisible = ptmp; ptmp = ptmp->next_entry; i++; } while ((ptmp != NULL) && (i <= winht)); } static void labelstats(WINDOW *win) { wmove(win, 0, 1); wprintw(win, " Iface "); /* 14, 24, 34, ... from printifentry() */ /* 10 = strlen(printed number); from printlargenum() */ /* 7 = strlen(" Total ") */ /* 1 = align the string on 'l' from " Total " */ wmove(win, 0, (14 * COLS / 80) + 10 - 7 + 1); wprintw(win, " Total "); wmove(win, 0, (24 * COLS / 80) + 10 - 6 + 1); wprintw(win, " IPv4 "); wmove(win, 0, (34 * COLS / 80) + 10 - 6 + 1); wprintw(win, " IPv6 "); wmove(win, 0, (44 * COLS / 80) + 10 - 7 + 1); wprintw(win, " NonIP "); wmove(win, 0, (53 * COLS / 80) + 8 - 7 + 1); wprintw(win, " BadIP "); wmove(win, 0, (63 * COLS / 80) + 14 - 10); wprintw(win, " Activity "); } static void initiftab(struct iftab *table) { table->borderwin = newwin(LINES - 2, COLS, 1, 0); table->borderpanel = new_panel(table->borderwin); move(LINES - 1, 1); scrollkeyhelp(); stdexitkeyhelp(); wattrset(table->borderwin, BOXATTR); tx_box(table->borderwin, ACS_VLINE, ACS_HLINE); labelstats(table->borderwin); table->statwin = newwin(LINES - 4, COLS - 2, 2, 1); table->statpanel = new_panel(table->statwin); tx_stdwinset(table->statwin); wtimeout(table->statwin, -1); wattrset(table->statwin, STDATTR); tx_colorwin(table->statwin); wattrset(table->statwin, BOXATTR); wmove(table->borderwin, LINES - 3, 32 * COLS / 80); wprintw(table->borderwin, " Total, IP, NonIP, and BadIP are packet counts "); } /* * Scrolling routines for the general interface statistics window */ static void scrollgstatwin(struct iftab *table, int direction) { char buf[255]; sprintf(buf, "%%%dc", COLS - 2); wattrset(table->statwin, STDATTR); if (direction == SCROLLUP) { if (table->lastvisible->next_entry != NULL) { wscrl(table->statwin, 1); table->lastvisible = table->lastvisible->next_entry; table->firstvisible = table->firstvisible->next_entry; wmove(table->statwin, LINES - 5, 0); scrollok(table->statwin, 0); wprintw(table->statwin, buf, ' '); scrollok(table->statwin, 1); printifentry(table->lastvisible, table->statwin, table->firstvisible->index); } } else { if (table->firstvisible != table->head) { wscrl(table->statwin, -1); table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; wmove(table->statwin, 0, 0); wprintw(table->statwin, buf, ' '); printifentry(table->firstvisible, table->statwin, table->firstvisible->index); } } } static void pagegstatwin(struct iftab *table, int direction) { int i = 1; if (direction == SCROLLUP) { while ((i <= LINES - 5) && (table->lastvisible->next_entry != NULL)) { i++; scrollgstatwin(table, direction); } } else { while ((i <= LINES - 5) && (table->firstvisible != table->head)) { i++; scrollgstatwin(table, direction); } } } /* * The general interface statistics function */ void ifstats(time_t facilitytime) { int logging = options.logging; struct iftab table; int pkt_result = 0; struct iflist *ptmp = NULL; FILE *logfile = NULL; int ch; int fd; struct timeval tv; time_t starttime = 0; time_t statbegin = 0; time_t now = 0; struct timeval start_tv; time_t startlog = 0; struct timeval updtime; initiflist(&(table.head)); if (!table.head) { no_ifaces_error(); return; } initiftab(&table); LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, NULL); promisc_set_list(&promisc); } if (logging) { if (strcmp(current_logfile, "") == 0) { strcpy(current_logfile, GSTATLOG); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, GSTATLOG); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_gstat_log); rotate_flag = 0; writelog(logging, logfile, "******** General interface statistics started ********"); } table.firstvisible = table.head; print_if_entries(&table); update_panels(); doupdate(); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } exitloop = 0; gettimeofday(&tv, NULL); start_tv = tv; updtime = tv; starttime = startlog = statbegin = tv.tv_sec; PACKET_INIT(pkt); while (!exitloop) { gettimeofday(&tv, NULL); now = tv.tv_sec; if ((now - starttime) >= 1) { unsigned long msecs; msecs = timeval_diff_msec(&tv, &start_tv); updaterates(&table, msecs); showrates(&table); printelapsedtime(statbegin, now, LINES - 3, 1, table.borderwin); starttime = now; start_tv = tv; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writegstatlog(&table, time(NULL) - statbegin, logfile); startlog = now; } } if (screen_update_needed(&tv, &updtime)) { print_if_entries(&table); update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - statbegin) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, table.statwin) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } switch (ch) { case ERR: /* no key ready, do nothing */ break; case KEY_UP: scrollgstatwin(&table, SCROLLDOWN); break; case KEY_DOWN: scrollgstatwin(&table, SCROLLUP); break; case KEY_PPAGE: case '-': pagegstatwin(&table, SCROLLDOWN); break; case KEY_NPAGE: case ' ': pagegstatwin(&table, SCROLLUP); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'Q': case 'q': case 'X': case 'x': case 27: case 24: exitloop = 1; break; } if (pkt.pkt_len <= 0) continue; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, options.v6inv4asv6); if (pkt_result != PACKET_OK && pkt_result != MORE_FRAGMENTS) continue; ptmp = positionptr(table.head, pkt.pkt_ifindex); if (!ptmp) continue; ptmp->total++; ptmp->spanbr += pkt.pkt_len; ptmp->br += pkt.pkt_len; if (pkt.pkt_protocol == ETH_P_IP) { ptmp->iptotal++; if (pkt_result == CHECKSUM_ERROR) { (ptmp->badtotal)++; continue; } } else if (pkt.pkt_protocol == ETH_P_IPV6) { ptmp->ip6total++; } else { (ptmp->noniptotal)++; } } close(fd); err: if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } del_panel(table.statpanel); delwin(table.statwin); del_panel(table.borderpanel); delwin(table.borderwin); update_panels(); doupdate(); if (logging) { signal(SIGUSR1, SIG_DFL); writegstatlog(&table, time(NULL) - statbegin, logfile); writelog(logging, logfile, "******** General interface statistics stopped ********"); fclose(logfile); } destroyiflist(table.head); pkt_cleanup(); strcpy(current_logfile, ""); } void selectiface(char *ifname, int withall, int *aborted) { int ch; struct iflist *list; struct iflist *ptmp; struct scroll_list scrolllist; initiflist(&list); if (list == NULL) { no_ifaces_error(); *aborted = 1; return; } if ((withall) && (list != NULL)) { ptmp = xmalloc(sizeof(struct iflist)); strncpy(ptmp->ifname, "All interfaces", sizeof(ptmp->ifname)); ptmp->ifindex = 0; rate_alloc(&ptmp->rate, 5); /* FIXME: need iflist_entry_init() */ ptmp->prev_entry = NULL; list->prev_entry = ptmp; ptmp->next_entry = list; list = ptmp; } tx_listkeyhelp(STDATTR, HIGHATTR); ptmp = list; tx_init_listbox(&scrolllist, 24, 14, (COLS - 24) / 2 - 9, (LINES - 14) / 2, STDATTR, BOXATTR, BARSTDATTR, HIGHATTR); tx_set_listbox_title(&scrolllist, "Select Interface", 1); while (ptmp != NULL) { tx_add_list_entry(&scrolllist, (char *) ptmp, ptmp->ifname); ptmp = ptmp->next_entry; } tx_show_listbox(&scrolllist); tx_operate_listbox(&scrolllist, &ch, aborted); tx_close_listbox(&scrolllist); if (!(*aborted) && (list != NULL)) { ptmp = (struct iflist *) scrolllist.textptr->nodeptr; if ((withall) && (ptmp->prev_entry == NULL)) /* All Interfaces */ strcpy(ifname, ""); else strcpy(ifname, ptmp->ifname); } tx_destroy_list(&scrolllist); destroyiflist(list); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/ifstats.h0000664000076400007640000000027112173477703016316 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_IFSTATS_H #define IPTRAF_NG_IFSTATS_H void selectiface(char *ifname, int withall, int *aborted); void ifstats(time_t facilitytime); #endif /* IPTRAF_NG_IFSTATS_H */ iptraf-ng-1.1.4/src/ipfilter.c0000664000076400007640000002703212173477703016456 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** ipfilter.c - user interface and filter function for all IP packets ***/ #include "iptraf-ng-compat.h" #include "tui/input.h" #include "tui/menurt.h" #include "tui/msgboxes.h" #include "addproto.h" #include "dirs.h" #include "deskman.h" #include "attrs.h" #include "fltdefs.h" #include "fltmgr.h" #include "fltselect.h" #include "ipfilter.h" #include "fltedit.h" #include "getpath.h" #include "parseproto.h" #include "cidr.h" static in_port_t parse_port(char *buf) { unsigned int value; if ((strtoul_ui(buf, 10, &value) == 0) && (value <= 65535)) return value; else return 0; } void gethostparams(struct hostparams *data, char *init_saddr, char *init_smask, char *init_sport1, char *init_sport2, char *init_daddr, char *init_dmask, char *init_dport1, char *init_dport2, char *initinex, char *initmatchop, int *aborted) { WINDOW *dlgwin; PANEL *dlgpanel; struct FIELDLIST fields; struct FIELD *fieldptr; unsigned int rangeproto1, rangeproto2; int parse_result; char *bptr, *cptr; int doagain; unsigned int i; char msgstr[60]; char actual_address[30]; unsigned int maskbits; const char *WILDCARD = "0.0.0.0"; dlgwin = newwin(22, 80, (LINES - 22) / 2, (COLS - 80) / 2); dlgpanel = new_panel(dlgwin); wattrset(dlgwin, DLGBOXATTR); tx_colorwin(dlgwin); tx_box(dlgwin, ACS_VLINE, ACS_HLINE); mvwprintw(dlgwin, 0, 22, " Source "); mvwprintw(dlgwin, 0, 52, " Destination "); wmove(dlgwin, 20, 2); tabkeyhelp(dlgwin); stdkeyhelp(dlgwin); wattrset(dlgwin, DLGTEXTATTR); mvwprintw(dlgwin, 2, 2, "IP address"); mvwprintw(dlgwin, 4, 2, "Wildcard mask"); mvwprintw(dlgwin, 6, 2, "Port"); mvwprintw(dlgwin, 9, 2, "Protocols to match"); mvwprintw(dlgwin, 10, 2, "(Enter Y beside each"); mvwprintw(dlgwin, 11, 2, "protocol to match.)"); mvwprintw(dlgwin, 18, 2, "Include/Exclude (I/E)"); tx_initfields(&fields, 19, 55, (LINES - 22) / 2 + 1, (COLS - 80) / 2 + 23, DLGTEXTATTR, FIELDATTR); mvwprintw(fields.fieldwin, 5, 6, "to"); mvwprintw(fields.fieldwin, 5, 36, "to"); mvwprintw(fields.fieldwin, 6, 0, "Port fields apply only to TCP and UDP packets"); mvwprintw(fields.fieldwin, 8, 3, "All IP"); mvwprintw(fields.fieldwin, 8, 16, "TCP"); mvwprintw(fields.fieldwin, 8, 26, "UDP"); mvwprintw(fields.fieldwin, 8, 35, "ICMP"); mvwprintw(fields.fieldwin, 8, 45, "IGMP"); mvwprintw(fields.fieldwin, 10, 5, "OSPF"); mvwprintw(fields.fieldwin, 10, 16, "IGP"); mvwprintw(fields.fieldwin, 10, 25, "IGRP"); mvwprintw(fields.fieldwin, 10, 36, "GRE"); mvwprintw(fields.fieldwin, 10, 45, "L2TP"); mvwprintw(fields.fieldwin, 12, 1, "IPSec AH"); mvwprintw(fields.fieldwin, 12, 13, "IPSec ESP"); mvwprintw(fields.fieldwin, 14, 1, "Additional protocols or ranges (e.g. 8, 18-20, 69, 90)"); mvwprintw(fields.fieldwin, 17, 11, "Match opposite (Y/N)"); tx_addfield(&fields, 25, 1, 0, init_saddr); tx_addfield(&fields, 25, 3, 0, init_smask); tx_addfield(&fields, 5, 5, 0, init_sport1); tx_addfield(&fields, 5, 5, 9, init_sport2); tx_addfield(&fields, 25, 1, 30, init_daddr); tx_addfield(&fields, 25, 3, 30, init_dmask); tx_addfield(&fields, 5, 5, 30, init_dport1); tx_addfield(&fields, 5, 5, 39, init_dport2); tx_addfield(&fields, 1, 8, 10, (data->filters[F_ALL_IP]) ? "Y" : ""); tx_addfield(&fields, 1, 8, 20, (data->filters[F_TCP]) ? "Y" : ""); tx_addfield(&fields, 1, 8, 30, (data->filters[F_UDP]) ? "Y" : ""); tx_addfield(&fields, 1, 8, 40, (data->filters[F_ICMP]) ? "Y" : ""); tx_addfield(&fields, 1, 8, 50, (data->filters[F_IGMP]) ? "Y" : ""); tx_addfield(&fields, 1, 10, 10, (data->filters[F_OSPF]) ? "Y" : ""); tx_addfield(&fields, 1, 10, 20, (data->filters[F_IGP]) ? "Y" : ""); tx_addfield(&fields, 1, 10, 30, (data->filters[F_IGRP]) ? "Y" : ""); tx_addfield(&fields, 1, 10, 40, (data->filters[F_GRE]) ? "Y" : ""); tx_addfield(&fields, 1, 10, 50, (data->filters[F_L2TP]) ? "Y" : ""); tx_addfield(&fields, 1, 12, 10, (data->filters[F_IPSEC_AH]) ? "Y" : ""); tx_addfield(&fields, 1, 12, 23, (data->filters[F_IPSEC_ESP]) ? "Y" : ""); cptr = skip_whitespace(data->protolist); tx_addfield(&fields, 54, 15, 1, cptr); tx_addfield(&fields, 1, 17, 1, initinex); tx_addfield(&fields, 1, 17, 32, initmatchop); do { tx_fillfields(&fields, aborted); /*get input */ if (!(*aborted)) { fieldptr = fields.list; /* * Adjust upper loop bound depending on the number of fields * before the "Additional IP protocols" field. */ for (i = 2; i <= 21; i++) fieldptr = fieldptr->nextfield; if (!validate_ranges (fieldptr->buf, &parse_result, &bptr)) { snprintf(msgstr, 60, "Invalid protocol input at or near token \"%s\"", bptr); tui_error(ANYKEY_MSG, msgstr); doagain = 1; } else doagain = 0; } else { doagain = 0; } } while (doagain); /* * Store entered filter data into data structures */ if (!(*aborted)) { fieldptr = fields.list; maskbits = 0; /* * Process Source Address field */ if (fieldptr->buf[0] == '\0') strcpy(data->s_fqdn, WILDCARD); else strcpy(data->s_fqdn, fieldptr->buf); if (strchr(data->s_fqdn, '/') != NULL) { cidr_split_address(data->s_fqdn, actual_address, &maskbits); strcpy(data->s_fqdn, actual_address); } /* * Process Source Mask field */ fieldptr = fieldptr->nextfield; if (fieldptr->buf[0] == '\0') { if (maskbits > 32) { strcpy(data->s_mask, WILDCARD); } else { strncpy(data->s_mask, cidr_get_quad_mask(maskbits), 20); } } else strcpy(data->s_mask, fieldptr->buf); /* * Process Source Port fields */ fieldptr = fieldptr->nextfield; data->sport1 = parse_port(fieldptr->buf); fieldptr = fieldptr->nextfield; data->sport2 = parse_port(fieldptr->buf); /* * Process Destination Address field */ fieldptr = fieldptr->nextfield; if (fieldptr->buf[0] == '\0') strcpy(data->d_fqdn, WILDCARD); else strcpy(data->d_fqdn, fieldptr->buf); maskbits = 0; if (strchr(data->d_fqdn, '/') != NULL) { cidr_split_address(data->d_fqdn, actual_address, &maskbits); strcpy(data->d_fqdn, actual_address); } /* * Process Destination mask field */ fieldptr = fieldptr->nextfield; if (fieldptr->buf[0] == '\0') { if (maskbits > 32) { strcpy(data->d_mask, WILDCARD); } else { strncpy(data->d_mask, cidr_get_quad_mask(maskbits), 20); } } else strcpy(data->d_mask, fieldptr->buf); /* * Process Dedination Port fields */ fieldptr = fieldptr->nextfield; data->dport1 = parse_port(fieldptr->buf); fieldptr = fieldptr->nextfield; data->dport2 = parse_port(fieldptr->buf); /* * Process IP protocol filter fields */ fieldptr = fieldptr->nextfield; memset(&(data->filters), 0, sizeof(data->filters)); if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_ALL_IP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_TCP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_UDP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_ICMP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_IGMP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_OSPF] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_IGP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_IGRP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_GRE] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_L2TP] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_IPSEC_AH] = 1; fieldptr = fieldptr->nextfield; if (toupper(fieldptr->buf[0]) == 'Y') data->filters[F_IPSEC_ESP] = 1; fieldptr = fieldptr->nextfield; /* * Parse protocol string */ cptr = fieldptr->buf; strncpy(data->protolist, cptr, 60); do { get_next_protorange(&cptr, &rangeproto1, &rangeproto2, &parse_result, &bptr); if (parse_result == RANGE_OK) { if (rangeproto2 != 0) { for (i = rangeproto1; i <= rangeproto2; i++) { data->filters[i] = 1; } } else { data->filters[rangeproto1] = 1; } } } while (parse_result == RANGE_OK); data->reverse = toupper(fieldptr->nextfield->buf[0]); if (data->reverse != 'E') data->reverse = 'I'; data->match_opposite = toupper(fieldptr->nextfield->nextfield->buf[0]); if (data->match_opposite != 'Y') data->match_opposite = 'N'; } tx_destroyfields(&fields); del_panel(dlgpanel); delwin(dlgwin); update_panels(); doupdate(); } void ipfilterselect(int *aborted) { struct MENU menu; int row = 1; struct filterfileent fflist; makestdfiltermenu(&menu); do { tx_showmenu(&menu); tx_operatemenu(&menu, &row, aborted); switch (row) { case 1: definefilter(aborted); break; case 2: selectfilter(&fflist, aborted); if (!(*aborted)) { memset(ofilter.filename, 0, FLT_FILENAME_MAX); strncpy(ofilter.filename, get_path(T_WORKDIR, fflist.filename), FLT_FILENAME_MAX - 1); if (!loadfilter(ofilter.filename, &ofilter.fl, FLT_RESOLVE)) ofilter.filtercode = 1; else ofilter.filtercode = 0; } break; case 3: destroyfilter(&ofilter.fl); ofilter.filtercode = 0; tx_infobox("IP filter deactivated", ANYKEY_MSG); break; case 4: editfilter(aborted); break; case 5: delfilter(aborted); if (!(*aborted)) tx_infobox("IP filter deleted", ANYKEY_MSG); } } while (row != 7); tx_destroymenu(&menu); update_panels(); doupdate(); } static int addr_in_net(unsigned long addr, unsigned long net, unsigned long mask) { return (addr & mask) == (net & mask); } static int port_in_range(in_port_t port, in_port_t port1, in_port_t port2) { if (port2 == 0) return port == port1 || port1 == 0; else return port >= port1 && port <= port2; } /* Display/logging filter for other (non-TCP, non-UDP) IP protocols. */ int ipfilter(unsigned long saddr, unsigned long daddr, in_port_t sport, in_port_t dport, unsigned int protocol, int match_opp_mode) { struct filterent *fe; int result = 0; int fltexpr1; int fltexpr2; for (fe = ofilter.fl.head; fe != NULL; fe = fe->next_entry) { if (protocol == IPPROTO_TCP || protocol == IPPROTO_UDP) { fltexpr1 = addr_in_net(saddr, fe->saddr, fe->smask) && addr_in_net(daddr, fe->daddr, fe->dmask) && port_in_range(sport, fe->hp.sport1, fe->hp.sport2) && port_in_range(dport, fe->hp.dport1, fe->hp.dport2); if ((protocol == IPPROTO_TCP && match_opp_mode == MATCH_OPPOSITE_ALWAYS) || (fe->hp.match_opposite == 'Y')) fltexpr2 = addr_in_net(saddr, fe->daddr, fe->dmask) && addr_in_net(daddr, fe->saddr, fe->smask) && port_in_range(sport, fe->hp.dport1, fe->hp.dport2) && port_in_range(dport, fe->hp.sport1, fe->hp.sport2); else fltexpr2 = 0; } else { fltexpr1 = addr_in_net(saddr, fe->saddr, fe->smask) && addr_in_net(daddr, fe->daddr, fe->dmask); if (fe->hp.match_opposite == 'Y') { fltexpr2 = addr_in_net(saddr, fe->daddr, fe->dmask) && addr_in_net(daddr, fe->saddr, fe->smask); } else fltexpr2 = 0; } if (fltexpr1 || fltexpr2) { result = fe->hp.filters[protocol] || fe->hp.filters[F_ALL_IP]; if (result) { if (toupper(fe->hp.reverse) == 'E') { return 0; } return 1; } } } return 0; } iptraf-ng-1.1.4/src/ipfilter.h0000664000076400007640000000101612173477703016455 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_IPFILTER_H #define IPTRAF_NG_IPFILTER_H void gethostparams(struct hostparams *data, char *init_saddr, char *init_smask, char *init_sport1, char *init_sport2, char *init_daddr, char *init_dmask, char *init_dport1, char *init_dport2, char *initinex, char *initmatchop, int *aborted); void ipfilterselect(int *faborted); int ipfilter(unsigned long saddr, unsigned long daddr, in_port_t sport, in_port_t dport, unsigned int protocol, int match_opp_mode); #endif /* IPTRAF_NG_IPFILTER_H */ iptraf-ng-1.1.4/src/ipfrag.c0000664000076400007640000001363712173477703016116 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** ipfrag.c - module that handles fragmented IP packets. This module is necessary to maintain accurate counts in case fragmented IP packets are received. TCP and UDP headers are not copied in fragments. This module is based on RFC 815, but does not really reassemble packets. The routines here merely accumulate packet sizes and pass them off to the IP traffic monitor routine. ***/ #include "iptraf-ng-compat.h" #include "ipfrag.h" static struct fragent *fraglist = NULL; static struct fragent *fragtail = NULL; static struct fragent *addnewdgram(struct iphdr *packet) { struct fragent *ptmp; ptmp = xmallocz(sizeof(struct fragent)); if (fraglist == NULL) { fraglist = ptmp; ptmp->prev_entry = NULL; } if (fragtail != NULL) { fragtail->next_entry = ptmp; ptmp->prev_entry = fragtail; } ptmp->fragdesclist = xmalloc(sizeof(struct fragdescent)); ptmp->fragdesclist->min = 0; ptmp->fragdesclist->max = 65535; ptmp->fragdesclist->next_entry = NULL; ptmp->fragdesclist->prev_entry = NULL; ptmp->fragdesctail = ptmp->fragdesclist; fragtail = ptmp; ptmp->next_entry = NULL; ptmp->s_addr = packet->saddr; ptmp->d_addr = packet->daddr; ptmp->protocol = packet->protocol; ptmp->id = packet->id; return ptmp; } static struct fragdescent *addnewhole(struct fragent *frag) { struct fragdescent *ptmp; ptmp = xmalloc(sizeof(struct fragdescent)); if (frag->fragdesclist == NULL) { frag->fragdesclist = ptmp; ptmp->prev_entry = NULL; } if (frag->fragdesctail != NULL) { frag->fragdesctail->next_entry = ptmp; ptmp->prev_entry = frag->fragdesctail; } ptmp->next_entry = NULL; frag->fragdesctail = ptmp; return ptmp; } static struct fragent *searchfrags(unsigned long saddr, unsigned long daddr, unsigned int protocol, unsigned int id) { struct fragent *ftmp = fraglist; while (ftmp != NULL) { if ((saddr == ftmp->s_addr) && (daddr == ftmp->d_addr) && (protocol == ftmp->protocol) && (id == ftmp->id)) return ftmp; ftmp = ftmp->next_entry; } return NULL; } static void deldgram(struct fragent *ftmp) { if (ftmp->prev_entry != NULL) ftmp->prev_entry->next_entry = ftmp->next_entry; else fraglist = ftmp->next_entry; if (ftmp->next_entry != NULL) ftmp->next_entry->prev_entry = ftmp->prev_entry; else fragtail = ftmp->prev_entry; free(ftmp); } /* * Destroy hole descriptor list */ static void destroyholes(struct fragent *ftmp) { struct fragdescent *dtmp = ftmp->fragdesclist; struct fragdescent *ntmp = NULL; if (ftmp->fragdesclist != NULL) { ntmp = dtmp->next_entry; while (dtmp != NULL) { free(dtmp); dtmp = ntmp; if (ntmp != NULL) ntmp = ntmp->next_entry; } } } void destroyfraglist(void) { struct fragent *ptmp = fraglist; struct fragent *ctmp = NULL; if (fraglist != NULL) { ctmp = ptmp->next_entry; while (ptmp != NULL) { destroyholes(ptmp); free(ptmp); ptmp = ctmp; if (ctmp != NULL) ctmp = ctmp->next_entry; } } fraglist = NULL; fragtail = NULL; } /* * Process IP fragment. Returns number of bytes to report to the traffic * monitor or 0 for an error condition. */ unsigned int processfragment(struct iphdr *packet, in_port_t *sport, in_port_t *dport, int *firstin) { struct fragent *ftmp; struct fragdescent *dtmp; struct fragdescent *ntmp; char *tpacket; unsigned int offset; unsigned int lastbyte; unsigned int retval; /* Determine appropriate hole descriptor list */ ftmp = searchfrags(packet->saddr, packet->daddr, packet->protocol, packet->id); if (ftmp == NULL) /* No such datagram for this frag yet */ ftmp = addnewdgram(packet); if (ftmp == NULL) return 0; /* * At this point, ftmp should contain the address of the appropriate * descriptor list. */ dtmp = ftmp->fragdesclist; /* Point to hole descriptors */ offset = (ntohs(packet->frag_off) & 0x1fff) * 8; lastbyte = (offset + (ntohs(packet->tot_len) - (packet->ihl) * 4)) - 1; if ((ntohs(packet->frag_off) & 0x1fff) == 0) { /* first fragment? */ ftmp->firstin = 1; tpacket = ((char *) (packet)) + (packet->ihl * 4); if (packet->protocol == IPPROTO_TCP) { ftmp->s_port = ntohs(((struct tcphdr *) tpacket)->source); ftmp->d_port = ntohs(((struct tcphdr *) tpacket)->dest); } else if (packet->protocol == IPPROTO_UDP) { ftmp->s_port = ntohs(((struct udphdr *) tpacket)->source); ftmp->d_port = ntohs(((struct udphdr *) tpacket)->dest); } } while (dtmp != NULL) { if ((offset <= dtmp->max) && (lastbyte >= dtmp->min)) break; dtmp = dtmp->next_entry; } if (dtmp != NULL) { /* Duplicate/overlap or something out of the loopback interface */ /* * Delete current entry from hole descriptor list */ if (dtmp->prev_entry != NULL) dtmp->prev_entry->next_entry = dtmp->next_entry; else ftmp->fragdesclist = dtmp->next_entry; if (dtmp->next_entry != NULL) dtmp->next_entry->prev_entry = dtmp->prev_entry; else ftmp->fragdesctail = dtmp->prev_entry; /* * Memory for the hole descriptor will not be released yet. */ if (offset > dtmp->min) { /* * If offset in fragment is greater than offset in the descriptor, * create a new hole descriptor. */ ntmp = addnewhole(ftmp); ntmp->min = dtmp->min; ntmp->max = offset - 1; } if ((lastbyte < dtmp->max) && (ntohs(packet->frag_off) & 0x2000)) { /* * If last byte in fragment is less than the last byte of the * hole descriptor, and more fragments, create a new hole * descriptor. */ ntmp = addnewhole(ftmp); ntmp->min = lastbyte + 1; ntmp->max = dtmp->max; } free(dtmp); } *firstin = ftmp->firstin; ftmp->bcount += ntohs(packet->tot_len); if (ftmp->firstin) { *sport = ftmp->s_port; *dport = ftmp->d_port; retval = ftmp->bcount; ftmp->bcount = 0; if (ftmp->fragdesclist == NULL) deldgram(ftmp); return retval; } else return 0; } iptraf-ng-1.1.4/src/ipfrag.h0000664000076400007640000000147612173477703016121 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_IPFRAG_H #define IPTRAF_NG_IPFRAG_H /*** ipfrag.h - IP fragmentation hander definitions ***/ struct fragdescent { unsigned int min; unsigned int max; struct fragdescent *prev_entry; struct fragdescent *next_entry; }; struct fragent { unsigned long s_addr; in_port_t s_port; unsigned long d_addr; in_port_t d_port; unsigned int id; unsigned int protocol; int firstin; time_t starttime; struct fragdescent *fragdesclist; struct fragdescent *fragdesctail; unsigned int bcount; struct fragent *prev_entry; struct fragent *next_entry; }; struct fragfreelistent { struct fragent *top; struct fragfreelist *next_entry; }; void destroyfraglist(void); unsigned int processfragment(struct iphdr *packet, in_port_t *sport, in_port_t *dport, int *firstin); #endif /* IPTRAF_NG_IPFRAG_H */ iptraf-ng-1.1.4/src/iptraf-ng-compat.h0000664000076400007640000000704712173477703020021 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_COMPAT_H #define IPTRAF_NG_COMPAT_H #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef ETH_P_8021AD #define ETH_P_8021AD 0x88A8 /* 802.1ad Service VLAN */ #endif #ifndef ETH_P_QINQ1 #define ETH_P_QINQ1 0x9100 /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */ #endif #ifndef ETH_P_QINQ2 #define ETH_P_QINQ2 0x9200 /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */ #endif #ifndef ETH_P_QINQ3 #define ETH_P_QINQ3 0x9300 /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */ #endif #define debug(...) \ do { \ fprintf(stderr, "%s:%s():%d:", \ __FILE__, __func__, __LINE__); \ fprintf(stderr, __VA_ARGS__); \ fprintf(stderr, "\n"); \ } while(0) #define KBITS 0 #define dispmode(mode) \ (((mode) == KBITS) ? "kbps": "kBps") #define __noreturn __attribute__((noreturn)) #define __unused __attribute__((unused)) #define __printf(x, y) __attribute__((format(printf, (x), (y)))) /* screen delay (in msecs) if update rate == 0 */ #define DEFAULT_UPDATE_DELAY 50 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) #define alloc_nr(x) (((x)+16)*3/2) /* * Realloc the buffer pointed at by variable 'x' so that it can hold * at least 'nr' entries; the number of entries currently allocated * is 'alloc', using the standard growing factor alloc_nr() macro. * * DO NOT USE any expression with side-effect for 'x', 'nr', or 'alloc'. */ #define ALLOC_GROW(x, nr, alloc) \ do { \ if ((nr) > alloc) { \ if (alloc_nr(alloc) < (nr)) \ alloc = (nr); \ else \ alloc = alloc_nr(alloc); \ x = xrealloc((x), alloc * sizeof(*(x))); \ } \ } while (0) extern int daemonized; extern int exitloop; extern void *xmalloc(size_t size); extern void *xcalloc(size_t nmemb, size_t size); extern void *xrealloc(void *ptr, size_t size); extern void *xmallocz(size_t size); extern char *xstrdup(const char *s); extern int strtoul_ui(char const *s, int base, unsigned int *result); extern int strtol_i(char const *s, int base, int *result); extern void die(const char *err, ...) __noreturn __printf(1,2); extern void die_errno(const char *fmt, ...) __noreturn __printf(1,2); extern void error(const char *err, ...) __printf(1,2); static inline char *skip_whitespace(char *str) { while (isspace(*str)) ++str; return str; } static inline unsigned long timeval_diff_msec(const struct timeval *end, const struct timeval *start) { if (!start || !end) return 0UL; signed long secs = end->tv_sec - start->tv_sec; signed long usecs = end->tv_usec - start->tv_usec; if(usecs < 0) { usecs = 1000000 - usecs; secs -= 1; } if(secs >= 0) return secs * 1000UL + usecs / 1000UL; else return 0UL; } #endif /* IPTRAF_NG_COMPAT_H */ iptraf-ng-1.1.4/src/iptraf-ng.80000664000076400007640000000620512173477703016453 0ustar npajkovsnpajkovs.TH IPTRAF 8 "IPTraf Help Page" .SH NAME iptraf \- Interactive Colorful IP LAN Monitor .SH SYNOPSIS .BR iptraf " { [ " \-f " ] [ " \-q " ] [ " \-u " ] [ { " \-i .IR iface " | " .BR \-g " | " \-d .IR iface " | " .BR \-s .IR iface " | " .BR \-z .IR iface " | " .BR \-l .IR iface " } [ " .BR \-t .IR timeout " ] [ " .BR \-B " [ " .BR \-L .IR logfile " ] ] ] | [ " .BR \-h " ] }" .br .SH DESCRIPTION .B iptraf is an ncurses-based IP LAN monitor that generates various network statistics including TCP info, UDP counts, ICMP and OSPF information, Ethernet load info, node stats, IP checksum errors, and others. .PP If the .B iptraf command is issued without any command-line options, the program comes up in interactive mode, with the various facilities accessed through the main menu. .SH OPTIONS These options can also be supplied to the command: .TP .BI "\-i " iface immediately start the IP traffic monitor on the specified interface, or all interfaces if "\-i all" is specified .TP .B "\-g" immediately start the general interface statistics .TP .BI "\-d " iface allows you to immediately start the detailed on the indicated interface (iface) .TP .BI "\-s " iface allows you to immediately monitor TCP and UDP traffic on the specified interface (iface) .TP .BI "\-z " iface shows packet counts by size on the specified interface .TP .BI "\-l " iface start the LAN station monitor on the specified interface, or all LAN interfaces if "\-l all" is specified .TP .BI "\-t " timeout tells IPTraf to run the specified facility for only .I timeout minutes. This option is used only with one of the above parameters. .TP .B "\-B" redirect standard output to /dev/null, closes standard input, and forks the program into the background. Can be used only with one of the facility invocation parameters above. Send the backgrounded process a USR2 signal to terminate. .TP .B "\-L logfile" allows you to specify an alternate log file name. The default log file name is based on either the interface selected (detailed interface statistics, TCP/UDP service statistics, packet size breakdown), or the instance of the facility (IP traffic monitor, LAN station monitor). If a path is not specified, the log file is placed in .B /var/log/iptraf .TP .B "\-f" clears all locks and counters, causing this instance of IPTraf to think it's the first one running. This should only be used to recover from an abnormal termination or system crash. .TP .B "\-u" allow use of unsupported interfaces as ethernet devices. This is needed if you changed the name of an interface (ex: ip link set eth0 name foo0) .TP .BI "\-q" no longer needed, maintained only for compatibility. .TP .B "\-h" shows a command summary .SH SIGNALS SIGUSR1 - rotates log files while program is running SIGUSR2 - terminates an IPTraf process running in the background. .SH FILES /var/log/iptraf/*.log - log file /var/lib/iptraf/* - important IPTraf data files .SH SEE ALSO Documentation/* - complete documentation written by the author .br .SH AUTHOR Gerard Paul Java (riker@mozcom.com) .SH MANUAL AUTHOR Frederic Peters (fpeters@debian.org), using iptraf \-h General manual page modifications by Gerard Paul Java (riker@mozcom.com) iptraf-ng-1.1.4/src/iptraf.c0000664000076400007640000003017512173477703016127 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /* IPTraf An IP Network Statistics Utility */ #include "iptraf-ng-compat.h" #include "built-in.h" #include "tui/menurt.h" #include "tui/winops.h" #include "dirs.h" #include "deskman.h" #include "fltdefs.h" #include "fltselect.h" #include "fltmgr.h" #include "fltedit.h" #include "serv.h" #include "options.h" #include "attrs.h" #include "rvnamed.h" #include "logvars.h" #include "detstats.h" #include "ifstats.h" #include "itrafmon.h" #include "pktsize.h" #include "hostmon.h" #include "parse-options.h" #define WITHALL 1 #define WITHOUTALL 0 #ifndef IPTRAF_PIDFILE #define IPTRAF_PIDFILE "/var/run/iptraf-ng.pid" #endif const char *ALLSPEC = "all"; #define CMD(name, h) { .cmd = #name, .fn = cmd_##name, .help = h } #define CMD_END() { NULL, NULL, NULL } struct cmd_struct { const char *cmd; int (*fn)(int, char **); const char *help; }; /* * Important globals used throughout the * program. */ int exitloop = 0; int daemonized = 0; int facility_running = 0; static void press_enter_to_continue(void) { fprintf(stderr, "Press Enter to continue.\n"); getchar(); } static void clearfiles(char *prefix, char *directory) { DIR *dir; struct dirent *dir_entry; char target_name[80]; dir = opendir(directory); if (dir == NULL) { fprintf(stderr, "\nUnable to read directory %s\n%s\n", directory, strerror(errno)); press_enter_to_continue(); return; } do { dir_entry = readdir(dir); if (dir_entry != NULL) { if (strncmp(dir_entry->d_name, prefix, strlen(prefix)) == 0) { snprintf(target_name, 80, "%s/%s", directory, dir_entry->d_name); unlink(target_name); } } } while (dir_entry != NULL); closedir(dir); } static void removetags(void) { clearfiles("iptraf", LOCKDIR); } static void remove_sockets(void) { clearfiles(SOCKET_PREFIX, WORKDIR); } /* * USR2 handler. Used to normally exit a daemonized facility. */ static void term_usr2_handler(int s __unused) { exitloop = 1; } static void init_break_menu(struct MENU *break_menu) { tx_initmenu(break_menu, 6, 20, (LINES - 6) / 2, COLS / 2, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(break_menu, " By packet ^s^ize", "Displays packet counts by packet size range"); tx_additem(break_menu, " By TCP/UDP ^p^ort", "Displays packet and byte counts by service port"); tx_additem(break_menu, NULL, NULL); tx_additem(break_menu, " E^x^it menu", "Return to main menu"); } /* * Get the ball rolling: The program interface routine. */ static void program_interface(void) { struct MENU menu; struct MENU break_menu; int endloop = 0; int row = 1; int break_row = 1; int aborted; int break_aborted; char ifname[IFNAMSIZ]; char *ifptr = NULL; /* * Load saved filter */ loadfilters(); indicate(""); tx_initmenu(&menu, 15, 35, (LINES - 16) / 2, (COLS - 35) / 2, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(&menu, " IP traffic ^m^onitor", "Displays current IP traffic information"); tx_additem(&menu, " General interface ^s^tatistics", "Displays some statistics for attached interfaces"); tx_additem(&menu, " ^D^etailed interface statistics", "Displays more statistics for a selected interface"); tx_additem(&menu, " Statistical ^b^reakdowns...", "Facilities for traffic counts by packet size or TCP/UDP port"); tx_additem(&menu, " ^L^AN station monitor", "Displays statistics on detected LAN stations"); tx_additem(&menu, NULL, NULL); tx_additem(&menu, " ^F^ilters...", "Allows you to select traffic display and logging criteria"); tx_additem(&menu, NULL, NULL); tx_additem(&menu, " C^o^nfigure...", "Set various program options"); tx_additem(&menu, NULL, NULL); tx_additem(&menu, " ^A^bout...", "Displays program info"); tx_additem(&menu, NULL, NULL); tx_additem(&menu, " E^x^it", "Exits program"); endloop = 0; do { tx_showmenu(&menu); tx_operatemenu(&menu, &row, &aborted); switch (row) { case 1: selectiface(ifname, WITHALL, &aborted); if (!aborted) { if (strcmp(ifname, "") != 0) ifptr = ifname; else ifptr = NULL; ipmon(0, ifptr); } break; case 2: ifstats(0); break; case 3: selectiface(ifname, WITHOUTALL, &aborted); if (!aborted) detstats(ifname, 0); break; case 4: break_row = 1; init_break_menu(&break_menu); tx_showmenu(&break_menu); tx_operatemenu(&break_menu, &break_row, &break_aborted); switch (break_row) { case 1: selectiface(ifname, WITHOUTALL, &aborted); if (!aborted) packet_size_breakdown(ifname, 0); break; case 2: selectiface(ifname, WITHOUTALL, &aborted); if (!aborted) servmon(ifname, 0); break; case 4: break; } tx_destroymenu(&break_menu); break; case 5: selectiface(ifname, WITHALL, &aborted); if (!aborted) { if (strcmp(ifname, "") != 0) ifptr = ifname; else ifptr = NULL; hostmon(0, ifptr); } break; case 7: config_filters(); savefilters(); break; case 9: setoptions(); saveoptions(); break; case 11: about(); break; case 13: endloop = 1; break; } } while (!endloop); tx_destroymenu(&menu); } static const char *const iptraf_ng_usage[] = { IPTRAF_NAME " [options]", IPTRAF_NAME " [options] -B [-i | -d | -s | -z | -l | -g]", NULL }; static int help_opt, f_opt, g_opt, facilitytime, B_opt; static char *i_opt, *d_opt, *s_opt, *z_opt, *l_opt, *L_opt; static struct options iptraf_ng_options[] = { OPT__HELP(&help_opt), OPT_GROUP(""), OPT_STRING('i', NULL, &i_opt, "iface", "start the IP traffic monitor (use '-i all' for all interfaces)"), OPT_STRING('d', NULL, &d_opt, "iface", "start the detailed statistics facility on an interface"), OPT_STRING('s', NULL, &s_opt, "iface", "start the TCP and UDP monitor on an interface"), OPT_STRING('z', NULL, &z_opt, "iface", "shows the packet size counts on an interface"), OPT_STRING('l', NULL, &l_opt, "iface", "start the LAN station monitor (use '-l all' for all LAN interfaces)"), OPT_BOOL('g', NULL, &g_opt, "start the general interface statistics"), OPT_GROUP(""), OPT_BOOL('B', NULL, &B_opt, "run in background (use only with one of the above parameters"), OPT_BOOL('f', NULL, &f_opt, "clear all locks and counters" /*. Use with great caution. Normally used to recover from an abnormal termination */ ), OPT_INTEGER('t', NULL, &facilitytime, "run only for the specified number of minutes"), OPT_STRING('L', NULL, &L_opt, "logfile", "specifies an alternate log file"), // OPT_INTEGER('I', NULL, &I_opt, "the log interval for all facilities except the IP traffic monitor. Value is in minutes"), OPT_END() }; static int create_pidfile(void) { int fd = open(IPTRAF_PIDFILE, O_WRONLY|O_CREAT, 0644); if (fd < 0) { perror("can not open "IPTRAF_PIDFILE); return -1; } if (lockf(fd, F_TLOCK, 0) < 0) { error("The PID file is locked "IPTRAF_PIDFILE". " "Maybe other iptraf-ng instance is running?can not acquire "); return -1; } fcntl(fd, F_SETFD, FD_CLOEXEC); char buf[sizeof(long) * 3 + 2]; int len = sprintf(buf, "%lu\n", (long) getpid()); write(fd, buf, len); ftruncate(fd, len); /* we leak opened+locked fd intentionally */ return 0; } static void sanitize_dir(const char *dir) { /* Check whether LOCKDIR exists (/var/run is on a tmpfs in Ubuntu) */ if (access(dir, F_OK) != 0) { if (mkdir(dir, 0700) == -1) die("Cannot create %s: %s", dir, strerror(errno)); if (chown(dir, 0, 0) == -1) die("Cannot change owner of %s: %s", dir, strerror(errno)); } } static void handle_internal_command(int argc, char **argv, const struct cmd_struct *commands) { const char *cmd = argv[0]; for (const struct cmd_struct *p = commands; p->cmd; ++p) { if (!strcmp(p->cmd, cmd)) exit(p->fn(argc, argv)); } } int main(int argc, char **argv) { int current_log_interval = 0; if (geteuid() != 0) die("This program can be run only by the system administrator"); const struct cmd_struct commands[] = { CMD(capture, "capture packet"), CMD_END(), }; /* stupid, but for now needed machinery with argc, args * */ char **internal_argv = argv; argc--; internal_argv++; if (argc > 0) handle_internal_command(argc, internal_argv, commands); argc++; /* * Parse command line */ parse_opts(argc, argv, iptraf_ng_options, iptraf_ng_usage); if (help_opt) parse_usage_and_die(iptraf_ng_usage, iptraf_ng_options); int command = 0; command |= (i_opt) ? (1 << 0) : 0; command |= (d_opt) ? (1 << 1) : 0; command |= (s_opt) ? (1 << 2) : 0; command |= (z_opt) ? (1 << 3) : 0; command |= (l_opt) ? (1 << 4) : 0; command |= (g_opt) ? (1 << 5) : 0; if (__builtin_popcount(command) > 1) die("only one of -i|-d|-s|-z|-l|-g options must be used"); strcpy(current_logfile, ""); if (f_opt) { removetags(); remove_sockets(); } if (B_opt) { if (!command) die("one of -i|-d|-s|-z|-l|-g option is missing\n"); daemonized = 1; setenv("TERM", "linux", 1); } if (L_opt) { if (strchr(L_opt, '/') != NULL) strncpy(current_logfile, L_opt, 80); else strncpy(current_logfile, get_path(T_LOGDIR, L_opt), 80); } #if 0 /* this could never work */ /* origin } else if (opt == 'I') { //this could never work current_log_interval = atoi(optarg); if (current_log_interval == 0) fprintf(stderr, "Invalid log interval value\n"); exit(1); } else if (opt == 'G') { */ if (I_opt == 0) { fprintf(stderr, "fatal: Invalid log interval value\n"); exit(1); } else current_log_interval = I_opt; #endif if ((getenv("TERM") == NULL) && (!daemonized)) die("Your TERM variable is not set.\n" "Please set it to an appropriate value"); loadoptions(); if (create_pidfile() < 0) goto cleanup; int pidfile_created = 1; /* * If a facility is directly invoked from the command line, check for * a daemonization request */ if (daemonized && command) { switch (fork()) { case 0: /* child */ setsid(); freopen("/dev/null", "w", stdout); /* redirect std output */ freopen("/dev/null", "r", stdin); /* redirect std input */ freopen("/dev/null", "w", stderr); /* redirect std error */ signal(SIGUSR2, term_usr2_handler); options.logging = 1; break; case -1: /* error */ error("Fork error, %s cannot run in background", IPTRAF_NAME); goto cleanup; default: /* parent */ goto cleanup; } } sanitize_dir(LOCKDIR); sanitize_dir(WORKDIR); initscr(); if ((LINES < 24) || (COLS < 80)) { endwin(); die("This program requires a screen size of at least 80 columns by 24 lines\n" "Please resize your window"); } signal(SIGTSTP, SIG_IGN); signal(SIGINT, SIG_IGN); signal(SIGUSR1, SIG_IGN); start_color(); standardcolors(options.color); noecho(); nonl(); cbreak(); curs_set(0); /* * Set logfilename variable to NULL if -L was specified without an * appropriate facility on the command line. */ if (command == 0) strcpy(current_logfile, ""); /* * If by this time the logfile is still acceptable, obtain the * logspan from the command line if so specified. */ if (current_logfile[0] != '\0') { options.logging = 1; if (current_log_interval != 0) { options.logspan = current_log_interval; } } /* * Load saved filter */ loadfilters(); indicate(""); /* bad, bad, bad name draw_desktop() * hide all into tui_top_panel(char *msg) * */ draw_desktop(); attrset(STATUSBARATTR); mvprintw(0, 1, "%s %s", IPTRAF_NAME, IPTRAF_VERSION); /* simplify */ if (g_opt) ifstats(facilitytime); else if (i_opt) if (strcmp(i_opt, "all") == 0) ipmon(facilitytime, NULL); else ipmon(facilitytime, i_opt); else if (l_opt) if (strcmp(l_opt, "all") == 0) hostmon(facilitytime, NULL); else hostmon(facilitytime, l_opt); else if (d_opt) detstats(d_opt, facilitytime); else if (s_opt) servmon(s_opt, facilitytime); else if (z_opt) packet_size_breakdown(z_opt, facilitytime); else program_interface(); erase(); update_panels(); doupdate(); endwin(); cleanup: if (pidfile_created) unlink(IPTRAF_PIDFILE); return 0; } iptraf-ng-1.1.4/src/itrafmon.c0000664000076400007640000006630312173477703016463 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** itrafmon.c - the IP traffic monitor module ***/ #include "iptraf-ng-compat.h" #include "tui/labels.h" #include "tui/winops.h" #include "options.h" #include "tcptable.h" #include "othptab.h" #include "fltdefs.h" #include "packet.h" #include "ifaces.h" #include "promisc.h" #include "deskman.h" #include "error.h" #include "attrs.h" #include "log.h" #include "revname.h" #include "rvnamed.h" #include "dirs.h" #include "timer.h" #include "ipfrag.h" #include "logvars.h" #include "itrafmon.h" #include "sockaddr.h" #define SCROLLUP 0 #define SCROLLDOWN 1 static void rotate_ipmon_log(int s __unused) { rotate_flag = 1; strcpy(target_logname, current_logfile); signal(SIGUSR1, rotate_ipmon_log); } /* Hot key indicators for the bottom line */ static void ipmonhelp(void) { move(LINES - 1, 1); tx_printkeyhelp("Up/Dn/PgUp/PgDn", "-scroll ", stdscr, HIGHATTR, STATUSBARATTR); move(LINES - 1, 43); tx_printkeyhelp("W", "-chg actv win ", stdscr, HIGHATTR, STATUSBARATTR); tx_printkeyhelp("S", "-sort TCP ", stdscr, HIGHATTR, STATUSBARATTR); stdexitkeyhelp(); } static void uniq_help(int what) { move(LINES - 1, 25); if (!what) tx_printkeyhelp("M", "-more TCP info ", stdscr, HIGHATTR, STATUSBARATTR); else tx_printkeyhelp("Lft/Rt", "-vtcl scrl ", stdscr, HIGHATTR, STATUSBARATTR); } /* Mark general packet count indicators */ static void prepare_statwin(WINDOW * win) { wattrset(win, IPSTATLABELATTR); wmove(win, 0, 1); wprintw(win, "Packets captured:"); mvwaddch(win, 0, 45 * COLS / 80, ACS_VLINE); } static void markactive(int curwin, WINDOW * tw, WINDOW * ow) { WINDOW *win1; WINDOW *win2; int x1 __unused, y1, x2 __unused, y2; if (!curwin) { win1 = tw; win2 = ow; } else { win1 = ow; win2 = tw; } getmaxyx(win1, y1, x1); getmaxyx(win2, y2, x2); wmove(win1, --y1, COLS - 10); wattrset(win1, ACTIVEATTR); wprintw(win1, " Active "); wattrset(win1, BOXATTR); wmove(win2, --y2, COLS - 10); whline(win2, ACS_HLINE, 8); } static void show_stats(WINDOW * win, unsigned long long total) { wattrset(win, IPSTATATTR); wmove(win, 0, 35 * COLS / 80); printlargenum(total, win); } /* * Scrolling and paging routines for the upper (TCP) window */ static void scrollupperwin(struct tcptable *table, int direction, unsigned long *idx, int mode) { char sp_buf[10]; sprintf(sp_buf, "%%%dc", COLS - 2); wattrset(table->tcpscreen, STDATTR); if (direction == SCROLLUP) { if (table->lastvisible != table->tail) { wscrl(table->tcpscreen, 1); table->lastvisible = table->lastvisible->next_entry; table->firstvisible = table->firstvisible->next_entry; (*idx)++; wmove(table->tcpscreen, table->imaxy - 1, 0); scrollok(table->tcpscreen, 0); wprintw(table->tcpscreen, sp_buf, ' '); scrollok(table->tcpscreen, 1); printentry(table, table->lastvisible, *idx, mode); } } else { if (table->firstvisible != table->head) { wscrl(table->tcpscreen, -1); table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; (*idx)--; wmove(table->tcpscreen, 0, 0); wprintw(table->tcpscreen, sp_buf, ' '); printentry(table, table->firstvisible, *idx, mode); } } } static void pageupperwin(struct tcptable *table, int direction, unsigned long *idx) { unsigned int i = 1; wattrset(table->tcpscreen, STDATTR); if (direction == SCROLLUP) { while ((i <= table->imaxy - 3) && (table->lastvisible != table->tail)) { i++; table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->lastvisible->next_entry; (*idx)++; } } else { while ((i <= table->imaxy - 3) && (table->firstvisible != table->head)) { i++; table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; (*idx)--; } } } /* * Scrolling and paging routines for the lower (non-TCP) window. */ static void scrolllowerwin(struct othptable *table, int direction) { if (direction == SCROLLUP) { if (table->lastvisible != table->tail) { wscrl(table->othpwin, 1); table->lastvisible = table->lastvisible->next_entry; table->firstvisible = table->firstvisible->next_entry; if (table->htstat == HIND) { /* Head indicator on? */ wmove(table->borderwin, table->obmaxy - 1, 1); whline(table->borderwin, ACS_HLINE, 8); table->htstat = NOHTIND; } printothpentry(table, table->lastvisible, table->oimaxy - 1, 0, NULL); } } else { if (table->firstvisible != table->head) { wscrl(table->othpwin, -1); table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; if (table->htstat == TIND) { /* Tail indicator on? */ wmove(table->borderwin, table->obmaxy - 1, 1); whline(table->borderwin, ACS_HLINE, 8); table->htstat = NOHTIND; } printothpentry(table, table->firstvisible, 0, 0, NULL); } } } static void pagelowerwin(struct othptable *table, int direction) { unsigned int i = 1; if (direction == SCROLLUP) { while ((i <= table->oimaxy - 2) && (table->lastvisible != table->tail)) { i++; table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->lastvisible->next_entry; if (table->htstat == HIND) { /* Head indicator on? */ wmove(table->borderwin, table->obmaxy - 1, 1); whline(table->borderwin, ACS_HLINE, 8); table->htstat = NOHTIND; } } } else { while ((i <= table->oimaxy - 2) && (table->firstvisible != table->head)) { i++; table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; if (table->htstat == TIND) { /* Tail indicator on? */ wmove(table->borderwin, table->obmaxy - 1, 1); whline(table->borderwin, ACS_HLINE, 8); table->htstat = NOHTIND; } } } } /* * Pop up sorting key window */ static void show_tcpsort_win(WINDOW ** win, PANEL ** panel) { *win = newwin(9, 35, (LINES - 8) / 2, COLS - 40); *panel = new_panel(*win); wattrset(*win, DLGBOXATTR); tx_colorwin(*win); tx_box(*win, ACS_VLINE, ACS_HLINE); wattrset(*win, DLGTEXTATTR); mvwprintw(*win, 2, 2, "Select sort criterion"); wmove(*win, 4, 2); tx_printkeyhelp("P", " - sort by packet count", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 5, 2); tx_printkeyhelp("B", " - sort by byte count", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 6, 2); tx_printkeyhelp("Any other key", " - cancel sort", *win, DLGHIGHATTR, DLGTEXTATTR); update_panels(); doupdate(); } /* * Routine to swap two TCP entries. p1 and p2 are pointers to TCP entries, * but p1 must be ahead of p2. It's a linked list thing. */ static void swap_tcp_entries(struct tcptable *table, struct tcptableent *p1, struct tcptableent *p2) { struct tcptableent *p2nextsaved; struct tcptableent *p1prevsaved; unsigned int tmp; if (p1 == p2) return; tmp = p1->index; p1->index = p2->index; p2->index = tmp; p1->next_entry->index = p1->index + 1; p2->next_entry->index = p2->index + 1; if (p1->prev_entry != NULL) p1->prev_entry->next_entry = p2; else table->head = p2; if (p2->next_entry->next_entry != NULL) p2->next_entry->next_entry->prev_entry = p1->next_entry; else table->tail = p1->next_entry; p2nextsaved = p2->next_entry->next_entry; p1prevsaved = p1->prev_entry; if (p1->next_entry->next_entry == p2) { /* swapping adjacent entries */ p2->next_entry->next_entry = p1; p1->prev_entry = p2->next_entry; } else { p2->next_entry->next_entry = p1->next_entry->next_entry; p1->prev_entry = p2->prev_entry; p2->prev_entry->next_entry = p1; p1->next_entry->next_entry->prev_entry = p2->next_entry; } p2->prev_entry = p1prevsaved; p1->next_entry->next_entry = p2nextsaved; } static unsigned long long qt_getkey(struct tcptableent *entry, int ch) { if (ch == 'B') return (max(entry->bcount, entry->oth_connection->bcount)); return (max(entry->pcount, entry->oth_connection->pcount)); } static struct tcptableent *qt_partition(struct tcptable *table, struct tcptableent **low, struct tcptableent **high, int ch, int logging, FILE *logfile) { struct tcptableent *pivot = *low; struct tcptableent *left = *low; struct tcptableent *right = *high; struct tcptableent *ptmp; unsigned long long pivot_value; time_t now; pivot_value = qt_getkey(pivot, ch); now = time(NULL); while (left->index < right->index) { while ((qt_getkey(left, ch) >= pivot_value) && (left->next_entry->next_entry != NULL)) { /* * Might as well check out timed out entries here too. */ if ((options.timeout > 0) && ((now - left->lastupdate) / 60 > options.timeout) && (!(left->inclosed))) { left->timedout = left->oth_connection->timedout = 1; addtoclosedlist(table, left); if (logging) write_timeout_log(logging, logfile, left); } left = left->next_entry->next_entry; } while (qt_getkey(right, ch) < pivot_value) { /* * Might as well check out timed out entries here too. */ if ((options.timeout > 0) && ((now - right->lastupdate) / 60 > options.timeout) && (!(right->inclosed))) { right->timedout = right->oth_connection->timedout = 1; addtoclosedlist(table, right); if (logging) write_timeout_log(logging, logfile, right); } right = right->prev_entry->prev_entry; } if (left->index < right->index) { swap_tcp_entries(table, left, right); if (*low == left) *low = right; if (*high == right) *high = left; ptmp = left; left = right; right = ptmp; } } swap_tcp_entries(table, pivot, right); if (*low == pivot) *low = right; if (*high == right) *high = pivot; return pivot; } /* * Quicksort the TCP entries. */ static void quicksort_tcp_entries(struct tcptable *table, struct tcptableent *low, struct tcptableent *high, int ch, int logging, FILE *logfile) { struct tcptableent *pivot; if ((high == NULL) || (low == NULL)) return; if (high->index > low->index) { pivot = qt_partition(table, &low, &high, ch, logging, logfile); if (pivot->prev_entry != NULL) quicksort_tcp_entries(table, low, pivot->prev_entry->prev_entry, ch, logging, logfile); quicksort_tcp_entries(table, pivot->next_entry->next_entry, high, ch, logging, logfile); } } /* * This function sorts the TCP window. The old exchange sort has been * replaced with a Quicksort algorithm. */ static void sortipents(struct tcptable *table, unsigned long *idx, int ch, int logging, FILE *logfile) { struct tcptableent *tcptmp1; unsigned int idxtmp; if ((table->head == NULL) || (table->head->next_entry->next_entry == NULL)) return; ch = toupper(ch); if ((ch != 'P') && (ch != 'B')) return; quicksort_tcp_entries(table, table->head, table->tail->prev_entry, ch, logging, logfile); update_panels(); doupdate(); tx_colorwin(table->tcpscreen); tcptmp1 = table->firstvisible = table->head; *idx = 1; idxtmp = 0; while ((tcptmp1 != NULL) && (idxtmp <= table->imaxy - 1)) { if (idxtmp++ <= table->imaxy - 1) table->lastvisible = tcptmp1; tcptmp1 = tcptmp1->next_entry; } } /* * Attempt to communicate with rvnamed, and if it doesn't respond, try * to start it. */ static int checkrvnamed(void) { pid_t cpid = 0; int cstat; indicate("Trying to communicate with reverse lookup server"); if (!rvnamedactive()) { indicate("Starting reverse lookup server"); if ((cpid = fork()) == 0) { char *args[] = { "rvnamed-ng", NULL }; execvp("rvnamed-ng", args); /* * execvp() never returns, so if we reach this point, we have * a problem. */ die("unable execvp() rvnamed-ng"); } else if (cpid == -1) { write_error("Can't spawn new process; lookups will block"); return 0; } else { while (waitpid(cpid, &cstat, 0) < 0) if (errno != EINTR) break; if (WEXITSTATUS(cstat) == 1) { write_error("Can't start rvnamed; lookups will block"); return 0; } else { sleep(1); return 1; } } } return 1; } static void update_flowrate(struct tcptable *table, unsigned long msecs) { struct tcptableent *entry; for (entry = table->head; entry != NULL; entry = entry->next_entry) { rate_add_rate(&entry->rate, entry->spanbr, msecs); entry->spanbr = 0; } } static void print_flowrate(struct tcptableent *entry, WINDOW *win) { wattrset(win, IPSTATLABELATTR); mvwprintw(win, 0, COLS * 47 / 80, "TCP flow rate: "); wattrset(win, IPSTATATTR); char buf[32]; rate_print(rate_get_average(&entry->rate), buf, sizeof(buf)); mvwprintw(win, 0, COLS * 52 / 80 + 13, "%s", buf); } /* * The IP Traffic Monitor */ void ipmon(time_t facilitytime, char *ifptr) { int logging = options.logging; unsigned int frag_off; struct tcphdr *transpacket; /* IP-encapsulated packet */ in_port_t sport = 0, dport = 0; /* TCP/UDP port values */ char sp_buf[10]; unsigned long screen_idx = 1; struct timeval tv; struct timeval tv_rate; time_t starttime = 0; time_t now = 0; time_t timeint = 0; struct timeval updtime; time_t closedint = 0; WINDOW *statwin; PANEL *statpanel; WINDOW *sortwin; PANEL *sortpanel; FILE *logfile = NULL; int curwin = 0; char *ifname = ifptr; unsigned long long total_pkts = 0; unsigned int br; /* bytes read. Differs from readlen */ struct tcptable table; struct tcptableent *tcpentry; struct tcptableent *tmptcp; int mode = 0; struct othptable othptbl; int p_sstat = 0, p_dstat = 0; /* Reverse lookup statuses prior to */ /* reattempt in updateentry() */ int pkt_result = 0; /* Non-IP filter ok */ int fragment = 0; /* Set to 1 if not first fragment */ int fd; int ch; int keymode = 0; char msgstring[80]; int rvnfd = 0; int revlook = options.revlook; int wasempty = 1; const int statx = COLS * 47 / 80; /* * Mark this instance of the traffic monitor */ if (ifptr && !dev_up(ifptr)) { err_iface_down(); return; } LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, ifptr); promisc_set_list(&promisc); } init_tcp_table(&table); init_othp_table(&othptbl); statwin = newwin(1, COLS, LINES - 2, 0); statpanel = new_panel(statwin); wattrset(statwin, IPSTATLABELATTR); wmove(statwin, 0, 0); sprintf(sp_buf, "%%%dc", COLS); wprintw(statwin, sp_buf, ' '); prepare_statwin(statwin); show_stats(statwin, 0); markactive(curwin, table.borderwin, othptbl.borderwin); update_panels(); doupdate(); if (revlook) { if (checkrvnamed()) open_rvn_socket(&rvnfd); } else rvnfd = 0; ipmonhelp(); uniq_help(0); update_panels(); doupdate(); if (options.servnames) setservent(1); /* * Try to open log file if logging activated. Turn off logging * (for this session only) if an error was discovered in opening * the log file. Configuration setting is kept. Who knows, the * situation may be corrected later. */ if (logging) { if (strcmp(current_logfile, "") == 0) { strncpy(current_logfile, gen_instance_logname(IPMONLOG, getpid()), 80); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_ipmon_log); rotate_flag = 0; writelog(logging, logfile, "******** IP traffic monitor started ********"); } setprotoent(1); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(ifptr && dev_bind_ifname(fd, ifptr) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } exitloop = 0; gettimeofday(&tv, NULL); tv_rate = tv; updtime = tv; starttime = timeint = closedint = tv.tv_sec; PACKET_INIT(pkt); while (!exitloop) { char ifnamebuf[IFNAMSIZ]; gettimeofday(&tv, NULL); now = tv.tv_sec; /* * Print timer at bottom of screen */ if (now - timeint >= 5) { printelapsedtime(starttime, now, othptbl.obmaxy - 1, 15, othptbl.borderwin); timeint = now; } /* * Automatically clear closed/timed out entries */ if ((options.closedint != 0) && ((now - closedint) / 60 >= options.closedint)) { flushclosedentries(&table, &screen_idx, logging, logfile); refreshtcpwin(&table, screen_idx, mode); closedint = now; } /* * Update screen at configured intervals. */ if (screen_update_needed(&tv, &updtime)) { update_panels(); doupdate(); updtime = tv; } /* * If highlight bar is on some entry, update the flow rate * indicator after five seconds. */ unsigned long rate_msecs = timeval_diff_msec(&tv, &tv_rate); if (rate_msecs > 1000) { update_flowrate(&table, rate_msecs); if (table.barptr != NULL) { print_flowrate(table.barptr, statwin); } else { wattrset(statwin, IPSTATATTR); mvwprintw(statwin, 0, statx, "No TCP entries "); } tv_rate = tv; } /* * Terminate facility should a lifetime be specified at the * command line */ if ((facilitytime != 0) && (((now - starttime) / 60) >= facilitytime)) exitloop = 1; /* * Close and rotate log file if signal was received */ if (logging && (rotate_flag == 1)) { announce_rotate_prepare(logfile); write_tcp_unclosed(logging, logfile, &table); rotate_logfile(&logfile, target_logname); announce_rotate_complete(logfile); rotate_flag = 0; } if (packet_get(fd, &pkt, &ch, table.tcpscreen) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch == ERR) goto no_key_ready; if (keymode == 0) { switch (ch) { case KEY_UP: if (curwin) { scrolllowerwin(&othptbl, SCROLLDOWN); break; } if (!table.barptr || !table.barptr->prev_entry) break; tmptcp = table.barptr; table.barptr = table.barptr->prev_entry; printentry(&table, tmptcp, screen_idx, mode); if (table.baridx == 1) scrollupperwin(&table, SCROLLDOWN, &screen_idx, mode); else (table.baridx)--; printentry(&table, table.barptr, screen_idx, mode); break; case KEY_DOWN: if (curwin) { scrolllowerwin(&othptbl, SCROLLUP); break; } if (!table.barptr || !table.barptr->next_entry) break; tmptcp = table.barptr; table.barptr = table.barptr->next_entry; printentry(&table, tmptcp, screen_idx,mode); if (table.baridx == table.imaxy) scrollupperwin(&table, SCROLLUP, &screen_idx, mode); else (table.baridx)++; printentry(&table,table.barptr, screen_idx, mode); break; case KEY_RIGHT: if (!curwin) break; if (othptbl.strindex != VSCRL_OFFSET) othptbl.strindex = VSCRL_OFFSET; refresh_othwindow(&othptbl); break; case KEY_LEFT: if (!curwin) break; if (othptbl.strindex != 0) othptbl.strindex = 0; refresh_othwindow(&othptbl); break; case KEY_PPAGE: case '-': if (curwin) { pagelowerwin(&othptbl, SCROLLDOWN); refresh_othwindow(&othptbl); break; } if (!table.barptr) break; pageupperwin(&table, SCROLLDOWN, &screen_idx); table.barptr = table.lastvisible; table.baridx = table.lastvisible->index - screen_idx + 1; refreshtcpwin(&table, screen_idx, mode); break; case KEY_NPAGE: case ' ': if (curwin) { pagelowerwin(&othptbl, SCROLLUP); refresh_othwindow(&othptbl); break; } if (!table.barptr) break; pageupperwin(&table, SCROLLUP, &screen_idx); table.barptr = table.firstvisible; table.baridx = 1; refreshtcpwin(&table, screen_idx, mode); break; case KEY_F(6): case 'w': case 'W': case 9: curwin = !curwin; markactive(curwin, table.borderwin, othptbl.borderwin); uniq_help(curwin); break; case 'm': case 'M': if (curwin) break; mode = (mode + 1) % 3; if ((mode == 1) && !options.mac) mode = 2; refreshtcpwin(&table, screen_idx, mode); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'F': case 'f': case 'c': case 'C': flushclosedentries(&table, &screen_idx, logging, logfile); refreshtcpwin(&table, screen_idx, mode); break; case 's': case 'S': keymode = 1; show_tcpsort_win(&sortwin, &sortpanel); break; case 'Q': case 'q': case 'X': case 'x': case 24: case 27: exitloop = 1; break; } } else if (keymode == 1) { keymode = 0; del_panel(sortpanel); delwin(sortwin); show_sort_statwin(&sortwin, &sortpanel); update_panels(); doupdate(); sortipents(&table, &screen_idx, ch, logging, logfile); if (table.barptr != NULL) { table.barptr = table.firstvisible; table.baridx = 1; } refreshtcpwin(&table, screen_idx, mode); del_panel(sortpanel); delwin(sortwin); update_panels(); doupdate(); } no_key_ready: if (pkt.pkt_len <= 0) continue; total_pkts++; show_stats(statwin, total_pkts); pkt_result = packet_process(&pkt, &br, &sport, &dport, MATCH_OPPOSITE_ALWAYS, options.v6inv4asv6); if (pkt_result != PACKET_OK) continue; if (!ifptr) { /* we're capturing on "All interfaces", */ /* so get the name of the interface */ /* of this packet */ int r = dev_get_ifname(pkt.pkt_ifindex, ifnamebuf); if (r != 0) { write_error("Unable to get interface name"); break; /* error getting interface name, get out! */ } ifname = ifnamebuf; } struct sockaddr_storage saddr, daddr; switch(pkt.pkt_protocol) { case ETH_P_IP: frag_off = pkt.iphdr->frag_off; sockaddr_make_ipv4(&saddr, pkt.iphdr->saddr); sockaddr_make_ipv4(&daddr, pkt.iphdr->daddr); break; case ETH_P_IPV6: frag_off = 0; sockaddr_make_ipv6(&saddr, &pkt.ip6_hdr->ip6_src); sockaddr_make_ipv6(&daddr, &pkt.ip6_hdr->ip6_dst); break; default: add_othp_entry(&othptbl, &pkt, NULL, NULL, NOT_IP, pkt.pkt_protocol, pkt.pkt_payload, ifname, 0, 0, logging, logfile, 0); continue; } /* only when packets fragmented */ __u8 iphlen = pkt_iph_len(&pkt); transpacket = (struct tcphdr *) (pkt.pkt_payload + iphlen); __u8 ip_protocol = pkt_ip_protocol(&pkt); if (ip_protocol == IPPROTO_TCP) { sockaddr_set_port(&saddr, sport); sockaddr_set_port(&daddr, dport); tcpentry = in_table(&table, &saddr, &daddr, ifname, logging, logfile, options.timeout); /* * Add a new entry if it doesn't exist, and, * to reduce the chances of stales, not a FIN. */ if (((ntohs(frag_off) & 0x3fff) == 0) /* first frag only */ && (tcpentry == NULL) && (!(transpacket->fin))) { /* * Ok, so we have a packet. Add it if this connection * is not yet closed, or if it is a SYN packet. */ wasempty = (table.head == NULL); tcpentry = addentry(&table, &saddr, &daddr, pkt_ip_protocol(&pkt), ifname, &revlook, rvnfd); if (tcpentry != NULL) { printentry(&table, tcpentry->oth_connection, screen_idx, mode); if (wasempty) { table.barptr = table.firstvisible; table.baridx = 1; } } } /* * If we had an addentry() success, we should have no * problem here. Same thing if we had a table lookup * success. */ if ((tcpentry != NULL) && !(tcpentry->stat & FLAG_RST)) { /* * Don't bother updating the entry if the connection * has been previously reset. (Does this really * happen in practice?) */ if (revlook) { p_sstat = tcpentry->s_fstat; p_dstat = tcpentry->d_fstat; } if (pkt.iphdr) updateentry(&table, tcpentry, transpacket, pkt.pkt_buf, pkt.pkt_hatype, pkt.pkt_len, br, pkt.iphdr->frag_off, logging, &revlook, rvnfd, logfile); else updateentry(&table, tcpentry, transpacket, pkt.pkt_buf, pkt.pkt_hatype, pkt.pkt_len, pkt.pkt_len, 0, logging, &revlook, rvnfd, logfile); /* * Log first packet of a TCP connection except if * it's a RST, which was already logged earlier in * updateentry() */ if (logging && (tcpentry->pcount == 1) && (!(tcpentry->stat & FLAG_RST))) { strcpy(msgstring, "first packet"); if (transpacket->syn) strcat(msgstring, " (SYN)"); writetcplog(logging, logfile, tcpentry, pkt.pkt_len, msgstring); } if ((revlook) && (((p_sstat != RESOLVED) && (tcpentry->s_fstat == RESOLVED)) || ((p_dstat != RESOLVED) && (tcpentry->d_fstat == RESOLVED)))) { clearaddr(&table, tcpentry, screen_idx); clearaddr(&table, tcpentry->oth_connection, screen_idx); } printentry(&table, tcpentry, screen_idx, mode); /* * Special cases: Update other direction if it's * an ACK in response to a FIN. * * -- or -- * * Addresses were just resolved for the other * direction, so we should also do so here. */ if (((tcpentry->oth_connection->finsent == 2) && /* FINed and ACKed */ (ntohl(transpacket->seq) == tcpentry->oth_connection->finack)) || ((revlook) && (((p_sstat != RESOLVED) && (tcpentry->s_fstat == RESOLVED)) || ((p_dstat != RESOLVED) && (tcpentry->d_fstat == RESOLVED))))) printentry(&table, tcpentry->oth_connection, screen_idx, mode); } } else if (pkt.iphdr) { fragment = ((ntohs(pkt.iphdr->frag_off) & 0x1fff) != 0); if (pkt_ip_protocol(&pkt) == IPPROTO_ICMP) { /* * Cancel the corresponding TCP entry if an ICMP * Destination Unreachable or TTL Exceeded message * is received. */ if (((struct icmphdr *) transpacket)->type == ICMP_DEST_UNREACH) process_dest_unreach(&table, (char *) transpacket, ifname); } add_othp_entry(&othptbl, &pkt, &saddr, &daddr, IS_IP, pkt_ip_protocol(&pkt), (char *) transpacket, ifname, &revlook, rvnfd, logging, logfile, fragment); } else { if (pkt_ip_protocol(&pkt) == IPPROTO_ICMPV6 && (((struct icmp6_hdr *) transpacket)->icmp6_type == ICMP6_DST_UNREACH)) process_dest_unreach(&table, (char *) transpacket, ifname); add_othp_entry(&othptbl, &pkt, &saddr, &daddr, IS_IP, pkt_ip_protocol(&pkt), (char *) transpacket, ifname, &revlook, rvnfd, logging, logfile, fragment); } } err_close: close(fd); err: killrvnamed(); if (options.servnames) endservent(); endprotoent(); close_rvn_socket(rvnfd); if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } attrset(STDATTR); mvprintw(0, COLS - 20, " "); del_panel(table.tcppanel); del_panel(table.borderpanel); del_panel(othptbl.othppanel); del_panel(othptbl.borderpanel); del_panel(statpanel); update_panels(); doupdate(); delwin(table.tcpscreen); delwin(table.borderwin); delwin(othptbl.othpwin); delwin(othptbl.borderwin); delwin(statwin); destroytcptable(&table); destroyothptable(&othptbl); pkt_cleanup(); if (logging) { signal(SIGUSR1, SIG_DFL); writelog(logging, logfile, "******** IP traffic monitor stopped ********\n"); fclose(logfile); strcpy(current_logfile, ""); } } iptraf-ng-1.1.4/src/itrafmon.h0000664000076400007640000000021412173477703016455 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_ITRAFMON_H #define IPTRAF_NG_ITRAFMON_H void ipmon(time_t facilitytime, char *ifptr); #endif /* IPTRAF_NG_ITRAFMON_H */ iptraf-ng-1.1.4/src/landesc.c0000664000076400007640000001670612173477703016257 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** landesc.c - LAN host description management module Currently includes support for Ethernet, PLIP, and FDDI ***/ #include "iptraf-ng-compat.h" #include "tui/input.h" #include "tui/listbox.h" #include "tui/msgboxes.h" #include "tui/menurt.h" #include "landesc.h" #include "deskman.h" #include "attrs.h" #include "dirs.h" static int check_mac_addr(const char *mac) { if (strlen(mac) != 17) return 0; char a[3], b[3], c[3], d[3], e[3], f[3]; int success = sscanf(mac, "%02s:%02s:%02s:%02s:%02s:%02s", a, b, c, d, e, f); if (success != 6) return 0; char mac_hex[13]; sprintf(mac_hex, "%s%s%s%s%s%s", a, b, c, d, e, f); for (int ii = 0; ii < 12; ++ii) if (!isxdigit(mac_hex[ii])) return 0; return 1; } /* parse and insert unique eth description. * caller is responsible for freeing whole list */ static void parse_eth_desc(FILE * fp, struct eth_desc *hd) { char *l = NULL; size_t len = 0; ssize_t read; while ((read = getline(&l, &len, fp)) != -1) { if (l[0] == '\n' || l[0] == '#') continue; char *line = l; if (strchr(line, '\n')) strchr(line, '\n')[0] = '\0'; char mac[18] = { 0 }; strncpy(mac, line, 17); if (!check_mac_addr(mac)) { tui_error(ANYKEY_MSG, "Not a mac '%s' address, skipped", mac); continue; } /* skip mac address */ line += 17; /* mandatory space between mac and ip */ if (!isspace(*line)) { tui_error(ANYKEY_MSG, "Missing mandatory space between" "mac and host/ip address, skipped"); continue; } line = skip_whitespace(line); if (!*line) { tui_error(ANYKEY_MSG, "Missing description, skipped"); continue; } struct eth_desc *new = xmalloc(sizeof(struct eth_desc)); memcpy(new->hd_mac, mac, sizeof(mac)); new->hd_desc = xstrdup(line); struct eth_desc *desc = NULL; list_for_each_entry(desc, &hd->hd_list, hd_list) if ((strcmp(desc->hd_mac, mac) == 0) || (strcmp(desc->hd_desc, line) == 0)) goto dupe; list_add_tail(&new->hd_list, &hd->hd_list); dupe:; } free(l); } struct eth_desc *load_eth_desc(unsigned link_type) { /* why is usefull to have it two files with same content? * There is two options how to merge it. * 1) separate by comments * $ cat ETHFILE * # ethernet host description * MAC ip/hostname * * # fddi host description * MAC ip/hostname * 2) put it into groups * [ethernet] * MAC ip/hostname * * [fddi] * MAC ip/hostname */ char *filename = NULL; FILE *fp = NULL; if (link_type == ARPHRD_ETHER) filename = ETHFILE; else if (link_type == ARPHRD_FDDI) filename = FDDIFILE; struct eth_desc *hd = xmallocz(sizeof(struct eth_desc)); INIT_LIST_HEAD(&hd->hd_list); fp = fopen(filename, "r"); if (fp) { parse_eth_desc(fp, hd); fclose(fp); } /* merge with /etc/ethers */ fp = fopen("/etc/ethers", "r"); if (fp) { parse_eth_desc(fp, hd); fclose(fp); } return hd; } static void save_eth_desc(struct eth_desc *hd, unsigned linktype) { FILE *fd = NULL; if (linktype == ARPHRD_ETHER) fd = fopen(ETHFILE, "w"); else if (linktype == ARPHRD_FDDI) fd = fopen(FDDIFILE, "w"); if (!fd) { tui_error(ANYKEY_MSG, "Unable to save host description file"); return; } fprintf(fd, "# see man ethers for syntax\n\n"); struct eth_desc *desc = NULL; list_for_each_entry(desc, &hd->hd_list, hd_list) fprintf(fd, "%s %s\n", desc->hd_mac, desc->hd_desc); fclose(fd); } void free_eth_desc(struct eth_desc *hd) { struct eth_desc *entry = NULL; struct list_head *l, *n; list_for_each_safe(l, n, &hd->hd_list) { entry = list_entry(l, struct eth_desc, hd_list); free(entry->hd_desc); list_del(l); free(entry); } } static struct eth_desc *select_eth_desc(const struct eth_desc *hd) { int resp; struct scroll_list slist; char descline[80]; if (list_empty(&hd->hd_list)) { tui_error(ANYKEY_MSG, "No descriptions"); return NULL; } tx_init_listbox(&slist, COLS, 20, 0, (LINES - 20) / 2, STDATTR, BOXATTR, BARSTDATTR, HIGHATTR); tx_set_listbox_title(&slist, "Address", 1); tx_set_listbox_title(&slist, "Description", 19); struct eth_desc *entry = NULL; list_for_each_entry(entry, &hd->hd_list, hd_list) { snprintf(descline, 80, "%-18s%s", entry->hd_mac, entry->hd_desc); tx_add_list_entry(&slist, (char *) entry, descline); } tx_show_listbox(&slist); int aborted = 0; tx_operate_listbox(&slist, &resp, &aborted); if (!aborted) entry = (struct eth_desc *) slist.textptr->nodeptr; else entry = NULL; tx_close_listbox(&slist); tx_destroy_list(&slist); update_panels(); doupdate(); return entry; } static int dialog_eth_desc(struct FIELDLIST *fields, const char *initaddr, const char *initdesc) { /* TODO: move to tui */ WINDOW *win = newwin(8, 70, 8, (COLS - 70) / 2); PANEL *panel = new_panel(win); wattrset(win, DLGBOXATTR); tx_colorwin(win); tx_box(win, ACS_VLINE, ACS_HLINE); wmove(win, 6, 2 * COLS / 80); tabkeyhelp(win); wmove(win, 6, 20 * COLS / 80); stdkeyhelp(win); wattrset(win, DLGTEXTATTR); wmove(win, 2, 2 * COLS / 80); wprintw(win, "MAC Address:"); wmove(win, 4, 2 * COLS / 80); wprintw(win, "Description:"); tx_initfields(fields, 3, 52, 10, (COLS - 52) / 2 + 6 * COLS / 80, DLGTEXTATTR, FIELDATTR); tx_addfield(fields, 17, 0, 0, initaddr); tx_addfield(fields, 50, 2, 0, initdesc); int aborted = 0; tx_fillfields(fields, &aborted); del_panel(panel); delwin(win); return aborted; } static void add_eth_desc(struct eth_desc *list) { struct FIELDLIST fields; int aborted = dialog_eth_desc(&fields, "", ""); if (!aborted) { struct eth_desc *new = xmalloc(sizeof(struct eth_desc)); memcpy(new->hd_mac, fields.list->buf, sizeof(new->hd_mac)); new->hd_desc = xstrdup(fields.list->nextfield->buf); list_add_tail(&new->hd_list, &list->hd_list); } tx_destroyfields(&fields); update_panels(); doupdate(); } static void edit_eth_desc(struct eth_desc *list) { struct eth_desc *hd = select_eth_desc(list); if (!hd) return; struct FIELDLIST fields; int aborted = dialog_eth_desc(&fields, hd->hd_mac, hd->hd_desc); if (!aborted) { free(hd->hd_desc); memcpy(hd->hd_mac, fields.list->buf, sizeof(hd->hd_mac)); hd->hd_desc = xstrdup(fields.list->nextfield->buf); } tx_destroyfields(&fields); } static void del_eth_desc(struct eth_desc *list) { struct eth_desc *hd = select_eth_desc(list); if (hd) { free(hd->hd_desc); list_del(&hd->hd_list); free(hd); } } void manage_eth_desc(unsigned linktype) { struct MENU menu; int row = 1; int aborted = 0; tx_initmenu(&menu, 7, 31, (LINES - 6) / 2, (COLS - 31) / 2, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(&menu, " ^A^dd description...", "Adds a description for a MAC address"); tx_additem(&menu, " ^E^dit description...", "Modifies an existing MAC address description"); tx_additem(&menu, " ^D^elete description...", "Deletes an existing MAC address description"); tx_additem(&menu, NULL, NULL); tx_additem(&menu, " E^x^it menu", "Returns to the main menu"); struct eth_desc *list = load_eth_desc(linktype /*, WITHOUTETCETHERS */ ); do { tx_showmenu(&menu); tx_operatemenu(&menu, &row, &aborted); switch (row) { case 1: add_eth_desc(list); break; case 2: edit_eth_desc(list); break; case 3: del_eth_desc(list); break; } } while (row != 5); tx_destroymenu(&menu); update_panels(); doupdate(); save_eth_desc(list, linktype); } iptraf-ng-1.1.4/src/landesc.h0000664000076400007640000000070612173477703016255 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_LANDESC_H #define IPTRAF_NG_LANDESC_H /*** ethdesc.c - Ethernet host description management module ***/ #include "list.h" #define WITHETCETHERS 1 #define WITHOUTETCETHERS 0 struct eth_desc { struct list_head hd_list; char hd_mac[18]; char *hd_desc; }; struct eth_desc *load_eth_desc(unsigned link_type); void free_eth_desc(struct eth_desc *hd); void manage_eth_desc(unsigned int linktype); #endif /* IPTRAF_NG_LANDESC_H */ iptraf-ng-1.1.4/src/list.h0000664000076400007640000000430712173477703015620 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_LIST_H #define IPTRAF_NG_LIST_H struct list_head { struct list_head *next, *prev; }; #define LIST_HEAD_INIT(name) { &(name), &(name) } #define LIST_HEAD(name) \ struct list_head name = LIST_HEAD_INIT(name) static inline void INIT_LIST_HEAD(struct list_head *list) { list->next = list; list->prev = list; } static inline void __list_add(struct list_head *new, struct list_head *prev, struct list_head *next) { next->prev = new; new->next = next; new->prev = prev; prev->next = new; } static inline void list_add(struct list_head *new, struct list_head *head) { __list_add(new, head, head->next); } static inline void list_add_tail(struct list_head *new, struct list_head *head) { __list_add(new, head->prev, head); } static inline void list_add_tail_unique(struct list_head *new, struct list_head *head) { __list_add(new, head->prev, head); } static inline void __list_del(struct list_head *prev, struct list_head *next) { next->prev = prev; prev->next = next; } static inline void list_del(struct list_head *entry) { __list_del(entry->prev, entry->next); entry->next = NULL; entry->prev = NULL; } static inline int list_is_last(const struct list_head *list, const struct list_head *head) { return list->next == head; } static inline int list_empty(const struct list_head *head) { return head->next == head; } #define list_entry(ptr, type, member) \ ((type *)( (char *)(ptr) - offsetof(type, member) )) #define list_for_each(pos, head) \ for (pos = (head)->next; pos != (head); pos = pos->next) #define list_for_each_safe(pos, n, head) \ for (pos = (head)->next, n = pos->next; pos != (head); \ pos = n, n = pos->next) #define list_for_each_entry(pos, head, member) \ for (pos = list_entry((head)->next, typeof(*pos), member); \ &pos->member != (head); \ pos = list_entry(pos->member.next, typeof(*pos), member)) #define list_for_each_entry_safe(pos, n, head, member) \ for (pos = list_entry((head)->next, typeof(*pos), member), \ n = list_entry(pos->member.next, typeof(*pos), member); \ &pos->member != (head); \ pos = n, n = list_entry(n->member.next, typeof(*n), member)) #endif /* IPTRAF_NG_LIST_H */ iptraf-ng-1.1.4/src/log.c0000664000076400007640000000646012173477703015423 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** log.c - the iptraf logging facility ***/ #include "iptraf-ng-compat.h" #include "attrs.h" #include "deskman.h" #include "dirs.h" #include "log.h" #include "tui/input.h" #include "tui/msgboxes.h" #include "tui/winops.h" #define TARGET_LOGNAME_MAX 160 int rotate_flag; char target_logname[TARGET_LOGNAME_MAX]; char current_logfile[TARGET_LOGNAME_MAX]; /* * Generates a log file based on a template for a particular instance of * a facility. Used by the IP Traffic Monitor and LAN Station Monitor. */ char *gen_instance_logname(char *template, int instance_num) { static char filename[80]; snprintf(filename, 80, "%s-%d.log", template, instance_num); return filename; } void input_logfile(char *target, int *logging) { WINDOW *dlgwin; PANEL *dlgpanel; struct FIELDLIST fieldlist; int aborted; dlgwin = newwin(11, 60, (LINES - 11) / 2, (COLS - 60) / 2); dlgpanel = new_panel(dlgwin); wattrset(dlgwin, DLGBOXATTR); tx_colorwin(dlgwin); tx_box(dlgwin, ACS_VLINE, ACS_HLINE); mvwprintw(dlgwin, 0, 1, " Logging Enabled "); wattrset(dlgwin, DLGTEXTATTR); mvwprintw(dlgwin, 2, 2, "Enter the name of the file to which to write the log."); mvwprintw(dlgwin, 4, 2, "If you don't specify a path, the log file will"); mvwprintw(dlgwin, 5, 2, "be placed in %s.", LOGDIR); wmove(dlgwin, 9, 2); stdkeyhelp(dlgwin); wprintw(dlgwin, " (turns logging off)"); tx_initfields(&fieldlist, 1, 50, (LINES - 1) / 2 + 2, (COLS - 50) / 2 - 3, DLGTEXTATTR, FIELDATTR); tx_addfield(&fieldlist, 48, 0, 0, target); tx_fillfields(&fieldlist, &aborted); if (!aborted) { if (strchr(fieldlist.list->buf, '/') == NULL) snprintf(target, 48, "%s/%s", LOGDIR, fieldlist.list->buf); else strncpy(target, fieldlist.list->buf, 48); } *logging = !aborted; tx_destroyfields(&fieldlist); del_panel(dlgpanel); delwin(dlgwin); update_panels(); doupdate(); } void opentlog(FILE ** fd, char *logfilename) { *fd = fopen(logfilename, "a"); if (*fd == NULL) tui_error(ANYKEY_MSG, "Unable to open log file"); rotate_flag = 0; strcpy(target_logname, ""); } void genatime(time_t now, char *atime) { memset(atime, 0, TIME_TARGET_MAX); strncpy(atime, ctime(&now), 26); atime[strlen(atime) - 1] = '\0'; } void writelog(int logging, FILE * fd, char *msg) { char atime[TIME_TARGET_MAX]; if (logging) { genatime(time(NULL), atime); fprintf(fd, "%s; %s\n", atime, msg); } fflush(fd); } void write_daemon_err(char *msg, va_list vararg) { char atime[TIME_TARGET_MAX]; FILE *fd; genatime(time(NULL), atime); fd = fopen(DAEMONLOG, "a"); fprintf(fd, "%s iptraf[%u]: ", atime, getpid()); vfprintf(fd, msg, vararg); fprintf(fd, "\n"); fclose(fd); } void rotate_logfile(FILE ** fd, char *name) { fclose(*fd); *fd = fopen(name, "a"); rotate_flag = 0; } void announce_rotate_prepare(FILE * fd) { writelog(1, fd, "***** USR1 signal received, preparing to reopen log file *****"); } void announce_rotate_complete(FILE * fd) { writelog(1, fd, "***** Logfile reopened *****"); } void check_rotate_flag(FILE ** logfile) { if (rotate_flag == 1) { announce_rotate_prepare(*logfile); rotate_logfile(logfile, target_logname); announce_rotate_complete(*logfile); rotate_flag = 0; } } iptraf-ng-1.1.4/src/log.h0000664000076400007640000000116412173477703015424 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_LOG_H #define IPTRAF_NG_LOG_H /*** log.h - the iptraf logging facility header file ***/ #define TIME_TARGET_MAX 30 char *gen_instance_logname(char *template, int instance_id); void input_logfile(char *target, int *aborted); void opentlog(FILE ** fd, char *logfilename); void writelog(int logging, FILE * fd, char *msg); void genatime(time_t now, char *atime); void write_daemon_err(char *msg, va_list vararg); void rotate_logfile(FILE ** fd, char *name); void check_rotate_flag(FILE ** fd); void announce_rotate_prepare(FILE * fd); void announce_rotate_complete(FILE * fd); #endif /* IPTRAF_NG_LOG_H */ iptraf-ng-1.1.4/src/logvars.h0000664000076400007640000000026612173477703016322 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_LOGVARS_H #define IPTRAF_NG_LOGVARS_H extern int rotate_flag; extern char target_logname[160]; extern char current_logfile[160]; #endif /* IPTRAF_NG_LOGVARS_H */ iptraf-ng-1.1.4/src/options.c0000664000076400007640000002221412173477703016330 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** options.c - implements the configuration section of the utility ***/ #include "iptraf-ng-compat.h" #include "tui/input.h" #include "tui/menurt.h" #include "tui/msgboxes.h" #include "tui/winops.h" #include "serv.h" #include "options.h" #include "deskman.h" #include "attrs.h" #include "landesc.h" #include "promisc.h" #include "dirs.h" #define ALLOW_ZERO 1 #define DONT_ALLOW_ZERO 0 struct OPTIONS options; static void makeoptionmenu(struct MENU *menu) { tx_initmenu(menu, 20, 40, (LINES - 19) / 2 - 1, (COLS - 40) / 16, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(menu, " ^R^everse DNS lookups", "Toggles resolution of IP addresses into host names"); tx_additem(menu, " TCP/UDP ^s^ervice names", "Displays TCP/UDP service names instead of numeric ports"); tx_additem(menu, " Force ^p^romiscuous mode", "Toggles capture of all packets by LAN interfaces"); tx_additem(menu, " ^C^olor", "Turns color on or off (restart IPTraf to effect change)"); tx_additem(menu, " ^L^ogging", "Toggles logging of traffic to a data file"); tx_additem(menu, " Acti^v^ity mode", "Toggles activity indicators between kbits/s and kbytes/s"); tx_additem(menu, " Source ^M^AC addrs in traffic monitor", "Toggles display of source MAC addresses in the IP Traffic Monitor"); tx_additem(menu, " ^S^how v6-in-v4 traffic as IPv6", "Toggled display of IPv6 tunnel in IPv4 as IPv6 traffic"); tx_additem(menu, NULL, NULL); tx_additem(menu, " ^T^imers...", "Configures timeouts and intervals"); tx_additem(menu, NULL, NULL); tx_additem(menu, " ^A^dditional ports...", "Allows you to add port numbers higher than 1023 for the service stats"); tx_additem(menu, " ^D^elete port/range...", "Deletes a port or range of ports earlier added"); tx_additem(menu, NULL, NULL); tx_additem(menu, " ^E^thernet/PLIP host descriptions...", "Manages descriptions for Ethernet and PLIP addresses"); tx_additem(menu, " ^F^DDI/Token Ring host descriptions...", "Manages descriptions for FDDI and FDDI addresses"); tx_additem(menu, NULL, NULL); tx_additem(menu, " E^x^it configuration", "Returns to main menu"); } static void maketimermenu(struct MENU *menu) { tx_initmenu(menu, 8, 35, (LINES - 19) / 2 + 7, (COLS - 35) / 2, BOXATTR, STDATTR, HIGHATTR, BARSTDATTR, BARHIGHATTR, DESCATTR); tx_additem(menu, " TCP ^t^imeout...", "Sets the length of time before inactive TCP entries are considered idle"); tx_additem(menu, " ^L^ogging interval...", "Sets the time between loggings for interface, host, and service stats"); tx_additem(menu, " ^S^creen update interval...", "Sets the screen update interval in seconds (set to 0 for fastest updates)"); tx_additem(menu, " TCP closed/idle ^p^ersistence...", "Determines how long closed/idle/reset entries stay onscreen"); tx_additem(menu, NULL, NULL); tx_additem(menu, " E^x^it menu", "Returns to the configuration menu"); } static void printoptonoff(unsigned int option, WINDOW * win) { if (option) wprintw(win, " On"); else wprintw(win, "Off"); } static void indicatesetting(int row, WINDOW *win) { wmove(win, row, 30); wattrset(win, HIGHATTR); switch (row) { case 1: printoptonoff(options.revlook, win); break; case 2: printoptonoff(options.servnames, win); break; case 3: printoptonoff(options.promisc, win); break; case 4: printoptonoff(options.color, win); break; case 5: printoptonoff(options.logging, win); break; case 6: wmove(win, row, 25); if (options.actmode == KBITS) wprintw(win, " kbits/s"); else wprintw(win, "kbytes/s"); break; case 7: printoptonoff(options.mac, win); break; case 8: printoptonoff(options.v6inv4asv6, win); } } void saveoptions(void) { int fd; int bw; fd = open(CONFIGFILE, O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR); if (fd < 0) { tui_error(ANYKEY_MSG, "Cannot create config file: %s %s", CONFIGFILE, strerror(errno)); return; } bw = write(fd, &options, sizeof(struct OPTIONS)); if (bw < 0) tui_error(ANYKEY_MSG, "Unable to write config file"); close(fd); } static void setdefaultopts(void) { options.revlook = 0; options.promisc = 0; options.servnames = 0; options.color = 1; options.logging = 0; options.actmode = KBITS; options.mac = 0; options.timeout = 15; options.logspan = 3600; options.updrate = 0; options.closedint = 0; options.v6inv4asv6 = 1; } void loadoptions(void) { int fd; setdefaultopts(); fd = open(CONFIGFILE, O_RDONLY); if (fd < 0) return; read(fd, &options, sizeof(struct OPTIONS)); close(fd); } static void updatetimes(WINDOW *win) { wattrset(win, HIGHATTR); mvwprintw(win, 10, 25, "%3u mins", options.timeout); mvwprintw(win, 11, 25, "%3u mins", options.logspan / 60); mvwprintw(win, 12, 25, "%3u secs", options.updrate); mvwprintw(win, 13, 25, "%3u mins", options.closedint); } static void showoptions(WINDOW *win) { int i; for (i = 1; i <= 8; i++) indicatesetting(i, win); updatetimes(win); } static void settimeout(time_t *value, const char *units, int allow_zero, int *aborted) { WINDOW *dlgwin; PANEL *dlgpanel; struct FIELDLIST field; time_t tmval = 0; dlgwin = newwin(7, 40, (LINES - 7) / 2, (COLS - 40) / 4); dlgpanel = new_panel(dlgwin); wattrset(dlgwin, DLGBOXATTR); tx_colorwin(dlgwin); tx_box(dlgwin, ACS_VLINE, ACS_HLINE); wattrset(dlgwin, DLGTEXTATTR); wmove(dlgwin, 2, 2); wprintw(dlgwin, "Enter value in %s", units); wmove(dlgwin, 5, 2); stdkeyhelp(dlgwin); tx_initfields(&field, 1, 10, (LINES - 7) / 2 + 3, (COLS - 40) / 4 + 2, DLGTEXTATTR, FIELDATTR); tx_addfield(&field, 3, 0, 0, ""); do { tx_fillfields(&field, aborted); if (!(*aborted)) { unsigned int tm; tmval = 0; int ret = strtoul_ui(field.list->buf, 10, &tm); if ((ret == -1) || (!allow_zero && (tm == 0))) tui_error(ANYKEY_MSG, "Invalid timeout value"); else tmval = tm; } } while (((!allow_zero) && (tmval == 0)) && (!(*aborted))); if (!(*aborted)) *value = tmval; del_panel(dlgpanel); delwin(dlgwin); tx_destroyfields(&field); update_panels(); doupdate(); } void setoptions(void) { int row = 1; int trow = 1; /* row for timer submenu */ int aborted; struct MENU menu; struct MENU timermenu; WINDOW *statwin; PANEL *statpanel; struct porttab *ports; loadaddports(&ports); makeoptionmenu(&menu); statwin = newwin(15, 35, (LINES - 19) / 2 - 1, (COLS - 40) / 16 + 40); statpanel = new_panel(statwin); wattrset(statwin, BOXATTR); tx_colorwin(statwin); tx_box(statwin, ACS_VLINE, ACS_HLINE); wmove(statwin, 9, 1); whline(statwin, ACS_HLINE, 33); mvwprintw(statwin, 0, 1, " Current Settings "); wattrset(statwin, STDATTR); mvwprintw(statwin, 1, 2, "Reverse DNS lookups:"); mvwprintw(statwin, 2, 2, "Service names:"); mvwprintw(statwin, 3, 2, "Promiscuous:"); mvwprintw(statwin, 4, 2, "Color:"); mvwprintw(statwin, 5, 2, "Logging:"); mvwprintw(statwin, 6, 2, "Activity mode:"); mvwprintw(statwin, 7, 2, "MAC addresses:"); mvwprintw(statwin, 8, 2, "v6-in-v4 as IPv6:"); mvwprintw(statwin, 10, 2, "TCP timeout:"); mvwprintw(statwin, 11, 2, "Log interval:"); mvwprintw(statwin, 12, 2, "Update interval:"); mvwprintw(statwin, 13, 2, "Closed/idle persist:"); showoptions(statwin); do { tx_showmenu(&menu); tx_operatemenu(&menu, &row, &aborted); switch (row) { case 1: options.revlook = ~options.revlook; break; case 2: options.servnames = ~options.servnames; break; case 3: options.promisc = ~options.promisc; break; case 4: options.color = ~options.color; break; case 5: options.logging = ~options.logging; break; case 6: options.actmode = ~options.actmode; break; case 7: options.mac = ~options.mac; break; case 8: options.v6inv4asv6 = ~options.v6inv4asv6; break; case 10: maketimermenu(&timermenu); trow = 1; do { tx_showmenu(&timermenu); tx_operatemenu(&timermenu, &trow, &aborted); switch (trow) { case 1: settimeout(&options.timeout, "minutes", DONT_ALLOW_ZERO, &aborted); if (!aborted) updatetimes(statwin); break; case 2: settimeout(&options.logspan, "minutes", DONT_ALLOW_ZERO, &aborted); if (!aborted) { options.logspan = options.logspan * 60; updatetimes(statwin); } break; case 3: settimeout(&options.updrate, "seconds", ALLOW_ZERO, &aborted); if (!aborted) updatetimes(statwin); break; case 4: settimeout(&options.closedint, "minutes", ALLOW_ZERO, &aborted); if (!aborted) updatetimes(statwin); break; } } while (trow != 6); tx_destroymenu(&timermenu); update_panels(); doupdate(); break; case 12: addmoreports(&ports); break; case 13: removeaport(&ports); break; case 15: manage_eth_desc(ARPHRD_ETHER); break; case 16: manage_eth_desc(ARPHRD_FDDI); break; } indicatesetting(row, statwin); } while (row != 18); destroyporttab(ports); tx_destroymenu(&menu); del_panel(statpanel); delwin(statwin); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/options.h0000664000076400007640000000062012173477703016332 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_OPTIONS_H #define IPTRAF_NG_OPTIONS_H struct OPTIONS { unsigned int color:1, logging:1, revlook:1, servnames:1, promisc:1, actmode:1, mac:1, v6inv4asv6:1, dummy:8; time_t timeout; time_t logspan; time_t updrate; time_t closedint; }; extern struct OPTIONS options; void setoptions(void); void loadoptions(void); void saveoptions(void); #endif /* IPTRAF_NG_OPTIONS_H */ iptraf-ng-1.1.4/src/othptab.c0000664000076400007640000005032212173477703016277 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** othptab.c - non-TCP protocol display module ***/ #include "iptraf-ng-compat.h" #include "tui/winops.h" #include "arphdr.h" #include "options.h" #include "tcptable.h" #include "othptab.h" #include "deskman.h" #include "attrs.h" #include "log.h" #include "revname.h" #include "rvnamed.h" #include "servname.h" #include "addproto.h" #include "packet.h" #include "hostmon.h" #include "sockaddr.h" #define MSGSTRING_MAX 240 #define SHORTSTRING_MAX 40 /* * A trick to suppress uninitialized variable warning without generating any * code */ #define uninitialized_var(x) x = x static void writeothplog(int logging, FILE *fd, char *protname, char *description, char *additional, int is_ip, int withmac, struct othptabent *entry) { char msgbuffer[MSGSTRING_MAX]; char scratchpad[MSGSTRING_MAX]; if (logging) { memset(msgbuffer, 0, MSGSTRING_MAX); strcpy(msgbuffer, protname); strcat(msgbuffer, "; "); strcat(msgbuffer, entry->iface); sprintf(scratchpad, "; %u bytes;", entry->pkt_length); strcat(msgbuffer, scratchpad); if ((entry->smacaddr[0] != '\0') && (withmac)) { sprintf(scratchpad, " source MAC address %s;", entry->smacaddr); strcat(msgbuffer, scratchpad); } if (is_ip) { if (((entry->protocol == IPPROTO_UDP) && (!(entry->fragment))) || (entry->protocol == IPPROTO_TCP)) sprintf(scratchpad, " from %s:%s to %s:%s", entry->s_fqdn, entry->un.udp.s_sname, entry->d_fqdn, entry->un.udp.d_sname); else sprintf(scratchpad, " from %s to %s", entry->s_fqdn, entry->d_fqdn); } else sprintf(scratchpad, " from %s to %s ", entry->smacaddr, entry->dmacaddr); strcat(msgbuffer, scratchpad); strcpy(scratchpad, ""); if (strcmp(description, "") != 0) { sprintf(scratchpad, "; %s", description); strcat(msgbuffer, scratchpad); } strcpy(scratchpad, ""); if (strcmp(additional, "") != 0) { sprintf(scratchpad, " (%s)", additional); strcat(msgbuffer, scratchpad); } writelog(logging, fd, msgbuffer); } } void init_othp_table(struct othptable *table) { unsigned int winht; unsigned int wintop; unsigned int obmaxx __unused; winht = LINES - (LINES * 0.6) - 2; wintop = (LINES * 0.6) + 1; table->count = 0; table->lastpos = 0; table->strindex = 0; table->htstat = NOHTIND; table->head = table->tail = NULL; table->firstvisible = table->lastvisible = NULL; table->borderwin = newwin(winht, COLS, wintop, 0); table->borderpanel = new_panel(table->borderwin); wattrset(table->borderwin, BOXATTR); tx_box(table->borderwin, ACS_VLINE, ACS_HLINE); table->head = table->tail = NULL; table->othpwin = newwin(winht - 2, COLS - 2, wintop + 1, 1); table->othppanel = new_panel(table->othpwin); wattrset(table->othpwin, STDATTR); tx_colorwin(table->othpwin); update_panels(); doupdate(); tx_stdwinset(table->othpwin); getmaxyx(table->borderwin, table->obmaxy, obmaxx); table->oimaxy = table->obmaxy - 2; } void process_dest_unreach(struct tcptable *table, char *packet, char *ifname) { struct iphdr *ip; struct ip6_hdr *ip6; struct tcphdr *tcp; struct tcptableent *tcpentry; ip = (struct iphdr *) (packet + 8); /* * Timeout checking won't be performed either, so we just pass 0 * as timeout variable. */ if (ip->version == 6) { ip6 = (struct ip6_hdr *) (packet + 8); if (ip6->ip6_nxt != IPPROTO_TCP) return; tcp = (struct tcphdr *) (packet + 48); struct sockaddr_storage saddr, daddr; sockaddr_make_ipv6(&saddr, &ip6->ip6_src); sockaddr_set_port(&saddr, ntohs(tcp->source)); sockaddr_make_ipv6(&daddr, &ip6->ip6_dst); sockaddr_set_port(&daddr, ntohs(tcp->dest)); tcpentry = in_table(table, &saddr, &daddr, ifname, 0, NULL, 0); } else { if (ip->protocol != IPPROTO_TCP) return; tcp = (struct tcphdr *) (packet + 8 + (ip->ihl * 4)); struct sockaddr_storage saddr, daddr; sockaddr_make_ipv4(&saddr, ip->saddr); sockaddr_set_port(&saddr, ntohs(tcp->source)); sockaddr_make_ipv4(&daddr, ip->daddr); sockaddr_set_port(&daddr, ntohs(tcp->dest)); tcpentry = in_table(table, &saddr, &daddr, ifname, 0, NULL, 0); } if (tcpentry != NULL) { tcpentry->stat = tcpentry->oth_connection->stat = FLAG_RST; addtoclosedlist(table, tcpentry); } } struct othptabent *add_othp_entry(struct othptable *table, struct pkt_hdr *pkt, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, int is_ip, int protocol, char *packet2, char *ifname, int *rev_lookup, int rvnfd, int logging, FILE *logfile, int fragment) { struct othptabent *new_entry; struct othptabent *temp; new_entry = xmallocz(sizeof(struct othptabent)); new_entry->is_ip = is_ip; new_entry->fragment = fragment; if (options.mac || !is_ip) { if (pkt->pkt_hatype == ARPHRD_ETHER) { convmacaddr((char *) pkt->ethhdr->h_source, new_entry->smacaddr); convmacaddr((char *) pkt->ethhdr->h_dest, new_entry->dmacaddr); } else if (pkt->pkt_hatype == ARPHRD_FDDI) { convmacaddr((char *) pkt->fddihdr->saddr, new_entry->smacaddr); convmacaddr((char *) pkt->fddihdr->daddr, new_entry->dmacaddr); } } if (is_ip) { sockaddr_copy(&new_entry->saddr, saddr); sockaddr_copy(&new_entry->daddr, daddr); revname(rev_lookup, saddr, new_entry->s_fqdn, sizeof(new_entry->s_fqdn), rvnfd); revname(rev_lookup, daddr, new_entry->d_fqdn, sizeof(new_entry->d_fqdn), rvnfd); if (!fragment) { if (protocol == IPPROTO_ICMP) { new_entry->un.icmp.type = ((struct icmphdr *) packet2)->type; new_entry->un.icmp.code = ((struct icmphdr *) packet2)->code; } else if (protocol == IPPROTO_ICMPV6) { new_entry->un.icmp6.type = ((struct icmp6_hdr *) packet2)->icmp6_type; new_entry->un.icmp6.code = ((struct icmp6_hdr *) packet2)->icmp6_code; } else if (protocol == IPPROTO_UDP) { servlook(ntohs(((struct udphdr *) packet2)->source), IPPROTO_UDP, new_entry->un.udp.s_sname, 10); servlook(ntohs(((struct udphdr *) packet2)->dest), IPPROTO_UDP, new_entry->un.udp.d_sname, 10); } else if (protocol == IPPROTO_OSPFIGP) { new_entry->un.ospf.type = ((struct ospfhdr *) packet2)->ospf_type; new_entry->un.ospf.area = ntohl(((struct ospfhdr *) packet2)-> ospf_areaid.s_addr); inet_ntop(AF_INET, &((struct ospfhdr *)packet2)->ospf_routerid, new_entry->un.ospf.routerid, sizeof(new_entry->un.ospf.routerid)); } } } else { new_entry->linkproto = pkt->pkt_hatype; if (protocol == ETH_P_ARP) { new_entry->un.arp.opcode = ((struct arp_hdr *) packet2)->ar_op; memcpy(&(new_entry->un.arp.src_ip_address), &(((struct arp_hdr *) packet2)->ar_sip), 4); memcpy(&(new_entry->un.arp.dest_ip_address), &(((struct arp_hdr *) packet2)->ar_tip), 4); } else if (protocol == ETH_P_RARP) { new_entry->un.rarp.opcode = ((struct arphdr *) packet2)->ar_op; memcpy(&(new_entry->un.rarp.src_mac_address), &(((struct arp_hdr *) packet2)->ar_sha), 6); memcpy(&(new_entry->un.rarp.dest_mac_address), &(((struct arp_hdr *) packet2)->ar_tha), 6); } } new_entry->protocol = protocol; strcpy(new_entry->iface, ifname); new_entry->pkt_length = pkt->pkt_len; if (table->head == NULL) { new_entry->prev_entry = NULL; table->head = new_entry; table->firstvisible = new_entry; } /* * Max number of entries in the lower window is 512. Upon reaching * this figure, oldest entries are thrown out. */ if (table->count == 512) { if (table->firstvisible == table->head) { wscrl(table->othpwin, 1); printothpentry(table, table->lastvisible->next_entry, table->oimaxy - 1, logging, logfile); table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->lastvisible->next_entry; } temp = table->head; table->head = table->head->next_entry; table->head->prev_entry = NULL; free(temp); } else table->count++; if (table->tail != NULL) { new_entry->prev_entry = table->tail; table->tail->next_entry = new_entry; } table->tail = new_entry; new_entry->next_entry = NULL; table->lastpos++; new_entry->index = table->lastpos; if (table->count <= table->oimaxy) { table->lastvisible = new_entry; printothpentry(table, new_entry, table->count - 1, logging, logfile); } else if (table->lastvisible == table->tail->prev_entry) { wscrl(table->othpwin, 1); table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->tail; printothpentry(table, new_entry, table->oimaxy - 1, logging, logfile); } return new_entry; } /* * Function to retrieve non-IP packet tags. No further details are * provided beyond the type. */ static char *packetlookup(unsigned int protocol) { unsigned int i = 0; static struct packetstruct packettypes[] = { {"DEC MOP dump/load", 0x6001}, {"DEC MOP remote console", 0x6002}, {"DEC DECnet Phase IV", 0x6003}, {"DEC LAT", 0x6004}, {"DEC DECnet Diagnostics", 0x6005}, {"DEC DECnet Customer Use", 0x6006}, {"DEC DECnet SCA", 0x6007}, {"IPX", 0x8137}, {NULL, 0x0} }; while ((packettypes[i].packet_name != NULL) && (packettypes[i].protocol != protocol)) i++; return packettypes[i].packet_name; } void printothpentry(struct othptable *table, struct othptabent *entry, unsigned int target_row, int logging, FILE * logfile) { char protname[SHORTSTRING_MAX]; char description[SHORTSTRING_MAX]; char additional[MSGSTRING_MAX]; char msgstring[MSGSTRING_MAX]; char scratchpad[MSGSTRING_MAX]; char sp_buf[SHORTSTRING_MAX]; char *startstr; char *packet_type; struct in_addr uninitialized_var(saddr); char rarp_mac_addr[18]; unsigned int unknown = 0; struct protoent *protptr; sprintf(sp_buf, "%%%dc", COLS - 2); wmove(table->borderwin, table->obmaxy - 1, 1); if ((table->lastvisible == table->tail) && (table->htstat != TIND) && (table->count >= table->oimaxy)) { wprintw(table->borderwin, " Bottom "); table->htstat = TIND; } else if ((table->firstvisible == table->head) && (table->htstat != HIND)) { wprintw(table->borderwin, " Top "); table->htstat = HIND; } if (!(entry->is_ip)) { wmove(table->othpwin, target_row, 0); scrollok(table->othpwin, 0); wattrset(table->othpwin, UNKNATTR); wprintw(table->othpwin, sp_buf, ' '); scrollok(table->othpwin, 1); wmove(table->othpwin, target_row, 1); switch (entry->protocol) { case ETH_P_ARP: sprintf(msgstring, "ARP "); switch (ntohs(entry->un.arp.opcode)) { case ARPOP_REQUEST: strcat(msgstring, "request for "); memcpy(&(saddr.s_addr), entry->un.arp.dest_ip_address, 4); break; case ARPOP_REPLY: strcat(msgstring, "reply from "); memcpy(&(saddr.s_addr), entry->un.arp.src_ip_address, 4); break; } inet_ntop(AF_INET, &saddr, scratchpad, sizeof(scratchpad)); strcat(msgstring, scratchpad); wattrset(table->othpwin, ARPATTR); break; case ETH_P_RARP: sprintf(msgstring, "RARP "); memset(rarp_mac_addr, 0, sizeof(rarp_mac_addr)); switch (ntohs(entry->un.rarp.opcode)) { case ARPOP_RREQUEST: strcat(msgstring, "request for "); convmacaddr(entry->un.rarp.dest_mac_address, rarp_mac_addr); break; case ARPOP_RREPLY: strcat(msgstring, "reply from "); convmacaddr(entry->un.rarp.src_mac_address, rarp_mac_addr); break; } sprintf(scratchpad, rarp_mac_addr); strcat(msgstring, scratchpad); wattrset(table->othpwin, ARPATTR); break; default: packet_type = packetlookup(entry->protocol); if (packet_type == NULL) sprintf(msgstring, "Non-IP (0x%x)", entry->protocol); else sprintf(msgstring, "Non-IP (%s)", packet_type); wattrset(table->othpwin, UNKNATTR); } strcpy(protname, msgstring); sprintf(scratchpad, " (%u bytes)", entry->pkt_length); strcat(msgstring, scratchpad); if ((entry->linkproto == ARPHRD_ETHER) || (entry->linkproto == ARPHRD_FDDI)) { sprintf(scratchpad, " from %s to %s on %s", entry->smacaddr, entry->dmacaddr, entry->iface); strcat(msgstring, scratchpad); } startstr = msgstring + table->strindex; waddnstr(table->othpwin, startstr, COLS - 4); writeothplog(logging, logfile, protname, "", "", 0, 0, entry); return; } strcpy(additional, ""); strcpy(description, ""); switch (entry->protocol) { case IPPROTO_UDP: wattrset(table->othpwin, UDPATTR); strcpy(protname, "UDP"); break; case IPPROTO_ICMP: wattrset(table->othpwin, STDATTR); strcpy(protname, "ICMP"); break; case IPPROTO_OSPFIGP: wattrset(table->othpwin, OSPFATTR); strcpy(protname, "OSPF"); break; case IPPROTO_IGP: wattrset(table->othpwin, IGPATTR); strcpy(protname, "IGP"); break; case IPPROTO_IGMP: wattrset(table->othpwin, IGMPATTR); strcpy(protname, "IGMP"); break; case IPPROTO_IGRP: wattrset(table->othpwin, IGRPATTR); strcpy(protname, "IGRP"); break; case IPPROTO_GRE: wattrset(table->othpwin, GREATTR); strcpy(protname, "GRE"); break; case IPPROTO_ICMPV6: wattrset(table->othpwin, ICMPV6ATTR); strcpy(protname, "ICMPv6"); break; case IPPROTO_IPV6: wattrset(table->othpwin, IPV6ATTR); strcpy(protname, "IPv6 tun"); break; default: wattrset(table->othpwin, UNKNIPATTR); protptr = getprotobynumber(entry->protocol); if (protptr != NULL) { sprintf(protname, protptr->p_aliases[0]); } else { sprintf(protname, "IP protocol"); unknown = 1; } } if (!(entry->fragment)) { if (entry->protocol == IPPROTO_ICMP) { switch (entry->un.icmp.type) { case ICMP_ECHOREPLY: strcpy(description, "echo rply"); break; case ICMP_ECHO: strcpy(description, "echo req"); break; case ICMP_DEST_UNREACH: strcpy(description, "dest unrch"); switch (entry->un.icmp.code) { case ICMP_NET_UNREACH: strcpy(additional, "ntwk"); break; case ICMP_HOST_UNREACH: strcpy(additional, "host"); break; case ICMP_PROT_UNREACH: strcpy(additional, "proto"); break; case ICMP_PORT_UNREACH: strcpy(additional, "port"); break; case ICMP_FRAG_NEEDED: strcpy(additional, "DF set"); break; case ICMP_SR_FAILED: strcpy(additional, "src rte fail"); break; case ICMP_NET_UNKNOWN: strcpy(additional, "net unkn"); break; case ICMP_HOST_UNKNOWN: strcpy(additional, "host unkn"); break; case ICMP_HOST_ISOLATED: strcpy(additional, "src isltd"); break; case ICMP_NET_ANO: strcpy(additional, "net comm denied"); break; case ICMP_HOST_ANO: strcpy(additional, "host comm denied"); break; case ICMP_NET_UNR_TOS: strcpy(additional, "net unrch for TOS"); break; case ICMP_HOST_UNR_TOS: strcpy(additional, "host unrch for TOS"); break; case ICMP_PKT_FILTERED: strcpy(additional, "pkt fltrd"); break; case ICMP_PREC_VIOLATION: strcpy(additional, "prec violtn"); break; case ICMP_PREC_CUTOFF: strcpy(additional, "prec cutoff"); break; } break; case ICMP_SOURCE_QUENCH: strcpy(description, "src qnch"); break; case ICMP_REDIRECT: strcpy(description, "redirct"); break; case ICMP_TIME_EXCEEDED: strcpy(description, "time excd"); break; case ICMP_PARAMETERPROB: strcpy(description, "param prob"); break; case ICMP_TIMESTAMP: strcpy(description, "timestmp req"); break; case ICMP_INFO_REQUEST: strcpy(description, "info req"); break; case ICMP_INFO_REPLY: strcpy(description, "info rep"); break; case ICMP_ADDRESS: strcpy(description, "addr mask req"); break; case ICMP_ADDRESSREPLY: strcpy(description, "addr mask rep"); break; default: strcpy(description, "bad/unkn"); break; } } else if (entry->protocol == IPPROTO_ICMPV6) { switch (entry->un.icmp6.type) { case ICMP6_DST_UNREACH: strcpy(description, "dest unrch"); switch (entry->un.icmp6.code) { case ICMP6_DST_UNREACH_NOROUTE: strcpy(additional, "no route"); break; case ICMP6_DST_UNREACH_ADMIN: strcpy(additional, "admin"); break; #ifdef ICMP6_DST_UNREACH_NOTNEIGHBOR case ICMP6_DST_UNREACH_NOTNEIGHBOR: strcpy(additional, "not neigh"); #else case ICMP6_DST_UNREACH_BEYONDSCOPE: strcpy(additional, "not beyondsp"); #endif break; case ICMP6_DST_UNREACH_ADDR: strcpy(additional, "unreach addr"); break; case ICMP6_DST_UNREACH_NOPORT: strcpy(additional, "no port"); break; } break; case ICMP6_PACKET_TOO_BIG: strcpy(description, "pkt too big"); break; case ICMP6_TIME_EXCEEDED: strcpy(description, "time exceeded"); break; case ICMP6_PARAM_PROB: strcpy(description, "param prob"); break; case ICMP6_ECHO_REQUEST: strcpy(description, "echo req"); break; case ICMP6_ECHO_REPLY: strcpy(description, "echo rply"); break; case ND_ROUTER_SOLICIT: strcpy(description, "router sol"); break; case ND_ROUTER_ADVERT: strcpy(description, "router adv"); break; #ifdef ICMP6_MEMBERSHIP_QUERY case ICMP6_MEMBERSHIP_QUERY: strcpy(description, "mbrship query"); break; #endif #ifdef ICMP6_MEMBERSHIP_REPORT case ICMP6_MEMBERSHIP_REPORT: strcpy(description, "mbrship report"); break; #endif #ifdef ICMP6_MEMBERSHIP_REDUCTION case ICMP6_MEMBERSHIP_REDUCTION: strcpy(description, "mbrship reduc"); break; #endif case ND_NEIGHBOR_SOLICIT: strcpy(description, "neigh sol"); break; case ND_NEIGHBOR_ADVERT: strcpy(description, "neigh adv"); break; case ND_REDIRECT: strcpy(description, "redirect"); break; default: strcpy(description, "bad/unkn"); break; } } else if (entry->protocol == IPPROTO_OSPFIGP) { switch (entry->un.ospf.type) { case OSPF_TYPE_HELLO: strcpy(description, "hlo"); break; case OSPF_TYPE_DB: strcpy(description, "DB desc"); break; case OSPF_TYPE_LSR: strcpy(description, "LSR"); break; case OSPF_TYPE_LSU: strcpy(description, "LSU"); break; case OSPF_TYPE_LSA: strcpy(description, "LSA"); break; } sprintf(additional, "a=%lu r=%s", entry->un.ospf.area, entry->un.ospf.routerid); } } else strcpy(description, "fragment"); strcpy(msgstring, protname); strcat(msgstring, " "); if (strcmp(description, "") != 0) { strcat(msgstring, description); strcat(msgstring, " "); } if (strcmp(additional, "") != 0) { sprintf(scratchpad, "(%s) ", additional); strcat(msgstring, scratchpad); } if (unknown) { sprintf(scratchpad, "%u ", entry->protocol); strcat(msgstring, scratchpad); } sprintf(scratchpad, "(%u bytes) ", entry->pkt_length); strcat(msgstring, scratchpad); if ((entry->protocol == IPPROTO_UDP) && (!(entry->fragment))) { sprintf(scratchpad, "from %.40s:%s to %.40s:%s", entry->s_fqdn, entry->un.udp.s_sname, entry->d_fqdn, entry->un.udp.d_sname); } else { sprintf(scratchpad, "from %.40s to %.40s", entry->s_fqdn, entry->d_fqdn); } strcat(msgstring, scratchpad); if (((entry->smacaddr)[0] != '\0') && options.mac) { snprintf(scratchpad, MSGSTRING_MAX, " (src HWaddr %s)", entry->smacaddr); strcat(msgstring, scratchpad); } strcat(msgstring, " on "); strcat(msgstring, entry->iface); wmove(table->othpwin, target_row, 0); scrollok(table->othpwin, 0); wprintw(table->othpwin, sp_buf, ' '); scrollok(table->othpwin, 1); wmove(table->othpwin, target_row, 1); startstr = msgstring + table->strindex; waddnstr(table->othpwin, startstr, COLS - 4); if (logging) writeothplog(logging, logfile, protname, description, additional, 1, options.mac, entry); } void refresh_othwindow(struct othptable *table) { int target_row = 0; struct othptabent *entry; wattrset(table->othpwin, STDATTR); tx_colorwin(table->othpwin); entry = table->firstvisible; while ((entry != NULL) && (entry != table->lastvisible->next_entry)) { printothpentry(table, entry, target_row, 0, NULL); target_row++; entry = entry->next_entry; } update_panels(); doupdate(); } void destroyothptable(struct othptable *table) { struct othptabent *ctemp; struct othptabent *ctemp_next; if (table->head != NULL) { ctemp = table->head; ctemp_next = table->head->next_entry; while (ctemp != NULL) { free(ctemp); ctemp = ctemp_next; if (ctemp_next != NULL) ctemp_next = ctemp_next->next_entry; } } } iptraf-ng-1.1.4/src/othptab.h0000664000076400007640000000616012173477703016305 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_OTHPTAB_H #define IPTRAF_NG_OTHPTAB_H /*** othptab.h - header file for the non-TCP routines ***/ #include "packet.h" #define NONIP -1 #define IS_IP 1 #define NOT_IP 0 #define NOHTIND 0 /* Bottom or Top (head or tail) indicator printed */ #define TIND 1 /* Tail indicator printed */ #define HIND 2 /* Head indicator printed */ #define VSCRL_OFFSET 60 /* Characters to vertically scroll */ struct othptabent { struct sockaddr_storage saddr; struct sockaddr_storage daddr; char smacaddr[18]; /* FIXME: use dynamicly allocated space */ char dmacaddr[18]; unsigned short linkproto; char s_fqdn[100]; char d_fqdn[100]; int s_fstat; int d_fstat; unsigned int protocol; char iface[IFNAMSIZ]; unsigned int pkt_length; union { struct { char s_sname[15]; char d_sname[15]; } udp; struct { unsigned int type; unsigned int code; } icmp; struct { unsigned char type; unsigned long area; char routerid[16]; } ospf; struct { unsigned short opcode; char src_ip_address[4]; char dest_ip_address[4]; } arp; struct { unsigned short opcode; char src_mac_address[6]; char dest_mac_address[6]; } rarp; struct { uint8_t type; uint8_t code; } icmp6; } un; unsigned int type; unsigned int code; unsigned int index; int is_ip; int fragment; struct othptabent *prev_entry; struct othptabent *next_entry; }; struct othptable { struct othptabent *head; struct othptabent *tail; struct othptabent *firstvisible; struct othptabent *lastvisible; unsigned int count; unsigned int lastpos; unsigned int strindex; /* starting index of the string to display */ int htstat; unsigned int obmaxy; /* number of lines in the border window */ unsigned int oimaxy; /* number of lines inside the border */ WINDOW *othpwin; PANEL *othppanel; WINDOW *borderwin; PANEL *borderpanel; }; /* Added by David Harbaugh for Non-IP protocol identification */ struct packetstruct { char *packet_name; /* Name of packet type */ unsigned int protocol; /* Number of packet type */ }; /* partially stolen from ospf.h from tcpdump */ #define OSPF_TYPE_UMD 0 #define OSPF_TYPE_HELLO 1 #define OSPF_TYPE_DB 2 #define OSPF_TYPE_LSR 3 #define OSPF_TYPE_LSU 4 #define OSPF_TYPE_LSA 5 #define OSPF_TYPE_MAX 6 struct ospfhdr { u_char ospf_version; u_char ospf_type; u_short ospf_len; struct in_addr ospf_routerid; struct in_addr ospf_areaid; u_short ospf_chksum; u_short ospf_authtype; }; void init_othp_table(struct othptable *table); void process_dest_unreach(struct tcptable *table, char *packet, char *ifname); struct othptabent *add_othp_entry(struct othptable *table, struct pkt_hdr *pkt, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, int is_ip, int protocol, char *packet2, char *ifname, int *rev_lookup, int rvnamedon, int logging, FILE *logfile, int fragment); void printothpentry(struct othptable *table, struct othptabent *entry, unsigned int screen_idx, int logging, FILE * logfile); void refresh_othwindow(struct othptable *table); void destroyothptable(struct othptable *table); #endif /* IPTRAF_NG_OTHPTAB_H */ iptraf-ng-1.1.4/src/packet.c0000644000076400007640000001744712173477703016116 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** packet.c - routines to open the raw socket, read socket data and adjust the initial packet pointer ***/ #include "iptraf-ng-compat.h" #include "deskman.h" #include "error.h" #include "options.h" #include "fltdefs.h" #include "fltselect.h" #include "ipfilter.h" #include "ifaces.h" #include "packet.h" #include "ipfrag.h" #define pkt_cast_hdrp_l2off_t(hdr, pkt, off) \ do { \ pkt->hdr = (struct hdr *) (pkt->pkt_buf + off); \ } while (0) #define pkt_cast_hdrp_l2(hdr, pkt) \ pkt_cast_hdrp_l2off_t(hdr, pkt, 0) #define pkt_cast_hdrp_l3off_t(hdr, pkt, off) \ do { \ pkt->hdr = (struct hdr *) (pkt->pkt_payload + off); \ } while (0) #define pkt_cast_hdrp_l3(hdr, pkt) \ pkt_cast_hdrp_l3off_t(hdr, pkt, 0) /* code taken from http://www.faqs.org/rfcs/rfc1071.html. See section 4.1 "C" */ static int in_cksum(u_short * addr, int len) { register int sum = 0; while (len > 1) { sum += *(u_short *) addr++; len -= 2; } if (len > 0) sum += *(unsigned char *) addr; while (sum >> 16) sum = (sum & 0xffff) + (sum >> 16); return (u_short) (~sum); } static int packet_adjust(struct pkt_hdr *pkt) { int retval = 0; switch (pkt->pkt_hatype) { case ARPHRD_ETHER: case ARPHRD_LOOPBACK: pkt_cast_hdrp_l2(ethhdr, pkt); pkt->pkt_payload = pkt->pkt_buf; pkt->pkt_payload += ETH_HLEN; pkt->pkt_len -= ETH_HLEN; break; case ARPHRD_SLIP: case ARPHRD_CSLIP: case ARPHRD_SLIP6: case ARPHRD_CSLIP6: case ARPHRD_PPP: case ARPHRD_TUNNEL: case ARPHRD_SIT: case ARPHRD_NONE: case ARPHRD_IPGRE: pkt->pkt_payload = pkt->pkt_buf; break; case ARPHRD_FRAD: case ARPHRD_DLCI: pkt->pkt_payload = pkt->pkt_buf; pkt->pkt_payload += 4; pkt->pkt_len -= 4; break; case ARPHRD_FDDI: pkt_cast_hdrp_l2(fddihdr, pkt); pkt->pkt_payload = pkt->pkt_buf; pkt->pkt_payload += sizeof(struct fddihdr); pkt->pkt_len -= sizeof(struct fddihdr); break; default: /* return a NULL packet to signal an unrecognized link */ /* protocol to the caller. Hopefully, this switch statement */ /* will grow. */ pkt->pkt_payload = NULL; retval = -1; break; } return retval; } /* initialize all layer3 protocol pointers (we need to initialize all * of them, because of case we change pkt->pkt_protocol) */ static void packet_set_l3_hdrp(struct pkt_hdr *pkt) { switch (pkt->pkt_protocol) { case ETH_P_IP: pkt_cast_hdrp_l3(iphdr, pkt); pkt->ip6_hdr = NULL; break; case ETH_P_IPV6: pkt->iphdr = NULL; pkt_cast_hdrp_l3(ip6_hdr, pkt); break; default: pkt->iphdr = NULL; pkt->ip6_hdr = NULL; break; } } /* IPTraf input function; reads both keystrokes and network packets. */ int packet_get(int fd, struct pkt_hdr *pkt, int *ch, WINDOW *win) { struct pollfd pfds[2]; nfds_t nfds = 0; int ss; /* Monitor raw socket */ pfds[0].fd = fd; pfds[0].events = POLLIN; nfds++; /* Monitor stdin only if in interactive, not daemon mode. */ if (ch && !daemonized) { pfds[1].fd = 0; pfds[1].events = POLLIN; nfds++; } do { ss = poll(pfds, nfds, DEFAULT_UPDATE_DELAY); } while ((ss == -1) && (errno == EINTR)); PACKET_INIT_STRUCT(pkt); if ((ss > 0) && (pfds[0].revents & POLLIN) != 0) { struct sockaddr_ll from; struct iovec iov; struct msghdr msg; iov.iov_len = pkt->pkt_bufsize; iov.iov_base = pkt->pkt_buf; msg.msg_name = &from; msg.msg_namelen = sizeof(from); msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_control = NULL; msg.msg_controllen = 0; msg.msg_flags = 0; ssize_t len = recvmsg(fd, &msg, MSG_TRUNC | MSG_DONTWAIT); if (len > 0) { pkt->pkt_len = len; pkt->pkt_caplen = len; if (pkt->pkt_caplen > pkt->pkt_bufsize) pkt->pkt_caplen = pkt->pkt_bufsize; pkt->pkt_payload = NULL; pkt->pkt_protocol = ntohs(from.sll_protocol); pkt->pkt_ifindex = from.sll_ifindex; pkt->pkt_hatype = from.sll_hatype; pkt->pkt_pkttype = from.sll_pkttype; } else ss = len; } if (ch) { *ch = ERR; /* signalize we have no key ready */ if (!daemonized && (ss > 0) && ((pfds[1].revents & POLLIN) != 0)) *ch = wgetch(win); } return ss; } int packet_process(struct pkt_hdr *pkt, unsigned int *total_br, in_port_t *sport, in_port_t *dport, int match_opposite, int v6inv4asv6) { /* move packet pointer (pkt->pkt_payload) past data link header */ if (packet_adjust(pkt) != 0) return INVALID_PACKET; again: packet_set_l3_hdrp(pkt); switch (pkt->pkt_protocol) { case ETH_P_IP: { struct iphdr *ip = pkt->iphdr; int hdr_check; register int ip_checksum; in_port_t f_sport = 0, f_dport = 0; /* * Compute and verify IP header checksum. */ ip_checksum = ip->check; ip->check = 0; hdr_check = in_cksum((u_short *) pkt->iphdr, pkt_iph_len(pkt)); if ((hdr_check != ip_checksum)) return CHECKSUM_ERROR; if ((ip->protocol == IPPROTO_TCP || ip->protocol == IPPROTO_UDP) && (sport != NULL && dport != NULL)) { in_port_t sport_tmp, dport_tmp; /* * Process TCP/UDP fragments */ if ((ntohs(ip->frag_off) & 0x3fff) != 0) { int firstin; /* * total_br contains total byte count of all fragments * not yet retrieved. Will differ only if fragments * arrived before the first fragment, in which case * the total accumulated fragment sizes will be returned * once the first fragment arrives. */ if (total_br != NULL) *total_br = processfragment(ip, &sport_tmp, &dport_tmp, &firstin); if (!firstin) return MORE_FRAGMENTS; } else { struct tcphdr *tcp; struct udphdr *udp; char *ip_payload = (char *) ip + pkt_iph_len(pkt); switch (ip->protocol) { case IPPROTO_TCP: tcp = (struct tcphdr *) ip_payload; sport_tmp = ntohs(tcp->source); dport_tmp = ntohs(tcp->dest); break; case IPPROTO_UDP: udp = (struct udphdr *) ip_payload; sport_tmp = ntohs(udp->source); dport_tmp = ntohs(udp->dest); break; default: sport_tmp = 0; dport_tmp = 0; break; } if (total_br != NULL) *total_br = pkt->pkt_len; } if (sport != NULL) *sport = sport_tmp; if (dport != NULL) *dport = dport_tmp; f_sport = sport_tmp; f_dport = dport_tmp; } /* Process IP filter */ if ((ofilter.filtercode != 0) && (!ipfilter (ip->saddr, ip->daddr, f_sport, f_dport, ip->protocol, match_opposite))) return PACKET_FILTERED; if (v6inv4asv6 && (ip->protocol == IPPROTO_IPV6)) { pkt->pkt_protocol = ETH_P_IPV6; pkt->pkt_payload += pkt_iph_len(pkt); pkt->pkt_len -= pkt_iph_len(pkt); goto again; } break; } case ETH_P_IPV6: { struct tcphdr *tcp; struct udphdr *udp; struct ip6_hdr *ip6 = pkt->ip6_hdr; char *ip_payload = (char *) ip6 + pkt_iph_len(pkt); //TODO: Filter packets switch (pkt_ip_protocol(pkt)) { case IPPROTO_TCP: tcp = (struct tcphdr *) ip_payload; if (sport) *sport = ntohs(tcp->source); if (dport) *dport = ntohs(tcp->dest); break; case IPPROTO_UDP: udp = (struct udphdr *) ip_payload; if (sport) *sport = ntohs(udp->source); if (dport) *dport = ntohs(udp->dest); break; default: if (sport) *sport = 0; if (dport) *dport = 0; break; } break; } case ETH_P_8021Q: case ETH_P_QINQ1: /* ETH_P_QINQx are not officially */ case ETH_P_QINQ2: /* registered IDs */ case ETH_P_QINQ3: case ETH_P_8021AD: /* strip 802.1Q/QinQ/802.1ad VLAN header */ pkt->pkt_payload += 4; pkt->pkt_len -= 4; /* update network protocol */ pkt->pkt_protocol = ntohs(*((unsigned short *) pkt->pkt_payload)); goto again; default: /* not IPv4 and not IPv6: apply non-IP packet filter */ if (!nonipfilter(pkt->pkt_protocol)) { return PACKET_FILTERED; } } return PACKET_OK; } void pkt_cleanup(void) { destroyfraglist(); } iptraf-ng-1.1.4/src/packet.h0000664000076400007640000000415012173477703016110 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_PACKET_H #define IPTRAF_NG_PACKET_H /*** packet.h - external declarations for packet.c ***/ /* * Number of bytes from captured packet to move into a buffer. * 96 bytes should be enough for the IP header, TCP/UDP/ICMP/whatever header * with reasonable numbers of options. */ #define MAX_PACKET_SIZE 96 #define INVALID_PACKET 0 #define PACKET_OK 1 #define CHECKSUM_ERROR 2 #define PACKET_FILTERED 3 #define MORE_FRAGMENTS 4 struct pkt_hdr { size_t pkt_bufsize; char *pkt_payload; size_t pkt_caplen; /* bytes captured */ size_t pkt_len; /* bytes on-the-wire */ int pkt_ifindex; /* Interface number */ unsigned short pkt_protocol; /* Physical layer protocol: ETH_P_* */ unsigned short pkt_hatype; /* Header type: ARPHRD_* */ unsigned char pkt_pkttype; /* Packet type: PACKET_OUTGOING, PACKET_BROADCAST, ... */ unsigned char pkt_halen; /* Length of address */ unsigned char pkt_addr[8]; /* Physical layer address */ struct ethhdr *ethhdr; struct fddihdr *fddihdr; struct iphdr *iphdr; struct ip6_hdr *ip6_hdr; char pkt_buf[MAX_PACKET_SIZE]; }; static inline void PACKET_INIT_STRUCT(struct pkt_hdr *p) { p->pkt_bufsize = MAX_PACKET_SIZE; p->pkt_payload = NULL; p->ethhdr = NULL; p->fddihdr = NULL; p->iphdr = NULL; p->ip6_hdr = NULL; p->pkt_len = 0; /* signalize we have no packet prepared */ } #define PACKET_INIT(packet) \ struct pkt_hdr packet; \ PACKET_INIT_STRUCT(&packet) static inline __u8 pkt_iph_len(const struct pkt_hdr *pkt) { switch (pkt->pkt_protocol) { case ETH_P_IP: return pkt->iphdr->ihl * 4; case ETH_P_IPV6: return 40; default: return 0; } } static inline __u8 pkt_ip_protocol(const struct pkt_hdr *p) { switch (p->pkt_protocol) { case ETH_P_IP: return p->iphdr->protocol; case ETH_P_IPV6: return p->ip6_hdr->ip6_nxt; /* FIXME: extension headers ??? */ }; return 0; } int packet_get(int fd, struct pkt_hdr *pkt, int *ch, WINDOW *win); int packet_process(struct pkt_hdr *pkt, unsigned int *total_br, in_port_t *sport, in_port_t *dport, int match_opposite, int v6inv4asv6); void pkt_cleanup(void); #endif /* IPTRAF_NG_PACKET_H */ iptraf-ng-1.1.4/src/parse-options.c0000664000076400007640000000645412173477703017450 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" #include "parse-options.h" static int parse_opt_size(const struct options *opt) { unsigned size = 1; for (; opt->type != OPTION_END; opt++) size++; return size; } #define USAGE_OPTS_WIDTH 24 #define USAGE_GAP 2 void __noreturn parse_usage_and_die(const char *const *usage, const struct options *opt) { fprintf(stderr, "usage: %s\n", *usage++); while (*usage && **usage) fprintf(stderr, " or: %s\n", *usage++); if (opt->type != OPTION_GROUP) fputc('\n', stderr); for (; opt->type != OPTION_END; opt++) { size_t pos; int pad; if (opt->type == OPTION_GROUP) { fputc('\n', stderr); if (*opt->help) fprintf(stderr, "%s\n", opt->help); continue; } pos = fprintf(stderr, " "); if (opt->short_name) pos += fprintf(stderr, "-%c", opt->short_name); if (opt->short_name && opt->long_name) pos += fprintf(stderr, ", "); if (opt->long_name) pos += fprintf(stderr, "--%s", opt->long_name); if (opt->argh) pos += fprintf(stderr, " <%s>", opt->argh); if (pos <= USAGE_OPTS_WIDTH) pad = USAGE_OPTS_WIDTH - pos; else { fputc('\n', stderr); pad = USAGE_OPTS_WIDTH; } fprintf(stderr, "%*s%s\n", pad + USAGE_GAP, "", opt->help); } fputc('\n', stderr); exit(1); } static int get_value(const struct options *opt) { char *s = NULL; switch (opt->type) { case OPTION_BOOL: *(int *) opt->value += 1; break; case OPTION_INTEGER: *(int *) opt->value = strtol(optarg, (char **) &s, 10); if (*s) { error("invalid number -- %s", s); return -1; } break; case OPTION_STRING: if (optarg) *(char **) opt->value = (char *) optarg; break; case OPTION_GROUP: case OPTION_END: break; } return 0; } void parse_opts(int argc, char **argv, const struct options *opt, const char *const usage[]) { int size = parse_opt_size(opt); int nr = 0, alloc = 0; char *shortopts = NULL; struct option *longopts = xmallocz(sizeof(longopts[0]) * (size + 2)); const struct options *curopt = opt; struct option *curlongopts = longopts; for (; curopt->type != OPTION_END; curopt++, curlongopts++) { curlongopts->name = curopt->long_name; switch (curopt->type) { case OPTION_BOOL: curlongopts->has_arg = no_argument; if (curopt->short_name) { ALLOC_GROW(shortopts, nr + 1, alloc); shortopts[nr++] = curopt->short_name; } break; case OPTION_INTEGER: case OPTION_STRING: curlongopts->has_arg = required_argument; if (curopt->short_name) { ALLOC_GROW(shortopts, nr + 2, alloc); shortopts[nr++] = curopt->short_name; shortopts[nr++] = ':'; } break; case OPTION_GROUP: case OPTION_END: break; } curlongopts->flag = 0; curlongopts->val = curopt->short_name; } while (1) { curopt = opt; int c = getopt_long(argc, argv, shortopts, longopts, NULL); if (c == -1) break; if (c == '?') { free(longopts); free(shortopts); parse_usage_and_die(usage, opt); } for (; curopt->type != OPTION_END; curopt++) { if (curopt->short_name != c) continue; /* for now it fails only when string is badly converted */ if (get_value(curopt) < 0) parse_usage_and_die(usage, opt); } } free(longopts); free(shortopts); } iptraf-ng-1.1.4/src/parse-options.h0000644000076400007640000000222112173477703017437 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_PARSE_OPTIONS_H #define IPTRAF_NG_PARSE_OPTIONS_H enum parse_opt_type { OPTION_BOOL, OPTION_GROUP, OPTION_STRING, OPTION_INTEGER, OPTION_END, }; struct options { enum parse_opt_type type; int short_name; const char *long_name; void *value; const char *argh; const char *help; }; /* * s - short_name * l - long_name * v - value * a - argh argument help * h - help */ #define OPT_END() { OPTION_END, 0, NULL, NULL, NULL, NULL } #define OPT_BOOL(s, l, v, h) { OPTION_BOOL, (s), (l), (v), NULL, (h) } #define OPT_GROUP(h) { OPTION_GROUP, 0, NULL, NULL, NULL, (h) } #define OPT_INTEGER(s, l, v, h) { OPTION_INTEGER, (s), (l), (v), "n", (h) } #define OPT_STRING(s, l, v, a, h) { OPTION_STRING, (s), (l), (v), (a), (h) } #define OPT__VERBOSE(v) OPT_BOOL('v', "verbose", (v), "be verbose") #define OPT__HELP(v) OPT_BOOL('h', "help", (v), "show this help message") void parse_opts(int argc, char **argv, const struct options *opt, const char *const usage[]); void parse_usage_and_die(const char *const *usage, const struct options *opt); #endif /* IPTRAF_NG_PARSE_OPTIONS_H */ iptraf-ng-1.1.4/src/parseproto.c0000664000076400007640000000632512173477703017040 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /* * parseports.c - code to extract the protocol codes or ranges thereof from * the user-defined string. * */ #include "iptraf-ng-compat.h" #include "parseproto.h" /* * Extracts next token from the buffer. */ static char *get_next_token(char **cptr) { static char rtoken[32]; int i; i = 0; skip_whitespace(*cptr); if (**cptr == ',' || **cptr == '-') { rtoken[0] = **cptr; rtoken[1] = '\0'; (*cptr)++; } else { while (!isspace(**cptr) && **cptr != '-' && **cptr != ',' && **cptr != '\0') { rtoken[i] = **cptr; (*cptr)++; i++; } rtoken[i] = '\0'; } return rtoken; } void get_next_protorange(char **cptr, unsigned int *proto1, unsigned int *proto2, int *parse_result, char **badtokenptr) { char toktmp[5]; char prototmp1[5]; char prototmp2[5]; char *cerr_ptr; static char bad_token[5]; unsigned int tmp; memset(toktmp, 0, 5); memset(prototmp1, 0, 5); memset(prototmp2, 0, 5); memset(bad_token, 0, 5); strncpy(prototmp1, get_next_token(cptr), 5); if (prototmp1[0] == '\0') { *parse_result = NO_MORE_TOKENS; return; } strncpy(toktmp, get_next_token(cptr), 5); *parse_result = RANGE_OK; switch (toktmp[0]) { case '-': strncpy(prototmp2, get_next_token(cptr), 5); /* * Check for missing right-hand token for - */ if (prototmp2[0] == '\0') { *parse_result = INVALID_RANGE; strcpy(bad_token, "-"); *badtokenptr = bad_token; break; } *proto2 = (unsigned int) strtoul(prototmp2, &cerr_ptr, 10); /* * First check for an invalid character */ if (*cerr_ptr != '\0') { *parse_result = INVALID_RANGE; strncpy(bad_token, prototmp2, 5); *badtokenptr = bad_token; } else { /* * Then check for the validity of the token */ if (*proto2 > 255) { strncpy(bad_token, prototmp2, 5); *badtokenptr = bad_token; *parse_result = OUT_OF_RANGE; } /* * Then check if the next token is a comma */ strncpy(toktmp, get_next_token(cptr), 5); if (toktmp[0] != '\0' && toktmp[0] != ',') { *parse_result = COMMA_EXPECTED; strncpy(bad_token, toktmp, 5); *badtokenptr = bad_token; } } break; case ',': case '\0': *proto2 = 0; break; default: *parse_result = COMMA_EXPECTED; strncpy(bad_token, toktmp, 5); *badtokenptr = bad_token; break; } if (*parse_result != RANGE_OK) return; *proto1 = (unsigned int) strtoul(prototmp1, &cerr_ptr, 10); if (*cerr_ptr != '\0') { *parse_result = INVALID_RANGE; strncpy(bad_token, prototmp1, 5); *badtokenptr = bad_token; } else if (*proto1 > 255) { *parse_result = OUT_OF_RANGE; strncpy(bad_token, prototmp1, 5); *badtokenptr = bad_token; } else *badtokenptr = NULL; if (*proto2 != 0 && *proto1 > *proto2) { tmp = *proto1; *proto1 = *proto2; *proto2 = tmp; } } int validate_ranges(char *samplestring, int *parse_result, char **badtokenptr) { unsigned int proto1, proto2; char *cptr = samplestring; do { get_next_protorange(&cptr, &proto1, &proto2, parse_result, badtokenptr); } while (*parse_result == RANGE_OK); if (*parse_result != NO_MORE_TOKENS) return 0; return 1; } iptraf-ng-1.1.4/src/parseproto.h0000664000076400007640000000067612173477703017050 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_PARSEPROTO_H #define IPTRAF_NG_PARSEPROTO_H #define RANGE_OK 0 #define COMMA_EXPECTED 1 #define INVALID_RANGE 2 #define OUT_OF_RANGE 4 #define NO_MORE_TOKENS 5 void get_next_protorange(char **cptr, unsigned int *proto1, unsigned int *proto2, int *parse_result, char **badtokenptr); int validate_ranges(char *src, int *parse_result, char **bptr); #endif /* IPTRAF_NG_PARSEPROTO_H */ iptraf-ng-1.1.4/src/pktsize.c0000664000076400007640000001612012173477703016325 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** pktsize.c - the packet size breakdown facility ***/ #include "iptraf-ng-compat.h" #include "tui/winops.h" #include "attrs.h" #include "dirs.h" #include "fltdefs.h" #include "ifaces.h" #include "packet.h" #include "deskman.h" #include "error.h" #include "pktsize.h" #include "options.h" #include "timer.h" #include "log.h" #include "logvars.h" #include "promisc.h" struct ifstat_brackets { unsigned int floor; unsigned int ceil; unsigned long count; }; static void rotate_size_log(int s __unused) { rotate_flag = 1; strcpy(target_logname, current_logfile); signal(SIGUSR1, rotate_size_log); } static void write_size_log(struct ifstat_brackets *brackets, unsigned long nsecs, char *ifname, unsigned int mtu, FILE *logfile) { char atime[TIME_TARGET_MAX]; int i; genatime(time(NULL), atime); fprintf(logfile, "*** Packet Size Distribution, generated %s\n\n", atime); fprintf(logfile, "Interface: %s MTU: %u\n\n", ifname, mtu); fprintf(logfile, "Packet Size (bytes)\tCount\n"); for (i = 0; i <= 19; i++) { fprintf(logfile, "%u to %u:\t\t%lu\n", brackets[i].floor, brackets[i].ceil, brackets[i].count); } fprintf(logfile, "\nRunning time: %lu seconds\n", nsecs); fflush(logfile); } static int initialize_brackets(struct ifstat_brackets *brackets, unsigned int *interval, int mtu, WINDOW *win) { int i; *interval = mtu / 20; /* There are 20 packet size brackets */ for (i = 0; i <= 19; i++) { brackets[i].floor = *interval * i + 1; brackets[i].ceil = *interval * (i + 1); brackets[i].count = 0; } brackets[19].ceil = mtu; for (i = 0; i <= 9; i++) { wattrset(win, STDATTR); wmove(win, i + 5, 2); wprintw(win, "%4u to %4u:", brackets[i].floor, brackets[i].ceil); wmove(win, i + 5, 23); wattrset(win, HIGHATTR); wprintw(win, "%8lu", 0); } for (i = 10; i <= 19; i++) { wattrset(win, STDATTR); wmove(win, (i - 10) + 5, 36); if (i != 19) wprintw(win, "%4u to %4u:", brackets[i].floor, brackets[i].ceil); else wprintw(win, "%4u to %4u+:", brackets[i].floor, brackets[i].ceil); wmove(win, (i - 10) + 5, 57); wattrset(win, HIGHATTR); wprintw(win, "%8lu", 0); } wattrset(win, STDATTR); mvwprintw(win, 17, 1, "Interface MTU is %d bytes, not counting the data-link header", mtu); mvwprintw(win, 18, 1, "Maximum packet size is the MTU plus the data-link header length"); mvwprintw(win, 19, 1, "Packet size computations include data-link headers, if any"); return 0; } static void update_size_distrib(unsigned int length, struct ifstat_brackets *brackets, unsigned int interval) { unsigned int i; i = (length - 1) / interval; /* minus 1 to keep interval boundary lengths within the proper brackets */ if (i > 19) /* This is for extras for MTU's not */ i = 19; /* divisible by 20 */ brackets[i].count++; } static void print_size_distrib(struct ifstat_brackets *brackets, WINDOW *win) { for (unsigned int i = 0; i <= 19; i++) { if (i < 10) wmove(win, i + 5, 23); else wmove(win, (i - 10) + 5, 57); wprintw(win, "%8lu", brackets[i].count); } } void packet_size_breakdown(char *ifname, time_t facilitytime) { WINDOW *win; PANEL *panel; WINDOW *borderwin; PANEL *borderpanel; struct ifstat_brackets brackets[20]; unsigned int interval; int ch; int mtu; int pkt_result; struct timeval tv; time_t starttime, startlog, timeint; time_t now; struct timeval updtime; int logging = options.logging; FILE *logfile = NULL; int fd; if (!dev_up(ifname)) { err_iface_down(); goto err_unmark; } mtu = dev_get_mtu(ifname); if (mtu < 0) { write_error("Unable to obtain interface MTU"); goto err_unmark; } borderwin = newwin(LINES - 2, COLS, 1, 0); borderpanel = new_panel(borderwin); wattrset(borderwin, BOXATTR); tx_box(borderwin, ACS_VLINE, ACS_HLINE); mvwprintw(borderwin, 0, 1, " Packet Distribution by Size "); win = newwin(LINES - 4, COLS - 2, 2, 1); panel = new_panel(win); tx_stdwinset(win); wtimeout(win, -1); wattrset(win, STDATTR); tx_colorwin(win); move(LINES - 1, 1); stdexitkeyhelp(); initialize_brackets(brackets, &interval, mtu, win); mvwprintw(win, 1, 1, "Packet size brackets for interface %s", ifname); wattrset(win, BOXATTR); mvwprintw(win, 4, 1, "Packet Size (bytes)"); mvwprintw(win, 4, 26, "Count"); mvwprintw(win, 4, 36, "Packet Size (bytes)"); mvwprintw(win, 4, 60, "Count"); wattrset(win, HIGHATTR); if (logging) { if (strcmp(current_logfile, "") == 0) { snprintf(current_logfile, 80, "%s-%s.log", PKTSIZELOG, ifname); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_size_log); rotate_flag = 0; writelog(logging, logfile, "******** Packet size distribution facility started ********"); } exitloop = 0; gettimeofday(&tv, NULL); updtime = tv; now = starttime = startlog = timeint = tv.tv_sec; LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, ifname); promisc_set_list(&promisc); } fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(dev_bind_ifname(fd, ifname) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } PACKET_INIT(pkt); do { gettimeofday(&tv, NULL); now = tv.tv_sec; if (screen_update_needed(&tv, &updtime)) { print_size_distrib(brackets, win); update_panels(); doupdate(); updtime = tv; } if (now - timeint >= 5) { printelapsedtime(starttime, now, LINES - 3, 1, borderwin); timeint = now; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { write_size_log(brackets, now - starttime, ifname, mtu, logfile); startlog = now; } } if ((facilitytime != 0) && (((now - starttime) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, win) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch != ERR) { switch (ch) { case 12: case 'l': case 'L': tx_refresh_screen(); break; case 'x': case 'X': case 'q': case 'Q': case 27: case 24: exitloop = 1; } } if (pkt.pkt_len <= 0) continue; pkt_result = packet_process(&pkt, NULL, NULL, NULL, MATCH_OPPOSITE_USECONFIG, 0); if (pkt_result != PACKET_OK) continue; update_size_distrib(pkt.pkt_len, brackets, interval); } while (!exitloop); err_close: close(fd); err: if (logging) { signal(SIGUSR1, SIG_DFL); write_size_log(brackets, now - starttime, ifname, mtu, logfile); writelog(logging, logfile, "******** Packet size distribution facility stopped ********"); fclose(logfile); } if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } del_panel(panel); delwin(win); del_panel(borderpanel); delwin(borderwin); err_unmark: strcpy(current_logfile, ""); } iptraf-ng-1.1.4/src/pktsize.h0000664000076400007640000000023112173477703016326 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_PKTSIZE_H #define IPTRAF_NG_PKTSIZE_H void packet_size_breakdown(char *iface, time_t facilitytime); #endif /* IPTRAF_NG_PKTSIZE_H */ iptraf-ng-1.1.4/src/promisc.c0000664000076400007640000000347412173477703016320 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** promisc.c - handles the promiscuous mode flag for the Ethernet/FDDI/ Token Ring interfaces ***/ #include "iptraf-ng-compat.h" #include "ifaces.h" #include "error.h" #include "promisc.h" static void promisc_add_dev(struct list_head *promisc, const char *dev_name) { struct promisc_list *p = xmallocz(sizeof(*p)); strcpy(p->ifname, dev_name); INIT_LIST_HEAD(&p->list); list_add_tail(&p->list, promisc); } void promisc_init(struct list_head *promisc, const char *device_name) { if (device_name) { int flags = dev_promisc_flag(device_name); if (flags < 0) return; promisc_add_dev(promisc, device_name); return; } FILE *fp = open_procnetdev(); if (!fp) die_errno("%s: open_procnetdev", __func__); char dev_name[IFNAMSIZ]; while (get_next_iface(fp, dev_name, sizeof(dev_name))) { if (!strcmp(dev_name, "")) continue; int flags = dev_promisc_flag(dev_name); if (flags < 0) continue; promisc_add_dev(promisc, dev_name); } fclose(fp); } void promisc_set_list(struct list_head *promisc) { struct promisc_list *entry = NULL; list_for_each_entry(entry, promisc, list) { int r = dev_set_promisc(entry->ifname); if (r < 0) write_error("Failed to set promiscuous mode on %s", entry->ifname); } } void promisc_restore_list(struct list_head *promisc) { struct promisc_list *entry = NULL; list_for_each_entry(entry, promisc, list) { int r = dev_clr_promisc(entry->ifname); if (r < 0) write_error("Failed to clear promiscuous mode on %s", entry->ifname); } } void promisc_destroy(struct list_head *promisc) { struct promisc_list *entry, *tmp; list_for_each_entry_safe(entry, tmp, promisc, list) { list_del(&entry->list); free(entry); } } iptraf-ng-1.1.4/src/promisc.h0000664000076400007640000000063112173477703016315 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_PROMISC_H #define IPTRAF_NG_PROMISC_H #include "list.h" struct promisc_list { struct list_head list; char ifname[IFNAMSIZ]; }; void promisc_init(struct list_head *promisc, const char *device_name); void promisc_destroy(struct list_head *promisc); void promisc_set_list(struct list_head *promisc); void promisc_restore_list(struct list_head *promisc); #endif /* IPTRAF_NG_PROMISC_H */ iptraf-ng-1.1.4/src/rate.c0000664000076400007640000000460212173477703015571 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" #include "options.h" #include "rate.h" void rate_init(struct rate *rate) { if (!rate) return; rate->index = 0; rate->sma = 0; memset(rate->rates, 0, rate->n * sizeof(rate->rates[0])); } void rate_alloc(struct rate *rate, unsigned int n) { if (!rate) return; rate->n = n; rate->rates = xmalloc(n * sizeof(rate->rates[0])); rate_init(rate); } void rate_destroy(struct rate *rate) { if (!rate) return; rate->n = 0; if (!rate->rates) return; free(rate->rates); rate->rates = NULL; } void rate_add_rate(struct rate *rate, unsigned long bytes, unsigned long msecs) { if (!rate) return; rate->rates[rate->index] = bytes * 1000ULL / msecs; if ((rate->index + 1) >= rate->n) rate->index = 0; else rate->index++; /* compute the moving average */ unsigned long long sum = 0; for(unsigned int i = 0; i < rate->n; i++) sum += rate->rates[i]; rate->sma = sum / rate->n; } unsigned long rate_get_average(struct rate *rate) { if (rate) return rate->sma; else return 0UL; } int rate_print(unsigned long rate, char *buf, unsigned n) { char *suffix[] = { "k", "M", "G", "T", "P", "E", "Z", "Y" }; unsigned n_suffix = ARRAY_SIZE(suffix); int chars; if (options.actmode == KBITS) { unsigned long tmp = rate; unsigned int i = 0; unsigned long divider = 1000; rate *= 8; while(tmp >= 100000000) { tmp /= 1000; i++; divider *= 1000; } if (i >= n_suffix) chars = snprintf(buf, n, "error"); else chars = snprintf(buf, n, "%9.2f %sbps", (double)rate / divider, suffix[i]); } else { unsigned int i = 0; while(rate > 99 * (1UL << 20)) { rate >>= 10; i++; } if (i >= n_suffix) chars = snprintf(buf, n, "error"); else chars = snprintf(buf, n, "%9.2f %sBps", (double)rate / 1024, suffix[i]); } buf[n - 1] = '\0'; return chars; } int rate_print_no_units(unsigned long rate, char *buf, unsigned n) { int chars; if (options.actmode == KBITS) { chars = snprintf(buf, n, "%8.1f", (double)rate * 8 / 1000); } else { chars = snprintf(buf, n, "%8.1f", (double)rate / 1024); } buf[n - 1] = '\0'; return chars; } int rate_print_pps(unsigned long rate, char *buf, unsigned n) { int chars; chars = snprintf(buf, n, "%9lu pps", rate); buf[n - 1] = '\0'; return chars; } iptraf-ng-1.1.4/src/rate.h0000664000076400007640000000201312173477703015570 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_RATE_H #define IPTRAF_NG_RATE_H #include /* SMA = Simple Moving Average */ /* * SMA = (p(M) + p(M-1) + ... + p(M-n-1)) / n * * or * * SMA = last_SMA - (p(M-n) / n) + (p(M) / n) * * I choose the first one because there is smaller rounding * error when using integer divide. */ struct rate { unsigned int n; /* number of elements */ unsigned int index; /* index into the values array */ unsigned long long *rates; /* units are: bytes per second */ unsigned long sma; /* simple moving average */ }; void rate_init(struct rate *rate); void rate_alloc(struct rate *rate, unsigned int n); void rate_destroy(struct rate *rate); void rate_add_rate(struct rate *rate, unsigned long bytes, unsigned long msecs); unsigned long rate_get_average(struct rate *rate); int rate_print(unsigned long rate, char *buf, unsigned n); int rate_print_no_units(unsigned long rate, char *buf, unsigned n); int rate_print_pps(unsigned long rate, char *buf, unsigned n); #endif /* IPTRAF_NG_RATE_H */ iptraf-ng-1.1.4/src/revname.c0000664000076400007640000001043412173477703016273 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** revname.c - reverse DNS resolution module for IPTraf. As of IPTraf 1.1, this module now communicates with the rvnamed process to resolve in the background while allowing the foreground process to continue with the interim IP addresses in the meantime. ***/ #include "iptraf-ng-compat.h" #include "deskman.h" #include "getpath.h" #include "revname.h" #include "rvnamed.h" #include "sockaddr.h" char revname_socket[80]; static char *gen_unix_sockname(void) { static char scratch[80]; srandom(time(NULL)); snprintf(scratch, 80, "%s-%lu%d%ld", SOCKET_PREFIX, time(NULL), getpid(), random()); return scratch; } int rvnamedactive(void) { int fd; fd_set sockset; struct rvn rpkt; struct sockaddr_un su; int sstat; struct timeval tv; socklen_t fr; int br; char unix_socket[80]; strncpy(unix_socket, get_path(T_WORKDIR, gen_unix_sockname()), 80); unlink(unix_socket); fd = socket(PF_UNIX, SOCK_DGRAM, 0); su.sun_family = AF_UNIX; strcpy(su.sun_path, unix_socket); bind(fd, (struct sockaddr *) &su, sizeof(su.sun_family) + strlen(su.sun_path)); su.sun_family = AF_UNIX; strcpy(su.sun_path, IPTSOCKNAME); rpkt.type = RVN_HELLO; sendto(fd, &rpkt, sizeof(struct rvn), 0, (struct sockaddr *) &su, sizeof(su.sun_family) + strlen(su.sun_path)); tv.tv_sec = 1; tv.tv_usec = 0; FD_ZERO(&sockset); FD_SET(fd, &sockset); do { sstat = select(fd + 1, &sockset, NULL, NULL, &tv); } while ((sstat < 0) && (errno != ENOMEM) && (errno == EINTR)); if (sstat == 1) { fr = sizeof(su.sun_family) + strlen(su.sun_path); do { br = recvfrom(fd, &rpkt, sizeof(struct rvn), 0, (struct sockaddr *) &su, &fr); } while ((br < 0) && (errno == EINTR)); if (br < 0) printipcerr(); } close(fd); unlink(unix_socket); if (sstat == 0) return 0; else return 1; } /* * Terminate rvnamed process */ void killrvnamed(void) { int fd; struct sockaddr_un su; struct rvn rvnpkt; fd = socket(PF_UNIX, SOCK_DGRAM, 0); su.sun_family = AF_UNIX; strcpy(su.sun_path, IPTSOCKNAME); rvnpkt.type = RVN_QUIT; sendto(fd, &rvnpkt, sizeof(struct rvn), 0, (struct sockaddr *) &su, sizeof(su.sun_family) + strlen(su.sun_path)); close(fd); } void open_rvn_socket(int *fd) { struct sockaddr_un su; strncpy(revname_socket, get_path(T_WORKDIR, gen_unix_sockname()), 80); unlink(revname_socket); *fd = socket(PF_UNIX, SOCK_DGRAM, 0); su.sun_family = AF_UNIX; strcpy(su.sun_path, revname_socket); bind(*fd, (struct sockaddr *) &su, sizeof(su.sun_family) + strlen(su.sun_path)); } void close_rvn_socket(int fd) { if (fd > 0) { close(fd); unlink(revname_socket); } } int revname(int *lookup, struct sockaddr_storage *addr, char *target, size_t target_size, int rvnfd) { struct rvn rpkt; int br; struct sockaddr_un su; socklen_t fl; fd_set sockset; struct timeval tv; int sstat = 0; memset(target, 0, target_size); if (*lookup) { if (rvnfd > 0) { su.sun_family = AF_UNIX; strcpy(su.sun_path, IPTSOCKNAME); rpkt.type = RVN_REQUEST; sockaddr_copy(&rpkt.addr, addr); sendto(rvnfd, &rpkt, sizeof(struct rvn), 0, (struct sockaddr *) &su, sizeof(su.sun_family) + strlen(su.sun_path)); fl = sizeof(su.sun_family) + strlen(su.sun_path); do { tv.tv_sec = 10; tv.tv_usec = 0; FD_ZERO(&sockset); FD_SET(rvnfd, &sockset); do { sstat = select(rvnfd + 1, &sockset, NULL, NULL, &tv); } while ((sstat < 0) && (errno == EINTR)); if (FD_ISSET(rvnfd, &sockset)) br = recvfrom(rvnfd, &rpkt, sizeof(struct rvn), 0, (struct sockaddr *) &su, &fl); else br = -1; } while ((br < 0) && (errno == EINTR)); if (br < 0) { sockaddr_ntop(addr, target, target_size); printipcerr(); *lookup = 0; return RESOLVED; } strncpy(target, rpkt.fqdn, target_size - 1); return (rpkt.ready); } else { struct hostent *he = sockaddr_gethostbyaddr(addr); if (he == NULL) { sockaddr_ntop(addr, target, target_size); } else { strncpy(target, he->h_name, target_size - 1); } return RESOLVED; } } else { sockaddr_ntop(addr, target, target_size); return RESOLVED; } return NOTRESOLVED; } iptraf-ng-1.1.4/src/revname.h0000664000076400007640000000060612173477703016300 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_REVNAME_H #define IPTRAF_NG_REVNAME_H /*** revname.h - public declarations related to reverse name resolution ***/ int rvnamedactive(void); void killrvnamed(void); void open_rvn_socket(int *fd); void close_rvn_socket(int fd); int revname(int *lookup, struct sockaddr_storage *addr, char *target, size_t target_size, int rvnfd); #endif /* IPTRAF_NG_REVNAME_H */ iptraf-ng-1.1.4/src/rvnamed-ng.80000664000076400007640000000135412173477703016622 0ustar npajkovsnpajkovs.TH RVNAMED 8 "rvnamed Help Page" .SH NAME rvnamed \- reverse name resolution daemon for .BR iptraf (8) .SH DESCRIPTION .B rvnamed is a supplementary program distributed with iptraf. This is a reverse name resolution daemon used by iptraf to resolve IP addresses to host names in the background, keeping iptraf from waiting until the lookup is completed. .PP This program is only used by iptraf and, therefore, is useless alone. .SH FILES /var/log/iptraf/rvnamed.log - log file .SH SEE ALSO README.rvnamed - documentation from the author .br .SH AUTHOR Gerard Paul Java (riker@mozcom.com) .SH MANUAL AUTHOR Frederic Peters (fpeters@debian.org), using README.rvnamed General manual page modifications bu Gerard Paul Java (riker@mozcom.com) iptraf-ng-1.1.4/src/rvnamed.c0000664000076400007640000002560612173477703016301 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** rvnamed - reverse DNS lookup daemon for the IPTraf network statistics utility. Version 2.6.1 Parallel with IPTraf 2.6 Written by Gerard Paul Java Copyright (c) Gerard Paul Java 1998-2001 rvnamed is a daemon designed to do reverse DNS lookups, but return the IP address immediately while the lookup goes on in the background. A process requesting the lookup issues a request, and will immediately get a reply with the IP address. Meanwhile, rvnamed will fork and do the lookup. The requesting process simply needs to reissue the request until a full domain name is returned. This program is designed to be used by the IPTraf program to minimize blocking and allow smoother keyboard control and packet counting when reverse DNS lookups are enabled. rvnamed and IPTraf communicate with each other using the BSD UNIX domain socket protocol. ***/ #include #include #include #include #include #include #include #include #include #include #include #include #include #include "rvnamed.h" #include "dirs.h" #include "sockaddr.h" #define NUM_CACHE_ENTRIES 2048 #define TIME_TARGET_MAX 30 #define __unused __attribute__((unused)) struct hosts { struct sockaddr_storage addr; char fqdn[45]; int ready; }; static int fork_count = 0; static int max_fork_count = 0; /* * This is the classic zombie-preventer */ static void childreap(int s __unused) { signal(SIGCHLD, childreap); while (waitpid(-1, NULL, WNOHANG) > 0) fork_count--; } static void auto_terminate(int s __unused) { exit(2); } /* * Process reverse DNS request from the client */ static void process_rvn_packet(struct rvn *rvnpacket) { int ccfd; struct sockaddr_un ccsa; struct hostent *he; ccfd = socket(PF_UNIX, SOCK_DGRAM, 0); he = sockaddr_gethostbyaddr(&rvnpacket->addr); if (he == NULL) { sockaddr_ntop(&rvnpacket->addr, rvnpacket->fqdn, sizeof(rvnpacket->fqdn)); } else { memset(rvnpacket->fqdn, 0, sizeof(rvnpacket->fqdn)); strncpy(rvnpacket->fqdn, he->h_name, sizeof(rvnpacket->fqdn) - 1); } ccsa.sun_family = AF_UNIX; strcpy(ccsa.sun_path, CHILDSOCKNAME); sendto(ccfd, rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &ccsa, sizeof(ccsa.sun_family) + strlen(ccsa.sun_path)); close(ccfd); } /* * Check if name is already resolved and in the cache. */ static int name_resolved(struct rvn *rvnpacket, struct hosts *hostlist, unsigned int lastfree) { for (unsigned int i = 0; i != lastfree; i++) if ((hostlist[i].ready == RESOLVED) && sockaddr_is_equal(&rvnpacket->addr, &hostlist[i].addr)) return i; return -1; } /* * Return the resolution status (NOTRESOLVED, RESOLVING, RESOLVED) of * the given IP address */ static int addrstat(struct rvn *rvnpacket, struct hosts *hostlist, unsigned int lastfree) { for (unsigned int i = 0; i != lastfree; i++) if (sockaddr_is_equal(&rvnpacket->addr, &hostlist[i].addr)) return hostlist[i].ready; return NOTRESOLVED; } static void writervnlog(FILE * fd, char *msg) { time_t now; char atime[TIME_TARGET_MAX] = ""; now = time(NULL); strcpy(atime, ctime(&now)); atime[strlen(atime) - 1] = '\0'; fprintf(fd, "%s: %s\n", atime, msg); } int main(void) { int cfd; int ifd; struct hosts hostlist[NUM_CACHE_ENTRIES]; char logmsg[160]; unsigned int hostindex = 0; unsigned int lastfree = 0; unsigned int hi = 0; int readyidx = 0; int fr = 0; int maxlogged = 0; struct rvn rvnpacket; int br; int ss = 0; fd_set sockset; struct sockaddr_un csa, isa; /* child and iptraf comm sockets */ struct sockaddr_un fromaddr; socklen_t fromlen; FILE *logfile; /* Daemonization Sequence */ switch (fork()) { case -1: exit(1); case 0: break; default: exit(0); } setsid(); int i = chdir("/"); (void) i; signal(SIGCHLD, childreap); logfile = fopen(RVNDLOGFILE, "a"); if (logfile == NULL) logfile = fopen("/dev/null", "a"); writervnlog(logfile, "******** rvnamed started ********"); writervnlog(logfile, "Clearing socket names"); /* * Get rid of any residue socket names in case of a previous * abormal termination of rvnamed. */ unlink(CHILDSOCKNAME); unlink(IPTSOCKNAME); writervnlog(logfile, "Opening sockets"); csa.sun_family = AF_UNIX; strcpy(csa.sun_path, CHILDSOCKNAME); isa.sun_family = AF_UNIX; strcpy(isa.sun_path, IPTSOCKNAME); cfd = socket(PF_UNIX, SOCK_DGRAM, 0); if (cfd < 0) { writervnlog(logfile, "Unable to open child communication socket, aborting"); exit(1); } if (bind (cfd, (struct sockaddr *) &csa, sizeof(csa.sun_family) + strlen(csa.sun_path)) < 0) { writervnlog(logfile, "Error binding child communication socket, aborting"); exit(1); } ifd = socket(PF_UNIX, SOCK_DGRAM, 0); if (ifd < 0) { writervnlog(logfile, "Unable to open client communication socket, aborting"); exit(1); } if (bind (ifd, (struct sockaddr *) &isa, sizeof(isa.sun_family) + strlen(isa.sun_path)) < 0) { writervnlog(logfile, "Error binding client communication socket, aborting"); exit(1); } while (1) { FD_ZERO(&sockset); FD_SET(cfd, &sockset); FD_SET(ifd, &sockset); do { ss = select(ifd + 1, &sockset, NULL, NULL, NULL); } while ((ss < 0) && (errno != ENOMEM)); if (errno == ENOMEM) { writervnlog(logfile, "Fatal error: no memory for descriptor monitoring"); close(ifd); close(cfd); fclose(logfile); exit(1); } /* * Code to process packets coming from the forked child. */ if (FD_ISSET(cfd, &sockset)) { fromlen = sizeof(fromaddr.sun_family) + strlen(fromaddr.sun_path); br = recvfrom(cfd, &rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &fromaddr, &fromlen); if (br > 0) { hi = 0; while (hi <= lastfree) { if (sockaddr_is_equal(&hostlist[hi].addr, &rvnpacket.addr)) break; hi++; } if (hi == lastfree) { /* Address not in cache */ memset(&(hostlist[hi]), 0, sizeof(struct hosts)); hi = hostindex; hostindex++; if (hostindex == NUM_CACHE_ENTRIES) hostindex = 0; sockaddr_copy(&hostlist[hi].addr, &rvnpacket.addr); } strncpy(hostlist[hi].fqdn, rvnpacket.fqdn, sizeof(hostlist[hi].fqdn) - 1); hostlist[hi].ready = RESOLVED; } } /* * This code section processes packets received from the IPTraf * program. */ if (FD_ISSET(ifd, &sockset)) { fromlen = sizeof(struct sockaddr_un); br = recvfrom(ifd, &rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &fromaddr, &fromlen); if (br > 0) { switch (rvnpacket.type) { case RVN_HELLO: sendto(ifd, &rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &fromaddr, sizeof(fromaddr.sun_family) + strlen(fromaddr.sun_path)); break; case RVN_QUIT: writervnlog(logfile, "Received quit instruction"); writervnlog(logfile, "Closing sockets"); close(ifd); close(cfd); writervnlog(logfile, "Clearing socket names"); unlink(IPTSOCKNAME); unlink(CHILDSOCKNAME); sprintf(logmsg, "rvnamed terminating: max processes spawned: %d", max_fork_count); writervnlog(logfile, logmsg); writervnlog(logfile, "******** rvnamed terminated ********"); fclose(logfile); exit(0); case RVN_REQUEST: readyidx = name_resolved(&rvnpacket, hostlist, lastfree); if (readyidx >= 0) { rvnpacket.type = RVN_REPLY; memset(rvnpacket.fqdn, 0, sizeof(rvnpacket.fqdn)); strncpy(rvnpacket.fqdn, hostlist[readyidx].fqdn, sizeof(rvnpacket.fqdn)-1); rvnpacket.ready = RESOLVED; br = sendto(ifd, &rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &fromaddr, sizeof(fromaddr. sun_family) + strlen(fromaddr. sun_path)); } else { /* * Add this IP address to the cache if this is a * new one. */ if (addrstat (&rvnpacket, hostlist, lastfree) == NOTRESOLVED) { fflush(logfile); /* flush all data prior */ /* to fork() */ if (fork_count <= MAX_RVNAMED_CHILDREN) { /* * If we can still fork(), we add the data * to the cache array, but we don't update * the indexes until after the fork() * succeeds. If the fork() fails, we'll * just reuse this slot for the next query. * * This is so that if the fork() fails due * to a temporary condition, rvnamed won't * think it's RESOLVING while there isn't * any actual child doing the resolution * before the entry expires. * * However, we'll still tell IPTraf that the * address is RESOLVING. * */ sockaddr_copy(&hostlist[hostindex].addr, &rvnpacket.addr); hostlist[hostindex].ready = RESOLVING; maxlogged = 0; fr = fork(); } else { fr = -1; if (!maxlogged) writervnlog (logfile, "Maximum child process limit reached"); maxlogged = 1; } switch (fr) { case 0: /* spawned child */ fclose(logfile); /* no logging in child */ close(ifd); /* no comm with client */ /* * Set auto-terminate timeout */ signal(SIGALRM, auto_terminate); alarm(300); process_rvn_packet (&rvnpacket); exit(0); case -1: if (!maxlogged) writervnlog (logfile, "Error on fork, returning IP address"); break; default: /* parent */ if (fork_count > max_fork_count) max_fork_count = fork_count; /* * Increase cache indexes only if fork() * succeeded, otherwise the previously * allocated slots will be used for the * next query. */ hostindex++; if (hostindex == NUM_CACHE_ENTRIES) hostindex = 0; if (lastfree < NUM_CACHE_ENTRIES) lastfree++; fork_count++; break; } } rvnpacket.type = RVN_REPLY; sockaddr_ntop(&rvnpacket.addr, rvnpacket.fqdn, sizeof(rvnpacket.fqdn)); rvnpacket.ready = RESOLVING; br = sendto(ifd, &rvnpacket, sizeof(struct rvn), 0, (struct sockaddr *) &fromaddr, sizeof(fromaddr. sun_family) + strlen(fromaddr. sun_path)); } } } } /* end block for packets from IPTraf */ } } iptraf-ng-1.1.4/src/rvnamed.h0000664000076400007640000000106012173477703016272 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_RVNAMED_H #define IPTRAF_NG_RVNAMED_H #include #include #define CHILDSOCKNAME "/dev/rvndcldcomsk" #define PARENTSOCKNAME "/dev/rvndpntcomsk" #define IPTSOCKNAME "/dev/rvndiptcomsk" #define SOCKET_PREFIX "isock" #define NOTRESOLVED 0 #define RESOLVING 1 #define RESOLVED 2 #define RVN_HELLO 0 #define RVN_REQUEST 1 #define RVN_REPLY 2 #define RVN_QUIT 3 #define MAX_RVNAMED_CHILDREN 200 struct rvn { int type; int ready; struct sockaddr_storage addr; char fqdn[45]; }; #endif /* IPTRAF_NG_RVNAMED_H */ iptraf-ng-1.1.4/src/serv.c0000664000076400007640000007460012173477703015622 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** serv.c - TCP/UDP port statistics module ***/ #include "iptraf-ng-compat.h" #include "tui/input.h" #include "tui/labels.h" #include "tui/listbox.h" #include "tui/msgboxes.h" #include "dirs.h" #include "deskman.h" #include "fltdefs.h" #include "packet.h" #include "ipfrag.h" #include "ifaces.h" #include "attrs.h" #include "serv.h" #include "servname.h" #include "log.h" #include "timer.h" #include "promisc.h" #include "options.h" #include "packet.h" #include "logvars.h" #include "error.h" #include "counters.h" #include "rate.h" #define SCROLLUP 0 #define SCROLLDOWN 1 #define LEFT 0 #define RIGHT 1 struct serv_spans { int spanbr_in; int spanbr_out; int spanbr; }; struct portlistent { in_port_t port; unsigned int protocol; char servname[11]; unsigned int idx; struct proto_counter serv_count; struct proto_counter span; struct timeval starttime; struct timeval proto_starttime; struct rate rate; struct rate rate_in; struct rate rate_out; struct portlistent *prev_entry; struct portlistent *next_entry; }; struct portlist { struct portlistent *head; struct portlistent *tail; struct portlistent *firstvisible; struct portlistent *lastvisible; struct portlistent *barptr; unsigned imaxy; unsigned int baridx; unsigned int count; unsigned long bcount; WINDOW *win; PANEL *panel; WINDOW *borderwin; PANEL *borderpanel; }; /* * SIGUSR1 logfile rotation signal handler */ static void rotate_serv_log(int s __unused) { rotate_flag = 1; strcpy(target_logname, current_logfile); signal(SIGUSR1, rotate_serv_log); } static void writeutslog(struct portlistent *list, unsigned long nsecs, FILE *fd) { char atime[TIME_TARGET_MAX]; struct portlistent *ptmp = list; struct timeval now; gettimeofday(&now, NULL); genatime(time(NULL), atime); fprintf(fd, "\n*** TCP/UDP traffic log, generated %s\n\n", atime); while (ptmp != NULL) { unsigned long secs = timeval_diff_msec(&now, &ptmp->proto_starttime) / 1000UL; char bps_string[64]; if (ptmp->protocol == IPPROTO_TCP) fprintf(fd, "TCP/%s: ", ptmp->servname); else fprintf(fd, "UDP/%s: ", ptmp->servname); fprintf(fd, "%llu packets, %llu bytes total", ptmp->serv_count.proto_total.pc_packets, ptmp->serv_count.proto_total.pc_bytes); rate_print(ptmp->serv_count.proto_total.pc_bytes / secs, bps_string, sizeof(bps_string)); fprintf(fd, ", %s", bps_string); fprintf(fd, "; %llu packets, %llu bytes incoming", ptmp->serv_count.proto_in.pc_packets, ptmp->serv_count.proto_in.pc_bytes); rate_print(ptmp->serv_count.proto_in.pc_bytes / secs, bps_string, sizeof(bps_string)); fprintf(fd, ", %s", bps_string); fprintf(fd, "; %llu packets, %llu bytes outgoing", ptmp->serv_count.proto_out.pc_packets, ptmp->serv_count.proto_out.pc_bytes); rate_print(ptmp->serv_count.proto_out.pc_bytes / secs, bps_string, sizeof(bps_string)); fprintf(fd, ", %s", bps_string); fprintf(fd, "\n\n"); ptmp = ptmp->next_entry; } fprintf(fd, "\nRunning time: %lu seconds\n", nsecs); fflush(fd); } static void initportlist(struct portlist *list) { float screen_scale = ((float) COLS / 80 + 1) / 2; int scratchx __unused; list->head = list->tail = list->barptr = NULL; list->firstvisible = list->lastvisible = NULL; list->count = 0; list->baridx = 0; list->borderwin = newwin(LINES - 3, COLS, 1, 0); list->borderpanel = new_panel(list->borderwin); wattrset(list->borderwin, BOXATTR); tx_box(list->borderwin, ACS_VLINE, ACS_HLINE); wmove(list->borderwin, 0, 1 * screen_scale); wprintw(list->borderwin, " Proto/Port "); wmove(list->borderwin, 0, 22 * screen_scale); wprintw(list->borderwin, " Pkts "); wmove(list->borderwin, 0, 31 * screen_scale); wprintw(list->borderwin, " Bytes "); wmove(list->borderwin, 0, 40 * screen_scale); wprintw(list->borderwin, " PktsTo "); wmove(list->borderwin, 0, 49 * screen_scale); wprintw(list->borderwin, " BytesTo "); wmove(list->borderwin, 0, 58 * screen_scale); wprintw(list->borderwin, " PktsFrom "); wmove(list->borderwin, 0, 67 * screen_scale); wprintw(list->borderwin, " BytesFrom "); list->win = newwin(LINES - 5, COLS - 2, 2, 1); list->panel = new_panel(list->win); getmaxyx(list->win, list->imaxy, scratchx); tx_stdwinset(list->win); wtimeout(list->win, -1); wattrset(list->win, STDATTR); tx_colorwin(list->win); update_panels(); doupdate(); } static struct portlistent *addtoportlist(struct portlist *list, unsigned int protocol, in_port_t port) { struct portlistent *ptemp; ptemp = xmalloc(sizeof(struct portlistent)); if (list->head == NULL) { ptemp->prev_entry = NULL; list->head = ptemp; list->firstvisible = ptemp; } if (list->tail != NULL) { list->tail->next_entry = ptemp; ptemp->prev_entry = list->tail; } list->tail = ptemp; ptemp->next_entry = NULL; ptemp->protocol = protocol; ptemp->port = port; /* This is used in checks later. */ rate_alloc(&ptemp->rate, 5); rate_alloc(&ptemp->rate_in, 5); rate_alloc(&ptemp->rate_out, 5); /* * Obtain appropriate service name */ servlook(port, protocol, ptemp->servname, 10); memset(&ptemp->serv_count, 0, sizeof(ptemp->serv_count)); list->count++; ptemp->idx = list->count; gettimeofday(&ptemp->proto_starttime, NULL); if (list->count <= (unsigned) LINES - 5) list->lastvisible = ptemp; wmove(list->borderwin, LINES - 4, 1); wprintw(list->borderwin, " %u entries ", list->count); return ptemp; } static int portinlist(struct porttab *table, in_port_t port) { struct porttab *ptmp = table; while (ptmp != NULL) { if (((ptmp->port_max == 0) && (ptmp->port_min == port)) || ((port >= ptmp->port_min) && (port <= ptmp->port_max))) return 1; ptmp = ptmp->next_entry; } return 0; } static int goodport(in_port_t port, struct porttab *table) { return ((port < 1024) || (portinlist(table, port))); } static struct portlistent *inportlist(struct portlist *list, unsigned int protocol, in_port_t port) { struct portlistent *ptmp = list->head; while (ptmp != NULL) { if ((ptmp->port == port) && (ptmp->protocol == protocol)) return ptmp; ptmp = ptmp->next_entry; } return NULL; } static void printportent(struct portlist *list, struct portlistent *entry, unsigned int idx) { unsigned int target_row; float screen_scale = ((float) COLS / 80 + 1) / 2; int tcplabelattr; int udplabelattr; int highattr; char sp_buf[10]; if ((entry->idx < idx) || (entry->idx > idx + (LINES - 6))) return; target_row = entry->idx - idx; if (entry == list->barptr) { tcplabelattr = BARSTDATTR; udplabelattr = BARPTRATTR; highattr = BARHIGHATTR; } else { tcplabelattr = STDATTR; udplabelattr = PTRATTR; highattr = HIGHATTR; } wattrset(list->win, tcplabelattr); sprintf(sp_buf, "%%%dc", COLS - 2); scrollok(list->win, 0); mvwprintw(list->win, target_row, 0, sp_buf, ' '); scrollok(list->win, 1); wmove(list->win, target_row, 1); if (entry->protocol == IPPROTO_TCP) { wattrset(list->win, tcplabelattr); wprintw(list->win, "TCP"); } else if (entry->protocol == IPPROTO_UDP) { wattrset(list->win, udplabelattr); wprintw(list->win, "UDP"); } wprintw(list->win, "/%s ", entry->servname); wattrset(list->win, highattr); wmove(list->win, target_row, 17 * screen_scale); printlargenum(entry->serv_count.proto_total.pc_packets, list->win); wmove(list->win, target_row, 27 * screen_scale); printlargenum(entry->serv_count.proto_total.pc_bytes, list->win); wmove(list->win, target_row, 37 * screen_scale); printlargenum(entry->serv_count.proto_in.pc_packets, list->win); wmove(list->win, target_row, 47 * screen_scale); printlargenum(entry->serv_count.proto_in.pc_bytes, list->win); wmove(list->win, target_row, 57 * screen_scale); printlargenum(entry->serv_count.proto_out.pc_packets, list->win); wmove(list->win, target_row, 67 * screen_scale); printlargenum(entry->serv_count.proto_out.pc_bytes, list->win); } static void destroyportlist(struct portlist *list) { struct portlistent *ptmp = list->head; struct portlistent *ctmp = NULL; if (list->head != NULL) ctmp = list->head->next_entry; while (ptmp != NULL) { rate_destroy(&ptmp->rate_out); rate_destroy(&ptmp->rate_in); rate_destroy(&ptmp->rate); free(ptmp); ptmp = ctmp; if (ctmp != NULL) ctmp = ctmp->next_entry; } } static void updateportent(struct portlist *list, unsigned int protocol, in_port_t sport, in_port_t dport, int br, struct porttab *ports) { struct portlistent *sport_listent = NULL; struct portlistent *dport_listent = NULL; enum { PORT_INCOMING = 0, PORT_OUTGOING }; if (goodport(sport, ports)) { sport_listent = inportlist(list, protocol, sport); if (!sport_listent) sport_listent = addtoportlist(list, protocol, sport); if (sport_listent == NULL) return; update_proto_counter(&sport_listent->serv_count, PORT_OUTGOING, br); update_proto_counter(&sport_listent->span, PORT_OUTGOING, br); } if (goodport(dport, ports)) { dport_listent = inportlist(list, protocol, dport); if (!dport_listent) dport_listent = addtoportlist(list, protocol, dport); if (dport_listent == NULL) return; update_proto_counter(&dport_listent->serv_count, PORT_INCOMING, br); update_proto_counter(&dport_listent->span, PORT_INCOMING, br); } } /* * Swap two port list entries. p1 must be previous to p2. */ static void swapportents(struct portlist *list, struct portlistent *p1, struct portlistent *p2) { register unsigned int tmp; struct portlistent *p1prevsaved; struct portlistent *p2nextsaved; if (p1 == p2) return; tmp = p1->idx; p1->idx = p2->idx; p2->idx = tmp; if (p1->prev_entry != NULL) p1->prev_entry->next_entry = p2; else list->head = p2; if (p2->next_entry != NULL) p2->next_entry->prev_entry = p1; else list->tail = p1; p2nextsaved = p2->next_entry; p1prevsaved = p1->prev_entry; if (p1->next_entry == p2) { p2->next_entry = p1; p1->prev_entry = p2; } else { p2->next_entry = p1->next_entry; p1->prev_entry = p2->prev_entry; p2->prev_entry->next_entry = p1; p1->next_entry->prev_entry = p2; } p2->prev_entry = p1prevsaved; p1->next_entry = p2nextsaved; } /* * Retrieve the appropriate sort criterion based on keystroke. */ static unsigned long long qp_getkey(struct portlistent *entry, int ch) { unsigned long long result = 0; switch (ch) { case 'R': result = entry->port; break; case 'B': result = entry->serv_count.proto_total.pc_bytes; break; case 'O': result = entry->serv_count.proto_in.pc_bytes; break; case 'M': result = entry->serv_count.proto_out.pc_bytes; break; case 'P': result = entry->serv_count.proto_total.pc_packets; break; case 'T': result = entry->serv_count.proto_in.pc_packets; break; case 'F': result = entry->serv_count.proto_out.pc_packets; break; } return result; } /* * Refresh TCP/UDP service screen. */ static void refresh_serv_screen(struct portlist *table, int idx) { struct portlistent *ptmp = table->firstvisible; wattrset(table->win, STDATTR); tx_colorwin(table->win); while ((ptmp != NULL) && (ptmp->prev_entry != table->lastvisible)) { printportent(table, ptmp, idx); ptmp = ptmp->next_entry; } update_panels(); doupdate(); } /* * Compare the sort criterion with the pivot value. Receives a parameter * specifying whether the criterion is left or right of the pivot value. * * If criterion is the port number: return true if criterion is less than or * equal to the pivot when the SIDE is left. If SIDE is right, return * true if the value is greater than the pivot. This results in an * ascending sort. * * If the criterion is a count: return true when the criterion is greater than * or equal to the pivot when the SIDE is left, otherwise, when SIDE is * right, return true if the value is less than the pivot. This results * in a descending sort. */ static int qp_compare(struct portlistent *entry, unsigned long long pv, int ch, int side) { int result = 0; unsigned long long value; value = qp_getkey(entry, ch); if (ch == 'R') { if (side == LEFT) result = (value <= pv); else result = (value > pv); } else { if (side == LEFT) result = (value >= pv); else result = (value < pv); } return result; } /* * Partition port list such that a pivot is selected, and that all values * left of the pivot are less (or greater) than or equal to the pivot, * and that all values right of the pivot are greater (or less) than * the pivot. */ static struct portlistent *qp_partition(struct portlist *table, struct portlistent **low, struct portlistent **high, int ch) { struct portlistent *pivot = *low; struct portlistent *left = *low; struct portlistent *right = *high; struct portlistent *ptmp; unsigned long long pivot_value; pivot_value = qp_getkey(pivot, ch); while (left->idx < right->idx) { while ((qp_compare(left, pivot_value, ch, LEFT)) && (left->next_entry != NULL)) left = left->next_entry; while (qp_compare(right, pivot_value, ch, RIGHT)) right = right->prev_entry; if (left->idx < right->idx) { swapportents(table, left, right); if (*low == left) *low = right; if (*high == right) *high = left; ptmp = left; left = right; right = ptmp; } } swapportents(table, pivot, right); if (*low == pivot) *low = right; if (*high == right) *high = pivot; return pivot; } /* * Quicksort for the port list. */ static void quicksort_port_entries(struct portlist *table, struct portlistent *low, struct portlistent *high, int ch) { struct portlistent *pivot; if ((high == NULL) || (low == NULL)) return; if (high->idx > low->idx) { pivot = qp_partition(table, &low, &high, ch); quicksort_port_entries(table, low, pivot->prev_entry, ch); quicksort_port_entries(table, pivot->next_entry, high, ch); } } static void sortportents(struct portlist *list, unsigned int *idx, int command) { struct portlistent *ptemp1; int idxtmp; if (!(list->head)) return; command = toupper(command); if ((command != 'R') && (command != 'B') && (command != 'O') && (command != 'M') && (command != 'P') && (command != 'T') && (command != 'F')) return; quicksort_port_entries(list, list->head, list->tail, command); ptemp1 = list->firstvisible = list->head; *idx = 1; idxtmp = 1; while ((ptemp1) && (idxtmp <= LINES - 5)) { /* printout */ printportent(list, ptemp1, *idx); if (idxtmp <= LINES - 5) list->lastvisible = ptemp1; ptemp1 = ptemp1->next_entry; idxtmp++; } } static void scrollservwin(struct portlist *table, int direction, unsigned int *idx) { char sp_buf[10]; sprintf(sp_buf, "%%%dc", COLS - 2); wattrset(table->win, STDATTR); if (direction == SCROLLUP) { if (table->lastvisible != table->tail) { wscrl(table->win, 1); table->lastvisible = table->lastvisible->next_entry; table->firstvisible = table->firstvisible->next_entry; (*idx)++; wmove(table->win, LINES - 6, 0); scrollok(table->win, 0); wprintw(table->win, sp_buf, ' '); scrollok(table->win, 1); printportent(table, table->lastvisible, *idx); } } else { if (table->firstvisible != table->head) { wscrl(table->win, -1); table->lastvisible = table->lastvisible->prev_entry; table->firstvisible = table->firstvisible->prev_entry; (*idx)--; wmove(table->win, 0, 0); wprintw(table->win, sp_buf, ' '); printportent(table, table->firstvisible, *idx); } } } static void pageservwin(struct portlist *table, int direction, unsigned int *idx) { int i = 1; if (direction == SCROLLUP) { while ((i <= LINES - 9) && (table->lastvisible != table->tail)) { i++; table->firstvisible = table->firstvisible->next_entry; table->lastvisible = table->lastvisible->next_entry; (*idx)++; } } else { while ((i <= LINES - 9) && (table->firstvisible != table->head)) { i++; table->firstvisible = table->firstvisible->prev_entry; table->lastvisible = table->lastvisible->prev_entry; (*idx)--; } } refresh_serv_screen(table, *idx); } static void show_portsort_keywin(WINDOW ** win, PANEL ** panel) { *win = newwin(14, 35, (LINES - 10) / 2, COLS - 40); *panel = new_panel(*win); wattrset(*win, DLGBOXATTR); tx_colorwin(*win); tx_box(*win, ACS_VLINE, ACS_HLINE); wattrset(*win, DLGTEXTATTR); mvwprintw(*win, 2, 2, "Select sort criterion"); wmove(*win, 4, 2); tx_printkeyhelp("R", " - port number", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 5, 2); tx_printkeyhelp("P", " - total packets", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 6, 2); tx_printkeyhelp("B", " - total bytes", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 7, 2); tx_printkeyhelp("T", " - packets to", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 8, 2); tx_printkeyhelp("O", " - bytes to", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 9, 2); tx_printkeyhelp("F", " - packets from", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 10, 2); tx_printkeyhelp("M", " - bytes from", *win, DLGHIGHATTR, DLGTEXTATTR); wmove(*win, 11, 2); tx_printkeyhelp("Any other key", " - cancel sort", *win, DLGHIGHATTR, DLGTEXTATTR); update_panels(); doupdate(); } static void print_serv_rates(struct portlistent *ple, WINDOW *win) { char buf[64]; wattrset(win, IPSTATLABELATTR); mvwprintw(win, 0, 1, "Protocol data rates:"); mvwprintw(win, 0, 36, "total"); mvwprintw(win, 0, 57, "in"); mvwprintw(win, 0, 76, "out"); wattrset(win, IPSTATATTR); rate_print(rate_get_average(&ple->rate), buf, sizeof(buf)); mvwprintw(win, 0, 21, "%s", buf); rate_print(rate_get_average(&ple->rate_in), buf, sizeof(buf)); mvwprintw(win, 0, 42, "%s", buf); rate_print(rate_get_average(&ple->rate_out), buf, sizeof(buf)); mvwprintw(win, 0, 61, "%s", buf); } static void update_serv_rates(struct portlist *list, unsigned long msecs) { /* update rates of all portlistents */ for (struct portlistent *ple = list->head; ple != NULL; ple = ple->next_entry) { rate_add_rate(&ple->rate, ple->span.proto_total.pc_bytes, msecs); rate_add_rate(&ple->rate_in, ple->span.proto_in.pc_bytes, msecs); rate_add_rate(&ple->rate_out, ple->span.proto_out.pc_bytes, msecs); memset(&ple->span, 0, sizeof(ple->span)); } } /* * The TCP/UDP service monitor */ void servmon(char *ifname, time_t facilitytime) { int logging = options.logging; int pkt_result; int keymode = 0; unsigned int idx = 1; in_port_t sport = 0; in_port_t dport = 0; struct timeval tv; struct timeval tv_rate; time_t starttime, startlog, timeint; time_t now; struct timeval updtime; unsigned int tot_br; int ch; struct portlist list; struct portlistent *serv_tmp; FILE *logfile = NULL; WINDOW *sortwin; PANEL *sortpanel; WINDOW *statwin; PANEL *statpanel; char sp_buf[10]; int fd; struct porttab *ports; if (!dev_up(ifname)) { err_iface_down(); return; } loadaddports(&ports); LIST_HEAD(promisc); if (options.promisc) { promisc_init(&promisc, ifname); promisc_set_list(&promisc); } initportlist(&list); statwin = newwin(1, COLS, LINES - 2, 0); statpanel = new_panel(statwin); scrollok(statwin, 0); wattrset(statwin, IPSTATLABELATTR); sprintf(sp_buf, "%%%dc", COLS); mvwprintw(statwin, 0, 0, sp_buf, ' '); move(LINES - 1, 1); scrollkeyhelp(); sortkeyhelp(); stdexitkeyhelp(); if (options.servnames) setservent(1); if (logging) { if (strcmp(current_logfile, "") == 0) { snprintf(current_logfile, 80, "%s-%s.log", TCPUDPLOG, ifname); if (!daemonized) input_logfile(current_logfile, &logging); } } if (logging) { opentlog(&logfile, current_logfile); if (logfile == NULL) logging = 0; } if (logging) { signal(SIGUSR1, rotate_serv_log); rotate_flag = 0; writelog(logging, logfile, "******** TCP/UDP service monitor started ********"); } exitloop = 0; gettimeofday(&tv, NULL); tv_rate = tv; updtime = tv; starttime = startlog = timeint = tv.tv_sec; wattrset(statwin, IPSTATATTR); mvwprintw(statwin, 0, 1, "No entries"); update_panels(); doupdate(); fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if(fd == -1) { write_error("Unable to obtain monitoring socket"); goto err; } if(dev_bind_ifname(fd, ifname) == -1) { write_error("Unable to bind interface on the socket"); goto err_close; } PACKET_INIT(pkt); while (!exitloop) { gettimeofday(&tv, NULL); now = tv.tv_sec; if (now - timeint >= 5) { printelapsedtime(starttime, now, LINES - 4, 20, list.borderwin); timeint = now; } if (logging) { check_rotate_flag(&logfile); if ((now - startlog) >= options.logspan) { writeutslog(list.head, now - starttime, logfile); startlog = now; } } unsigned long rate_msecs = timeval_diff_msec(&tv, &tv_rate); if (rate_msecs >= 1000) { /* update all portlistent rates ... */ update_serv_rates(&list, rate_msecs); /* ... and print the current one */ if (list.barptr != NULL) print_serv_rates(list.barptr, statwin); tv_rate = tv; } if (screen_update_needed(&tv, &updtime)) { refresh_serv_screen(&list, idx); update_panels(); doupdate(); updtime = tv; } if ((facilitytime != 0) && (((now - starttime) / 60) >= facilitytime)) exitloop = 1; if (packet_get(fd, &pkt, &ch, list.win) == -1) { write_error("Packet receive failed"); exitloop = 1; break; } if (ch == ERR) goto no_key_ready; if (keymode == 0) { switch (ch) { case KEY_UP: if (!list.barptr || !list.barptr->prev_entry) break; serv_tmp = list.barptr; list.barptr = list.barptr->prev_entry; printportent(&list, serv_tmp, idx); if (list.baridx == 1) scrollservwin(&list, SCROLLDOWN, &idx); else list.baridx--; printportent(&list, list.barptr, idx); print_serv_rates(list.barptr, statwin); break; case KEY_DOWN: if (!list.barptr || !list.barptr->next_entry) break; serv_tmp = list.barptr; list.barptr = list.barptr->next_entry; printportent(&list,serv_tmp, idx); if (list.baridx == list.imaxy) scrollservwin(&list, SCROLLUP, &idx); else list.baridx++; printportent(&list, list.barptr, idx); print_serv_rates(list.barptr, statwin); break; case KEY_PPAGE: case '-': if (!list.barptr) break; pageservwin(&list, SCROLLDOWN, &idx); list.barptr = list.lastvisible; list.baridx = list.lastvisible->idx - idx + 1; refresh_serv_screen(&list, idx); print_serv_rates(list.barptr, statwin); break; case KEY_NPAGE: case ' ': if (!list.barptr) break; pageservwin(&list, SCROLLUP, &idx); list.barptr = list.firstvisible; list.baridx = 1; refresh_serv_screen(&list, idx); print_serv_rates(list.barptr, statwin); break; case 12: case 'l': case 'L': tx_refresh_screen(); break; case 's': case 'S': show_portsort_keywin(&sortwin, &sortpanel); keymode = 1; break; case 'q': case 'Q': case 'x': case 'X': case 27: case 24: exitloop = 1; } } else if (keymode == 1) { del_panel(sortpanel); delwin(sortwin); sortportents(&list, &idx, ch); keymode = 0; if (list.barptr != NULL) { list.barptr = list.firstvisible; list.baridx = 1; print_serv_rates(list.barptr, statwin); } refresh_serv_screen(&list, idx); update_panels(); doupdate(); } no_key_ready: if (pkt.pkt_len <= 0) continue; pkt_result = packet_process(&pkt, &tot_br, &sport, &dport, MATCH_OPPOSITE_USECONFIG, options.v6inv4asv6); if (pkt_result != PACKET_OK) continue; unsigned short iplen; switch (pkt.pkt_protocol) { case ETH_P_IP: iplen = ntohs(pkt.iphdr->tot_len); break; case ETH_P_IPV6: iplen = ntohs(pkt.ip6_hdr->ip6_plen) + 40; break; default: /* unknown link protocol */ continue; } __u8 ip_protocol = pkt_ip_protocol(&pkt); switch (ip_protocol) { case IPPROTO_TCP: case IPPROTO_UDP: updateportent(&list, ip_protocol, sport, dport, iplen, ports); break; default: /* unknown L4 protocol */ continue; } if ((list.barptr == NULL) && (list.head != NULL)) { list.barptr = list.head; list.baridx = 1; print_serv_rates(list.barptr, statwin); } } err_close: close(fd); err: if (logging) { signal(SIGUSR1, SIG_DFL); writeutslog(list.head, time(NULL) - starttime, logfile); writelog(logging, logfile, "******** TCP/UDP service monitor stopped ********"); fclose(logfile); } if (options.servnames) endservent(); if (options.promisc) { promisc_restore_list(&promisc); promisc_destroy(&promisc); } del_panel(list.panel); delwin(list.win); del_panel(list.borderpanel); delwin(list.borderwin); del_panel(statpanel); delwin(statwin); update_panels(); doupdate(); destroyportlist(&list); destroyporttab(ports); pkt_cleanup(); strcpy(current_logfile, ""); } static void portdlg(in_port_t *port_min, in_port_t *port_max, int *aborted) { WINDOW *bw; PANEL *bp; WINDOW *win; PANEL *panel; struct FIELDLIST list; bw = newwin(14, 50, (LINES - 14) / 2, (COLS - 50) / 2 - 10); bp = new_panel(bw); win = newwin(12, 48, (LINES - 14) / 2 + 1, (COLS - 50) / 2 - 9); panel = new_panel(win); wattrset(bw, DLGBOXATTR); tx_box(bw, ACS_VLINE, ACS_HLINE); wattrset(win, DLGTEXTATTR); tx_colorwin(win); tx_stdwinset(win); wtimeout(win, -1); mvwprintw(win, 1, 1, "Port numbers below 1024 are reserved for"); mvwprintw(win, 2, 1, "TCP/IP services, and are normally the only"); mvwprintw(win, 3, 1, "ones monitored by the TCP/UDP statistics"); mvwprintw(win, 4, 1, "module. If you wish to monitor a higher-"); mvwprintw(win, 5, 1, "numbered port or range of ports, enter it"); mvwprintw(win, 6, 1, "here. Fill just the first field for a"); mvwprintw(win, 7, 1, "single port, or both fields for a range."); wmove(win, 11, 1); tabkeyhelp(win); stdkeyhelp(win); tx_initfields(&list, 1, 20, (LINES - 14) / 2 + 10, (COLS - 50) / 2 - 8, DLGTEXTATTR, FIELDATTR); mvwprintw(list.fieldwin, 0, 6, "to"); tx_addfield(&list, 5, 0, 0, ""); tx_addfield(&list, 5, 0, 9, ""); int ok; do { unsigned int val; int ret; ok = 1; tx_fillfields(&list, aborted); if (*aborted) break; ret = strtoul_ui(list.list->buf, 10, &val); if (ret == -1 || val > 65535) { tui_error(ANYKEY_MSG, "Invalid port"); ok = 0; continue; } *port_min = val; if (list.list->nextfield->buf[0] != '\0') { ret = strtoul_ui(list.list->nextfield->buf, 10, &val); if (ret == -1 || val > 65535 || *port_min > val) { tui_error(ANYKEY_MSG, "Invalid port"); ok = 0; continue; } *port_max = val; } else *port_max = 0; } while (!ok); del_panel(bp); delwin(bw); del_panel(panel); delwin(win); tx_destroyfields(&list); } static void saveportlist(struct porttab *table) { struct porttab *ptmp = table; int fd; int bw; fd = open(PORTFILE, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR); if (fd < 0) { tui_error(ANYKEY_MSG, "Unable to open port list file"); return; } while (ptmp != NULL) { bw = write(fd, &(ptmp->port_min), sizeof(unsigned int)); bw = write(fd, &(ptmp->port_max), sizeof(unsigned int)); if (bw < 0) { tui_error(ANYKEY_MSG, "Unable to write port/range entry"); destroyporttab(table); close(fd); return; } ptmp = ptmp->next_entry; } close(fd); } static int dup_portentry(struct porttab *table, unsigned int min, unsigned int max) { struct porttab *ptmp = table; while (ptmp != NULL) { if ((ptmp->port_min == min) && (ptmp->port_max == max)) return 1; ptmp = ptmp->next_entry; } return 0; } void addmoreports(struct porttab **table) { in_port_t port_min = 0, port_max = 0; int aborted; struct porttab *ptmp; portdlg(&port_min, &port_max, &aborted); if (!aborted) { if (dup_portentry(*table, port_min, port_max)) tui_error(ANYKEY_MSG, "Duplicate port/range entry"); else { ptmp = xmalloc(sizeof(struct porttab)); ptmp->port_min = port_min; ptmp->port_max = port_max; ptmp->prev_entry = NULL; ptmp->next_entry = *table; if (*table != NULL) (*table)->prev_entry = ptmp; *table = ptmp; saveportlist(*table); } } update_panels(); doupdate(); } void loadaddports(struct porttab **table) { int fd; struct porttab *ptemp; struct porttab *tail = NULL; int br; *table = NULL; fd = open(PORTFILE, O_RDONLY); if (fd < 0) return; do { ptemp = xmalloc(sizeof(struct porttab)); br = read(fd, &(ptemp->port_min), sizeof(unsigned int)); br = read(fd, &(ptemp->port_max), sizeof(unsigned int)); if (br < 0) { tui_error(ANYKEY_MSG, "Error reading port list"); close(fd); destroyporttab(*table); return; } if (br > 0) { if (*table == NULL) { *table = ptemp; ptemp->prev_entry = NULL; } if (tail != NULL) { tail->next_entry = ptemp; ptemp->prev_entry = tail; } tail = ptemp; ptemp->next_entry = NULL; } else free(ptemp); } while (br > 0); close(fd); } static void operate_portselect(struct porttab **table, struct porttab **node, int *aborted) { int ch = 0; struct scroll_list list; char listtext[20]; tx_init_listbox(&list, 25, 22, (COLS - 25) / 2, (LINES - 22) / 2, STDATTR, BOXATTR, BARSTDATTR, HIGHATTR); tx_set_listbox_title(&list, "Select Port/Range", 1); *node = *table; while (*node != NULL) { snprintf(listtext, 20, "%d to %d", (*node)->port_min, (*node)->port_max); tx_add_list_entry(&list, (char *) *node, listtext); *node = (*node)->next_entry; } tx_show_listbox(&list); tx_operate_listbox(&list, &ch, aborted); if (!(*aborted)) *node = (struct porttab *) list.textptr->nodeptr; tx_close_listbox(&list); tx_destroy_list(&list); } static void selectport(struct porttab **table, struct porttab **node, int *aborted) { if (*table == NULL) { tui_error(ANYKEY_MSG, "No custom ports"); return; } operate_portselect(table, node, aborted); } static void delport(struct porttab **table, struct porttab *ptmp) { if (ptmp != NULL) { if (ptmp == *table) { *table = (*table)->next_entry; if (*table != NULL) (*table)->prev_entry = NULL; } else { ptmp->prev_entry->next_entry = ptmp->next_entry; if (ptmp->next_entry != NULL) ptmp->next_entry->prev_entry = ptmp->prev_entry; } free(ptmp); } } void removeaport(struct porttab **table) { int aborted; struct porttab *ptmp = NULL; selectport(table, &ptmp, &aborted); if (!aborted && ptmp) { delport(table, ptmp); saveportlist(*table); } } void destroyporttab(struct porttab *table) { struct porttab *ptemp = table; struct porttab *ctemp = NULL; if (ptemp != NULL) ctemp = ptemp->next_entry; while (ptemp != NULL) { free(ptemp); ptemp = ctemp; if (ctemp != NULL) ctemp = ctemp->next_entry; } } iptraf-ng-1.1.4/src/serv.h0000664000076400007640000000074212173477703015623 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_SERV_H #define IPTRAF_NG_SERV_H /*** serv.h - TCP/UDP port statistics header file ***/ struct porttab { in_port_t port_min; in_port_t port_max; struct porttab *prev_entry; struct porttab *next_entry; }; void addmoreports(struct porttab **table); void loadaddports(struct porttab **table); void destroyporttab(struct porttab *table); void removeaport(struct porttab **table); void servmon(char *iface, time_t facilitytime); #endif /* IPTRAF_NG_SERV_H */ iptraf-ng-1.1.4/src/servname.c0000664000076400007640000000133312173477703016454 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** servname.c - lookup module for TCP and UDP service names based on port numbers ***/ #include "iptraf-ng-compat.h" #include "options.h" void servlook(in_port_t port, unsigned int protocol, char *target, int maxlen) { static struct servent *sve; memset(target, 0, maxlen + 1); if (options.servnames) { if (protocol == IPPROTO_TCP) sve = getservbyport(htons(port), "tcp"); else sve = getservbyport(htons(port), "udp"); if (sve != NULL) { strncpy(target, sve->s_name, maxlen); } else { sprintf(target, "%u", port); } } else { sprintf(target, "%u", port); } } iptraf-ng-1.1.4/src/servname.h0000664000076400007640000000035612173477703016465 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_SERVNAME_H #define IPTRAF_NG_SERVNAME_H /*** servname.h - function prototype for service lookup ***/ void servlook(in_port_t port, unsigned int protocol, char *target, int maxlen); #endif /* IPTRAF_NG_SERVNAME_H */ iptraf-ng-1.1.4/src/sockaddr.c0000664000076400007640000001032312173477703016425 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" void sockaddr_make_ipv4(struct sockaddr_storage *sockaddr, u_int32_t addr) { if (!sockaddr) die("%s(): sockaddr == NULL", __FUNCTION__); memset(sockaddr, 0, sizeof(*sockaddr)); struct sockaddr_in *sockaddr_in = (struct sockaddr_in *)sockaddr; sockaddr_in->sin_family = AF_INET; sockaddr_in->sin_port = 0; sockaddr_in->sin_addr.s_addr = addr; } void sockaddr_make_ipv6(struct sockaddr_storage *sockaddr, struct in6_addr *addr) { if (!sockaddr) die("%s(): sockaddr == NULL", __FUNCTION__); if (!addr) die("%s(): addr == NULL", __FUNCTION__); memset(sockaddr, 0, sizeof(*sockaddr)); struct sockaddr_in6 *sockaddr_in6 = (struct sockaddr_in6 *)sockaddr; sockaddr_in6->sin6_family = AF_INET6; sockaddr_in6->sin6_port = 0; sockaddr_in6->sin6_addr = *addr; sockaddr_in6->sin6_flowinfo = 0; sockaddr_in6->sin6_scope_id = 0; } in_port_t sockaddr_get_port(struct sockaddr_storage *sockaddr) { if (!sockaddr) die("%s(): sockaddr == NULL", __FUNCTION__); switch (sockaddr->ss_family) { case AF_INET: return ((struct sockaddr_in *)sockaddr)->sin_port; case AF_INET6: return ((struct sockaddr_in6 *)sockaddr)->sin6_port; default: die("%s(): Unknown address family", __FUNCTION__); } } void sockaddr_set_port(struct sockaddr_storage *sockaddr, in_port_t port) { if (!sockaddr) die("%s(): sockaddr == NULL", __FUNCTION__); switch (sockaddr->ss_family) { case AF_INET: ((struct sockaddr_in *)sockaddr)->sin_port = port; break; case AF_INET6: ((struct sockaddr_in6 *)sockaddr)->sin6_port = port; break; default: die("%s(): Unknown address family", __FUNCTION__); } } int sockaddr_is_equal(struct sockaddr_storage *addr1, struct sockaddr_storage *addr2) { if (!addr1) die("%s(): addr1 == NULL", __FUNCTION__); if (!addr2) die("%s(): addr2 == NULL", __FUNCTION__); if (addr1->ss_family != addr2->ss_family) return 0; switch (addr1->ss_family) { case AF_INET: { struct sockaddr_in *sa1 = (struct sockaddr_in *)addr1; struct sockaddr_in *sa2 = (struct sockaddr_in *)addr2; if ((sa1->sin_addr.s_addr == sa2->sin_addr.s_addr) && (sa1->sin_port == sa2->sin_port)) return 1; else return 0; } case AF_INET6: { struct sockaddr_in6 *sa1 = (struct sockaddr_in6 *)addr1; struct sockaddr_in6 *sa2 = (struct sockaddr_in6 *)addr2; if ((sa1->sin6_port == sa2->sin6_port) && (sa1->sin6_flowinfo == sa2->sin6_flowinfo) && (sa1->sin6_scope_id == sa2->sin6_scope_id) && (memcmp(&sa1->sin6_addr, &sa2->sin6_addr, sizeof(sa1->sin6_addr)) == 0)) return 1; else return 0; } default: die("%s(): Unknown address family", __FUNCTION__); } } void sockaddr_ntop(struct sockaddr_storage *addr, char *buf, size_t buflen) { if(!addr) die("%s(): addr == NULL", __FUNCTION__); const char *ret; size_t minlen; memset(buf, 0, buflen); switch (addr->ss_family) { case AF_INET: minlen = INET_ADDRSTRLEN; ret = inet_ntop(AF_INET, &((struct sockaddr_in *)addr)->sin_addr, buf, buflen - 1); break; case AF_INET6: minlen = INET6_ADDRSTRLEN; ret = inet_ntop(AF_INET6, &((struct sockaddr_in6 *)addr)->sin6_addr, buf, buflen - 1); break; default: die("%s(): Unknown address family", __FUNCTION__); } if (ret == NULL) { switch (errno) { case ENOSPC: die("%s(): buffer too small (must be at least %zu bytes)", __FUNCTION__, minlen); case EAFNOSUPPORT: die("%s(): Unknown address family", __FUNCTION__); } } } struct hostent *sockaddr_gethostbyaddr(struct sockaddr_storage *addr) { if(!addr) die("%s(): addr == NULL", __FUNCTION__); switch (addr->ss_family) { case AF_INET: return gethostbyaddr(&((struct sockaddr_in *)addr)->sin_addr, sizeof(struct in_addr), AF_INET); case AF_INET6: return gethostbyaddr(&((struct sockaddr_in6 *)addr)->sin6_addr, sizeof(struct in6_addr), AF_INET6); default: die("%s(): Unknown address family", __FUNCTION__); } } void sockaddr_copy(struct sockaddr_storage *dest, struct sockaddr_storage *src) { if (!src) die("%s(): src == NULL", __FUNCTION__); if (!dest) die("%s(): dest == NULL", __FUNCTION__); memcpy(dest, src, sizeof(struct sockaddr_storage)); } iptraf-ng-1.1.4/src/sockaddr.h0000664000076400007640000000132212173477703016431 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_SOCKADDR_H #define IPTRAF_NG_SOCKADDR_H void sockaddr_make_ipv4(struct sockaddr_storage *sockaddr, u_int32_t addr); void sockaddr_make_ipv6(struct sockaddr_storage *sockaddr, struct in6_addr *addr); in_port_t sockaddr_get_port(struct sockaddr_storage *sockaddr); void sockaddr_set_port(struct sockaddr_storage *sockaddr, in_port_t port); int sockaddr_is_equal(struct sockaddr_storage *addr1, struct sockaddr_storage *addr2); void sockaddr_ntop(struct sockaddr_storage *addr, char *buf, size_t buflen); struct hostent *sockaddr_gethostbyaddr(struct sockaddr_storage *addr); void sockaddr_copy(struct sockaddr_storage *dest, struct sockaddr_storage *src); #endif /* IPTRAF_NG_SOCKADDR_H */ iptraf-ng-1.1.4/src/tcptable.c0000644000076400007640000007651612173477703016447 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** tcptable.c - table manipulation routines for the IP monitor ***/ #include "iptraf-ng-compat.h" #include "tui/winops.h" #include "options.h" #include "tcptable.h" #include "deskman.h" #include "attrs.h" #include "log.h" #include "revname.h" #include "rvnamed.h" #include "servname.h" #include "hostmon.h" #include "sockaddr.h" #define MSGSTRING_MAX 320 unsigned int bmaxy = 0; unsigned int imaxy = 0; static void setlabels(WINDOW *win, int mode) { wmove(win, 0, 42 * COLS / 80); whline(win, ACS_HLINE, 23 * COLS / 80); if (mode == 0) { wmove(win, 0, 47 * COLS / 80); wprintw(win, " Packets "); wmove(win, 0, 59 * COLS / 80); wprintw(win, " Bytes "); } else if (mode == 1) { mvwprintw(win, 0, 47 * COLS / 80, " Source MAC Addr "); } else if (mode == 2) { wmove(win, 0, 45 * COLS / 80); wprintw(win, " Pkt Size "); wmove(win, 0, 56 * COLS / 80); wprintw(win, " Win Size "); } } /* * The hash function for the TCP hash table */ static unsigned int tcp_hash(struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, char *ifname) { size_t i; unsigned int ifsum = 0; for (i = 0; i <= strlen(ifname) - 1; i++) ifsum += ifname[i]; switch (saddr->ss_family) { case AF_INET: ifsum += 4 * ((struct sockaddr_in *)saddr)->sin_addr.s_addr; ifsum += 3 * ((struct sockaddr_in *)saddr)->sin_port; break; case AF_INET6: { unsigned int ip6sum = 0; for (i = 0; i < 4; i++) ip6sum ^= ((struct sockaddr_in6 *)saddr)->sin6_addr.s6_addr32[i]; ifsum += 4 * ip6sum; ifsum += 3 * ((struct sockaddr_in6 *)saddr)->sin6_port; break; } default: die("%s(): saddr: unknown address family", __FUNCTION__); } switch (daddr->ss_family) { case AF_INET: ifsum += 2 * ((struct sockaddr_in *)daddr)->sin_addr.s_addr; ifsum += ((struct sockaddr_in *)daddr)->sin_port; break; case AF_INET6: { unsigned int ip6sum = 0; for (i = 0; i < 4; i++) ip6sum ^= ((struct sockaddr_in6 *)daddr)->sin6_addr.s6_addr32[i]; ifsum += 2 * ip6sum; ifsum += ((struct sockaddr_in6 *)daddr)->sin6_port; break; } default: die("%s(): daddr: unknown address family", __FUNCTION__); } return (ifsum % ENTRIES_IN_HASH_TABLE); } static void print_tcp_num_entries(struct tcptable *table) { mvwprintw(table->borderwin, table->bmaxy - 1, 1, " TCP: %6u entries ", table->count); } void init_tcp_table(struct tcptable *table) { int i; table->bmaxy = LINES * 0.6; /* 60% of total screen */ table->imaxy = table->bmaxy - 2; table->borderwin = newwin(table->bmaxy, COLS, 1, 0); table->borderpanel = new_panel(table->borderwin); wattrset(table->borderwin, BOXATTR); tx_box(table->borderwin, ACS_VLINE, ACS_HLINE); wmove(table->borderwin, 0, 1); wprintw(table->borderwin, " TCP Connections (Source Host:Port) "); setlabels(table->borderwin, 0); /* initially use mode 0 */ wmove(table->borderwin, 0, 65 * COLS / 80); wprintw(table->borderwin, " Flag "); wmove(table->borderwin, 0, 70 * COLS / 80); wprintw(table->borderwin, " Iface "); update_panels(); doupdate(); table->ifnamew = COLS - (70 * COLS / 80) - 3; if (table->ifnamew < 7) table->ifnamew = 7; if (table->ifnamew > IFNAMSIZ) table->ifnamew = IFNAMSIZ; table->head = table->tail = NULL; table->firstvisible = table->lastvisible = NULL; table->tcpscreen = newwin(table->imaxy, COLS - 2, 2, 1); table->tcppanel = new_panel(table->tcpscreen); table->closedentries = table->closedtail = NULL; wattrset(table->tcpscreen, BOXATTR); tx_colorwin(table->tcpscreen); table->lastpos = 0; table->count = 0; wtimeout(table->tcpscreen, -1); tx_stdwinset(table->tcpscreen); print_tcp_num_entries(table); /* * Initialize hash table to nulls */ for (i = 0; i <= ENTRIES_IN_HASH_TABLE - 1; i++) { table->hash_table[i] = NULL; table->hash_tails[i] = NULL; } table->barptr = NULL; table->baridx = 0; } /* * Add a TCP entry to the hash table. */ static void add_tcp_hash_entry(struct tcptable *table, struct tcptableent *entry) { unsigned int hp; /* hash position in table */ struct tcp_hashentry *ptmp; hp = tcp_hash(&entry->saddr, &entry->daddr, entry->ifname); ptmp = xmallocz(sizeof(struct tcp_hashentry)); /* * Add backpointer from screen node to hash node for deletion later * (Actually point to its predecessor coz of the header cell). */ entry->hash_node = ptmp; /* * Update hash node and add it to list. */ ptmp->tcpnode = entry; ptmp->hp = hp; if (table->hash_table[hp] == NULL) { ptmp->prev_entry = NULL; table->hash_table[hp] = ptmp; ptmp->index = 1; } if (table->hash_tails[hp] != NULL) { table->hash_tails[hp]->next_entry = ptmp; ptmp->prev_entry = table->hash_tails[hp]; ptmp->index = ptmp->prev_entry->index + 1; } table->hash_tails[hp] = ptmp; ptmp->next_entry = NULL; } /* * Delete a hash table node */ static void del_tcp_hash_node(struct tcptable *table, struct tcptableent *entry) { struct tcp_hashentry *ptmp; ptmp = entry->hash_node; /* ptmp now points to the target */ /* * If the targeted node is the last entry, adjust the corresponding tail * pointer to the preceeding node; */ if (ptmp->next_entry == NULL) table->hash_tails[ptmp->hp] = ptmp->prev_entry; if (ptmp->prev_entry != NULL) ptmp->prev_entry->next_entry = ptmp->next_entry; else table->hash_table[ptmp->hp] = ptmp->next_entry; if (ptmp->next_entry != NULL) ptmp->next_entry->prev_entry = ptmp->prev_entry; free(ptmp); } /* * Add a new entry to the TCP screen table */ struct tcptableent *addentry(struct tcptable *table, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, int protocol, char *ifname, int *rev_lookup, int rvnfd) { struct tcptableent *new_entry; struct closedlist *ctemp; /* * Allocate and attach a new node if no closed entries found */ if (table->closedentries == NULL) { new_entry = xmalloc(sizeof(struct tcptableent)); new_entry->oth_connection = xmalloc(sizeof(struct tcptableent)); new_entry->oth_connection->oth_connection = new_entry; if (table->head == NULL) { new_entry->prev_entry = NULL; table->head = new_entry; table->firstvisible = new_entry; } if (table->tail != NULL) { table->tail->next_entry = new_entry; new_entry->prev_entry = table->tail; } table->lastpos++; new_entry->index = table->lastpos; table->lastpos++; new_entry->oth_connection->index = table->lastpos; table->tail = new_entry->oth_connection; new_entry->next_entry = new_entry->oth_connection; new_entry->next_entry->prev_entry = new_entry; new_entry->next_entry->next_entry = NULL; if (new_entry->oth_connection->index <= table->firstvisible->index + (table->imaxy - 1)) table->lastvisible = new_entry->oth_connection; else if (new_entry->index <= table->firstvisible->index + (table->imaxy - 1)) table->lastvisible = new_entry; new_entry->reused = new_entry->oth_connection->reused = 0; table->count++; rate_alloc(&new_entry->rate, 5); rate_alloc(&new_entry->oth_connection->rate, 5); print_tcp_num_entries(table); } else { /* * If we reach this point, we're allocating off the list of closed * entries. In this case, we take the top entry, let the new_entry * variable point to whatever the top is pointing to. The new_entry's * oth_connection also points to the reused entry's oth_connection */ new_entry = table->closedentries->closedentry; new_entry->oth_connection = table->closedentries->pair; ctemp = table->closedentries; table->closedentries = table->closedentries->next_entry; free(ctemp); /* * Mark the closed list's tail as NULL if we use the last entry * in the list to prevent a dangling reference. */ if (table->closedentries == NULL) table->closedtail = NULL; new_entry->reused = new_entry->oth_connection->reused = 1; /* * Delete the old hash entries for this reallocated node; */ del_tcp_hash_node(table, new_entry); del_tcp_hash_node(table, new_entry->oth_connection); } /* * Fill in address fields with raw IP addresses */ sockaddr_copy(&new_entry->saddr, saddr); sockaddr_copy(&new_entry->oth_connection->daddr, saddr); sockaddr_copy(&new_entry->daddr, daddr); sockaddr_copy(&new_entry->oth_connection->saddr, daddr); new_entry->protocol = protocol; /* * Initialize count fields */ new_entry->pcount = new_entry->bcount = 0; new_entry->win = new_entry->psize = 0; new_entry->timedout = new_entry->oth_connection->timedout = 0; new_entry->oth_connection->pcount = new_entry->oth_connection->bcount = 0; new_entry->oth_connection->win = new_entry->oth_connection->psize = 0; /* * Store interface name */ strcpy(new_entry->ifname, ifname); strcpy(new_entry->oth_connection->ifname, ifname); /* * Zero out MAC address fields */ memset(new_entry->smacaddr, 0, sizeof(new_entry->smacaddr)); memset(new_entry->oth_connection->smacaddr, 0, sizeof(new_entry->oth_connection->smacaddr)); new_entry->stat = new_entry->oth_connection->stat = 0; new_entry->s_fstat = revname(rev_lookup, &new_entry->saddr, new_entry->s_fqdn, sizeof(new_entry->s_fqdn), rvnfd); new_entry->d_fstat = revname(rev_lookup, &new_entry->daddr, new_entry->d_fqdn, sizeof(new_entry->d_fqdn), rvnfd); /* set port service names (where applicable) */ servlook(sockaddr_get_port(saddr), IPPROTO_TCP, new_entry->s_sname, 10); servlook(sockaddr_get_port(daddr), IPPROTO_TCP, new_entry->d_sname, 10); strcpy(new_entry->oth_connection->s_sname, new_entry->d_sname); strcpy(new_entry->oth_connection->d_sname, new_entry->s_sname); strcpy(new_entry->oth_connection->d_fqdn, new_entry->s_fqdn); strcpy(new_entry->oth_connection->s_fqdn, new_entry->d_fqdn); new_entry->oth_connection->s_fstat = new_entry->d_fstat; new_entry->oth_connection->d_fstat = new_entry->s_fstat; if (new_entry->index < new_entry->oth_connection->index) { new_entry->half_bracket = ACS_ULCORNER; new_entry->oth_connection->half_bracket = ACS_LLCORNER; } else { new_entry->half_bracket = ACS_LLCORNER; new_entry->oth_connection->half_bracket = ACS_ULCORNER; } new_entry->inclosed = new_entry->oth_connection->inclosed = 0; new_entry->finack = new_entry->oth_connection->finack = 0; new_entry->finsent = new_entry->oth_connection->finsent = 0; new_entry->partial = new_entry->oth_connection->partial = 0; new_entry->spanbr = new_entry->oth_connection->spanbr = 0; new_entry->conn_starttime = new_entry->oth_connection->conn_starttime = time(NULL); rate_init(&new_entry->rate); rate_init(&new_entry->oth_connection->rate); /* * Mark flow rate start time and byte counter for flow computation * if the highlight bar is on either flow of the new connection. */ if (table->barptr == new_entry) { new_entry->starttime = time(NULL); new_entry->spanbr = 0; } else if (table->barptr == new_entry->oth_connection) { new_entry->oth_connection->starttime = time(NULL); new_entry->oth_connection->spanbr = 0; } /* * Add entries to hash table */ add_tcp_hash_entry(table, new_entry); add_tcp_hash_entry(table, new_entry->oth_connection); return new_entry; } void addtoclosedlist(struct tcptable *table, struct tcptableent *entry) { struct closedlist *ctemp; ctemp = xmalloc(sizeof(struct closedlist)); /* * Point to closed entries */ ctemp->closedentry = entry; ctemp->pair = entry->oth_connection; entry->inclosed = entry->oth_connection->inclosed = 1; /* * Add node to closed entry list. */ if (table->closedtail != NULL) table->closedtail->next_entry = ctemp; table->closedtail = ctemp; table->closedtail->next_entry = NULL; if (table->closedentries == NULL) table->closedentries = ctemp; } static char *tcplog_flowrate_msg(struct tcptableent *entry, char *buf, size_t bufsize) { time_t interval = time(NULL) - entry->conn_starttime; char rbuf[64]; rate_print(entry->bcount / interval, rbuf, sizeof(rbuf)); snprintf(buf, bufsize - 1, "avg flow rate %s", rbuf); buf[bufsize - 1] = '\0'; return buf; } void write_timeout_log(int logging, FILE *logfile, struct tcptableent *tcpnode) { char msgstring[MSGSTRING_MAX]; if (logging) { char flowrate1[64]; char flowrate2[64]; snprintf(msgstring, MSGSTRING_MAX, "TCP; Connection %s:%s to %s:%s timed out, %lu packets, %lu bytes, %s; opposite direction %lu packets, %lu bytes, %s", tcpnode->s_fqdn, tcpnode->s_sname, tcpnode->d_fqdn, tcpnode->d_sname, tcpnode->pcount, tcpnode->bcount, tcplog_flowrate_msg(tcpnode, flowrate1, sizeof(flowrate1)), tcpnode->oth_connection->pcount, tcpnode->oth_connection->bcount, tcplog_flowrate_msg(tcpnode->oth_connection, flowrate2, sizeof(flowrate2))); writelog(logging, logfile, msgstring); } } struct tcptableent *in_table(struct tcptable *table, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, char *ifname, int logging, FILE *logfile, time_t timeout) { struct tcp_hashentry *hashptr; unsigned int hp; time_t now; if (table->head == NULL) { return 0; } /* * Determine hash table index for this set of addresses and ports */ hp = tcp_hash(saddr, daddr, ifname); hashptr = table->hash_table[hp]; while (hashptr != NULL) { if (sockaddr_is_equal(&hashptr->tcpnode->saddr, saddr) && sockaddr_is_equal(&hashptr->tcpnode->daddr, daddr) && (strcmp(hashptr->tcpnode->ifname, ifname) == 0)) break; now = time(NULL); /* * Add the timed out entries to the closed list in case we didn't * find any closed ones. */ if ((timeout > 0) && ((now - hashptr->tcpnode->lastupdate) / 60 > timeout) && (!(hashptr->tcpnode->inclosed))) { hashptr->tcpnode->timedout = 1; hashptr->tcpnode->oth_connection->timedout = 1; addtoclosedlist(table, hashptr->tcpnode); if (logging) write_timeout_log(logging, logfile, hashptr->tcpnode); } hashptr = hashptr->next_entry; } if (hashptr != NULL) { /* needed to avoid SIGSEGV */ if ((((hashptr->tcpnode->finsent == 2) && (hashptr->tcpnode->oth_connection->finsent == 2))) || (((hashptr->tcpnode->stat & FLAG_RST) || (hashptr->tcpnode->oth_connection-> stat & FLAG_RST)))) { return NULL; } else { return hashptr->tcpnode; } } else { return NULL; } } /* * Update the TCP status record should an applicable packet arrive. */ void updateentry(struct tcptable *table, struct tcptableent *tableentry, struct tcphdr *transpacket, char *packet, int linkproto, unsigned long packetlength, unsigned int bcount, unsigned int fragofs, int logging, int *revlook, int rvnfd, FILE *logfile) { char msgstring[MSGSTRING_MAX]; char newmacaddr[18]; if (tableentry->s_fstat != RESOLVED) { tableentry->s_fstat = revname(revlook, &tableentry->saddr, tableentry->s_fqdn, sizeof(tableentry->s_fqdn), rvnfd); strcpy(tableentry->oth_connection->d_fqdn, tableentry->s_fqdn); tableentry->oth_connection->d_fstat = tableentry->s_fstat; } if (tableentry->d_fstat != RESOLVED) { tableentry->d_fstat = revname(revlook, &tableentry->daddr, tableentry->d_fqdn, sizeof(tableentry->d_fqdn), rvnfd); strcpy(tableentry->oth_connection->s_fqdn, tableentry->d_fqdn); tableentry->oth_connection->s_fstat = tableentry->d_fstat; } tableentry->pcount++; tableentry->bcount += bcount; tableentry->psize = packetlength; tableentry->spanbr += bcount; if (options.mac) { memset(newmacaddr, 0, sizeof(newmacaddr)); /* change updateentry to take struct pkt to remove this */ if (linkproto == ARPHRD_ETHER) { convmacaddr((char *) (((struct ethhdr *) packet)-> h_source), newmacaddr); } else if (linkproto == ARPHRD_FDDI) { convmacaddr((char *) (((struct fddihdr *) packet)-> saddr), newmacaddr); } if (tableentry->smacaddr[0] != '\0') { if (strcmp(tableentry->smacaddr, newmacaddr) != 0) { snprintf(msgstring, MSGSTRING_MAX, "TCP; %s; from %s:%s to %s:%s: new source MAC address %s (previously %s)", tableentry->ifname, tableentry->s_fqdn, tableentry->s_sname, tableentry->d_fqdn, tableentry->d_sname, newmacaddr, tableentry->smacaddr); writelog(logging, logfile, msgstring); strcpy(tableentry->smacaddr, newmacaddr); } } else strcpy(tableentry->smacaddr, newmacaddr); } /* * If this is not the first TCP fragment, skip interpretation of the * TCP header. */ if ((ntohs(fragofs) & 0x1fff) != 0) { tableentry->lastupdate = tableentry->oth_connection->lastupdate = time(NULL); return; } /* * At this point, we have a TCP header, and we proceed to process it. */ if (tableentry->pcount == 1) { if ((transpacket->syn) || (transpacket->rst)) tableentry->partial = 0; else tableentry->partial = 1; } tableentry->win = ntohs(transpacket->window); tableentry->stat = 0; if (transpacket->syn) tableentry->stat |= FLAG_SYN; if (transpacket->ack) { tableentry->stat |= FLAG_ACK; /* * The following sequences are used when the ACK is in response to * a FIN (see comments for FIN below). If the opposite direction * already has its indicator set to 1 (FIN sent, not ACKed), and * the incoming ACK has the same sequence number as the previously * stored FIN's ack number (i.e. the ACK in response to the opposite * flow's FIN), the opposite direction's state is set to 2 (FIN sent * and ACKed). */ if ((tableentry->oth_connection->finsent == 1) && (ntohl(transpacket->seq) == tableentry->oth_connection->finack)) { tableentry->oth_connection->finsent = 2; if (logging) { writetcplog(logging, logfile, tableentry, tableentry->psize, "FIN acknowleged"); } } } /* * The closing sequence is similar, but not identical to the TCP close * sequence described in the RFC. This sequence is primarily cosmetic. * * When a FIN is sent in a direction, a state indicator is set to 1, * to indicate a FIN sent, but not ACKed yet. For comparison later, * the acknowlegement number is also saved in the entry. See comments * in ACK above. */ if (transpacket->fin) { /* * First, we check if the opposite direction has no counts, in which * case we simply mark the entire connection available for reuse. * This is in case packets from a machine pass an interface, but * on the return, completely bypasses any interface on our machine. * * Q: Could such a situation really happen in practice? I managed to * do it but under *really* ridiculous circumstances. * * A: (as of version 2.5.0, June 2001): Yes this DOES happen in * practice. Unidirectional satellite feeds can send data straight * to a remote network using you as your upstream. */ if (tableentry->oth_connection->pcount == 0) addtoclosedlist(table, tableentry); else { /* * That aside, mark the direction as being done, and make it * ready for a complete close upon receipt of an ACK. We save * the acknowlegement number for identification of the proper * ACK packet when it arrives in the other direction. */ tableentry->finsent = 1; tableentry->finack = ntohl(transpacket->ack_seq); } if (logging) { char flowrate[64]; sprintf(msgstring, "FIN sent; %lu packets, %lu bytes, %s", tableentry->pcount, tableentry->bcount, tcplog_flowrate_msg(tableentry, flowrate, sizeof(flowrate))); writetcplog(logging, logfile, tableentry, tableentry->psize, msgstring); } } if (transpacket->rst) { tableentry->stat |= FLAG_RST; if (!(tableentry->inclosed)) addtoclosedlist(table, tableentry); if (logging) { char flowrate1[64]; char flowrate2[64]; snprintf(msgstring, MSGSTRING_MAX, "Connection reset; %lu packets, %lu bytes, %s; opposite direction %lu packets, %lu bytes; %s", tableentry->pcount, tableentry->bcount, tcplog_flowrate_msg(tableentry, flowrate1, sizeof(flowrate1)), tableentry->oth_connection->pcount, tableentry->oth_connection->bcount, tcplog_flowrate_msg(tableentry->oth_connection, flowrate2, sizeof(flowrate2))); writetcplog(logging, logfile, tableentry, tableentry->psize, msgstring); } } if (transpacket->psh) tableentry->stat |= FLAG_PSH; if (transpacket->urg) tableentry->stat |= FLAG_URG; tableentry->lastupdate = tableentry->oth_connection->lastupdate = time(NULL); /* * Shall we add this entry to the closed entry list? If both * directions have their state indicators set to 2, or one direction * is set to 2, and the other 1, that's it. */ if ((!tableentry->inclosed) && (((tableentry->finsent == 2) && ((tableentry->oth_connection->finsent == 1) || (tableentry->oth_connection->finsent == 2))) || ((tableentry->oth_connection->finsent == 2) && ((tableentry->finsent == 1) || (tableentry->finsent == 2))))) addtoclosedlist(table, tableentry); } /* * Clears out the resolved IP addresses from the window. This prevents * overlapping port numbers (in cases where the resolved DNS name is shorter * than its IP address), that may cause the illusion of large ports. Plus, * such output, while may be interpreted by people with a little know-how, * is just plain wrong. * * Returns immediately if the entry is not visible in the window. */ void clearaddr(struct tcptable *table, struct tcptableent *tableentry, unsigned int screen_idx) { unsigned int target_row; if ((tableentry->index < screen_idx) || (tableentry->index > screen_idx + (table->imaxy - 1))) return; target_row = (tableentry->index) - screen_idx; wmove(table->tcpscreen, target_row, 1); wprintw(table->tcpscreen, "%44c", ' '); } /* * Display a TCP connection line. Returns immediately if the entry is * not visible in the window. */ void printentry(struct tcptable *table, struct tcptableent *tableentry, unsigned int screen_idx, int mode) { char stat[7] = ""; unsigned int target_row; char sp_buf[MSGSTRING_MAX]; int normalattr; int highattr; /* * Set appropriate attributes for this entry */ if (table->barptr == tableentry) { normalattr = BARSTDATTR; highattr = BARHIGHATTR; } else { normalattr = STDATTR; highattr = HIGHATTR; } if ((tableentry->index < screen_idx) || (tableentry->index > screen_idx + (table->imaxy - 1))) return; target_row = (tableentry->index) - screen_idx; /* clear the data if it's a reused entry */ wattrset(table->tcpscreen, PTRATTR); wmove(table->tcpscreen, target_row, 2); if (tableentry->reused) { scrollok(table->tcpscreen, 0); sprintf(sp_buf, "%%%dc", COLS - 4); wprintw(table->tcpscreen, sp_buf, ' '); scrollok(table->tcpscreen, 1); tableentry->reused = 0; wmove(table->tcpscreen, target_row, 1); } /* print half of connection indicator bracket */ wmove(table->tcpscreen, target_row, 0); waddch(table->tcpscreen, tableentry->half_bracket); /* proceed with the actual entry */ wattrset(table->tcpscreen, normalattr); sprintf(sp_buf, "%%%dc", COLS - 5); mvwprintw(table->tcpscreen, target_row, 2, sp_buf, ' '); sprintf(sp_buf, "%%.%ds:%%.%ds", 32 * COLS / 80, 10); wmove(table->tcpscreen, target_row, 1); wprintw(table->tcpscreen, sp_buf, tableentry->s_fqdn, tableentry->s_sname); wattrset(table->tcpscreen, highattr); /* * Print packet and byte counts or window size and packet size, depending * on the value of mode. */ switch (mode) { case 0: wmove(table->tcpscreen, target_row, 47 * COLS / 80 - 2); if (tableentry->partial) wprintw(table->tcpscreen, ">"); else wprintw(table->tcpscreen, "="); wprintw(table->tcpscreen, "%8u ", tableentry->pcount); wmove(table->tcpscreen, target_row, 59 * COLS / 80 - 4); wprintw(table->tcpscreen, "%9u ", tableentry->bcount); break; case 1: wmove(table->tcpscreen, target_row, 50 * COLS / 80); if (tableentry->smacaddr[0] == '\0') wprintw(table->tcpscreen, " N/A "); else wprintw(table->tcpscreen, "%s", tableentry->smacaddr); break; case 2: wmove(table->tcpscreen, target_row, 45 * COLS / 80 + 3); wprintw(table->tcpscreen, "%5u ", tableentry->psize); wmove(table->tcpscreen, target_row, 56 * COLS / 80 - 1); wprintw(table->tcpscreen, "%9u ", tableentry->win); } wattrset(table->tcpscreen, normalattr); if (tableentry->finsent == 1) strcpy(stat, "DONE"); else if (tableentry->finsent == 2) strcpy(stat, "CLOS"); else if (tableentry->stat & FLAG_RST) strcpy(stat, "RSET"); else { strcat(stat, (tableentry->stat & FLAG_SYN) ? "S" : "-"); strcat(stat, (tableentry->stat & FLAG_PSH) ? "P" : "-"); strcat(stat, (tableentry->stat & FLAG_ACK) ? "A" : "-"); strcat(stat, (tableentry->stat & FLAG_URG) ? "U" : "-"); } wmove(table->tcpscreen, target_row, 65 * COLS / 80); wprintw(table->tcpscreen, "%4.4s", stat); wmove(table->tcpscreen, target_row, 70 * COLS / 80); wprintw(table->tcpscreen, "%-*.*s", table->ifnamew, table->ifnamew, tableentry->ifname); } /* * Redraw the TCP window */ void refreshtcpwin(struct tcptable *table, unsigned int idx, int mode) { struct tcptableent *ptmp; setlabels(table->borderwin, mode); wattrset(table->tcpscreen, STDATTR); tx_colorwin(table->tcpscreen); ptmp = table->firstvisible; while ((ptmp != NULL) && (ptmp->prev_entry != table->lastvisible)) { printentry(table, ptmp, idx, mode); ptmp = ptmp->next_entry; } wmove(table->borderwin, table->bmaxy - 1, 1); print_tcp_num_entries(table); update_panels(); doupdate(); } static void destroy_closed_entries(struct tcptable *table) { struct closedlist *closedtemp; struct closedlist *closedtemp_next; if (table->closedentries != NULL) { closedtemp = table->closedentries; closedtemp_next = table->closedentries->next_entry; while (closedtemp != NULL) { free(closedtemp); closedtemp = closedtemp_next; if (closedtemp_next != NULL) closedtemp_next = closedtemp_next->next_entry; } table->closedentries = NULL; table->closedtail = NULL; } } /* * Kill the entire TCP table */ void destroytcptable(struct tcptable *table) { struct tcptableent *ctemp; struct tcptableent *c_next_entry; struct tcp_hashentry *hashtemp; struct tcp_hashentry *hashtemp_next; unsigned int i; /* * Destroy main TCP table */ if (table->head != NULL) { ctemp = table->head; c_next_entry = table->head->next_entry; while (ctemp != NULL) { rate_destroy(&ctemp->rate); free(ctemp); ctemp = c_next_entry; if (c_next_entry != NULL) c_next_entry = c_next_entry->next_entry; } } /* * Destroy list of closed entries */ destroy_closed_entries(table); /* * Destroy hash table */ for (i = 0; i <= ENTRIES_IN_HASH_TABLE - 1; i++) { if (table->hash_table[i] != NULL) { hashtemp = table->hash_table[i]; hashtemp_next = table->hash_table[i]->next_entry; while (hashtemp != NULL) { free(hashtemp); hashtemp = hashtemp_next; if (hashtemp_next != NULL) hashtemp_next = hashtemp_next->next_entry; } } } } /* * Kill an entry from the TCP table */ static void destroy_tcp_entry(struct tcptable *table, struct tcptableent *ptmp) { if (ptmp->prev_entry != NULL) ptmp->prev_entry->next_entry = ptmp->next_entry; else table->head = ptmp->next_entry; if (ptmp->next_entry != NULL) ptmp->next_entry->prev_entry = ptmp->prev_entry; else table->tail = ptmp->prev_entry; rate_destroy(&ptmp->rate); free(ptmp); if (table->head == NULL) { table->firstvisible = NULL; table->lastvisible = NULL; } } /* * Kill all closed entries from the table, and clear the list of closed * entries. */ void flushclosedentries(struct tcptable *table, unsigned long *screen_idx, int logging, FILE *logfile) { struct tcptableent *ptmp = table->head; struct tcptableent *ctmp = NULL; unsigned long idx = 1; time_t now; time_t lastupdated = 0; while (ptmp != NULL) { now = time(NULL); lastupdated = (now - ptmp->lastupdate) / 60; if ((ptmp->inclosed) || (lastupdated > options.timeout)) { ctmp = ptmp; /* * Mark and flush timed out TCP entries. */ if (lastupdated > options.timeout) { if ((!(ptmp->timedout)) && (!(ptmp->inclosed))) { write_timeout_log(logging, logfile, ptmp); ptmp->timedout = ptmp->oth_connection->timedout = 1; } } /* * Advance to next entry and destroy target entry. */ ptmp = ptmp->next_entry; /* * If the targeted entry is highlighted, and the next entry is * not NULL (we're still in the list) we move the bar pointer to * the next entry otherwise we move it to the previous entry. */ if (ptmp != NULL) { if (table->barptr == ctmp) { table->barptr = ptmp; } } else { if (table->barptr == ctmp) { table->barptr = table->barptr->prev_entry; } } /* * Do the dirty deed */ del_tcp_hash_node(table, ctmp); destroy_tcp_entry(table, ctmp); /* * Adjust screen index if the deleted entry was "above" * the screen. */ if (idx < *screen_idx) (*screen_idx)--; } else { /* * Set the first visible pointer once the index matches * the screen index. */ if (idx == *screen_idx) table->firstvisible = ptmp; /* * Keep setting the last visible pointer until the scan * index "leaves" the screen */ if (idx <= (*screen_idx) + (table->imaxy - 1)) table->lastvisible = ptmp; ptmp->index = idx; idx++; ptmp = ptmp->next_entry; } } table->lastpos = idx - 1; table->count = table->lastpos / 2; destroy_closed_entries(table); /* * Shift entries down if the deletion causes the last entry to * occupy anywhere other than the last line of the TCP display * window. */ if (table->head != NULL) { /* * Point screen index to the last table entry if the tail entry is * "above" the screen index. Set the firstvisible pointer to that * as well. */ if (table->tail->index < *screen_idx) { *screen_idx = table->tail->index; table->firstvisible = table->tail; } /* * Move the screen index and firstvisible entry up until the tail * hits the bottom of the window (tail is at screen index plus * screen length minus 1) or the firstvisible pointer hits the * head of the table. The highlight bar should "go along" with * the shifting. */ while ((table->tail->index < *screen_idx + table->imaxy - 1) && (table->firstvisible->prev_entry != NULL)) { table->firstvisible = table->firstvisible->prev_entry; (*screen_idx)--; } /* * Set the bar position index once everything's done. */ table->baridx = table->barptr->index - *screen_idx + 1; } } void writetcplog(int logging, FILE *fd, struct tcptableent *entry, unsigned int pktlen, char *message) { char msgbuf[MSGSTRING_MAX]; if (logging) { if (options.mac) { snprintf(msgbuf, MSGSTRING_MAX, "TCP; %s; %u bytes; from %s:%s to %s:%s (source MAC addr %s); %s", entry->ifname, pktlen, entry->s_fqdn, entry->s_sname, entry->d_fqdn, entry->d_sname, entry->smacaddr, message); } else { snprintf(msgbuf, MSGSTRING_MAX, "TCP; %s; %u bytes; from %s:%s to %s:%s; %s", entry->ifname, pktlen, entry->s_fqdn, entry->s_sname, entry->d_fqdn, entry->d_sname, message); } writelog(logging, fd, msgbuf); } } void write_tcp_unclosed(int logging, FILE *fd, struct tcptable *table) { char msgbuf[MSGSTRING_MAX]; struct tcptableent *entry = table->head; while (entry != NULL) { if ((entry->finsent == 0) && ((entry->stat & FLAG_RST) == 0) && (!(entry->inclosed))) { sprintf(msgbuf, "TCP; %s; active; from %s:%s to %s:%s; %lu packets, %lu bytes", entry->ifname, entry->s_fqdn, entry->s_sname, entry->d_fqdn, entry->d_sname, entry->pcount, entry->bcount); writelog(logging, fd, msgbuf); } entry = entry->next_entry; } } iptraf-ng-1.1.4/src/tcptable.h0000664000076400007640000000766312173477703016453 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TCPTABLE_H #define IPTRAF_NG_TCPTABLE_H /*** tcptable.h -- table manipulation for the statistics display. ***/ #include "rate.h" /* * max() macros that also do * strict type-checking.. See the * "unnecessary" pointer comparison. */ #define max(x, y) ({ \ typeof(x) _max1 = (x); \ typeof(y) _max2 = (y); \ (void) (&_max1 == &_max2); \ _max1 > _max2 ? _max1 : _max2; }) #define FLAG_SYN 1 #define FLAG_RST 2 #define FLAG_PSH 4 #define FLAG_ACK 8 #define FLAG_URG 16 #define CLOSED 64 #define ENTRIES_IN_HASH_TABLE 1543 struct tcptableent { struct sockaddr_storage saddr; struct sockaddr_storage daddr; char s_fqdn[45]; /* fully-qualified domain names */ char d_fqdn[45]; int s_fstat; int d_fstat; char smacaddr[18]; char s_sname[11]; /* Service names, maxlen=10 */ char d_sname[11]; unsigned int protocol; unsigned long pcount; /* packet count */ unsigned long bcount; /* byte count */ unsigned int stat; /* TCP flags */ unsigned int win; unsigned int psize; unsigned long finack; int partial; int finsent; char ifname[IFNAMSIZ]; unsigned int index; int reused; int timedout; int inclosed; int half_bracket; unsigned long spanbr; struct rate rate; time_t lastupdate; time_t starttime; time_t conn_starttime; struct tcp_hashentry *hash_node; struct tcptableent *oth_connection; /* the other half of the connection */ struct tcptableent *prev_entry; struct tcptableent *next_entry; }; struct closedlist { struct tcptableent *closedentry; struct tcptableent *pair; struct closedlist *next_entry; }; struct tcp_hashentry { unsigned int index; unsigned int hp; /* index position in bucket array */ struct tcptableent *tcpnode; struct tcp_hashentry *prev_entry; struct tcp_hashentry *next_entry; }; struct tcptable { struct tcp_hashentry *hash_table[ENTRIES_IN_HASH_TABLE]; struct tcp_hashentry *hash_tails[ENTRIES_IN_HASH_TABLE]; struct tcptableent *head; struct tcptableent *tail; struct closedlist *closedentries; struct closedlist *closedtail; struct tcptableent *firstvisible; struct tcptableent *lastvisible; struct tcptableent *barptr; unsigned int baridx; unsigned int lastpos; unsigned int count; unsigned int bmaxy; /* number of lines of the border window */ unsigned int imaxy; /* number of lines inside the border */ int ifnamew; /* interface name width to display */ WINDOW *tcpscreen; PANEL *tcppanel; WINDOW *borderwin; PANEL *borderpanel; }; void init_tcp_table(struct tcptable *table); struct tcptableent *addentry(struct tcptable *table, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, int protocol, char *ifname, int *rev_lookup, int rvnamedon); struct tcptableent *in_table(struct tcptable *table, struct sockaddr_storage *saddr, struct sockaddr_storage *daddr, char *ifname, int logging, FILE *logfile, time_t timeout); void updateentry(struct tcptable *table, struct tcptableent *tableentry, struct tcphdr *transpacket, char *packet, int linkproto, unsigned long packetlength, unsigned int bcount, unsigned int fragofs, int logging, int *revlook, int rvnfd, FILE *logfile); void addtoclosedlist(struct tcptable *table, struct tcptableent *tableentry); void clearaddr(struct tcptable *table, struct tcptableent *tableentry, unsigned int screen_idx); void printentry(struct tcptable *table, struct tcptableent *tableentry, unsigned int screen_idx, int mode); void refreshtcpwin(struct tcptable *table, unsigned int idx, int mode); void destroytcptable(struct tcptable *table); void flushclosedentries(struct tcptable *table, unsigned long *screen_idx, int logging, FILE *logfile); void write_timeout_log(int logging, FILE *logfile, struct tcptableent *tcpnode); void writetcplog(int logging, FILE *fd, struct tcptableent *entry, unsigned int pktlen, char *message); void write_tcp_unclosed(int logging, FILE *fd, struct tcptable *table); #endif /* IPTRAF_NG_TCPTABLE_H */ iptraf-ng-1.1.4/src/timer.c0000664000076400007640000000104612173477703015755 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** timer.c - module to display the elapsed time since a facility was started ***/ #include "iptraf-ng-compat.h" void printelapsedtime(time_t start, time_t now, int y, int x, WINDOW * win) { time_t elapsed; unsigned int hours; unsigned int mins; elapsed = now - start; hours = elapsed / 3600; mins = (elapsed % 3600) / 60; wmove(win, y, x); wprintw(win, " Elapsed time: %3u:%02u ", hours, mins); } iptraf-ng-1.1.4/src/timer.h0000664000076400007640000000024212173477703015757 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TIMER_H #define IPTRAF_NG_TIMER_H void printelapsedtime(time_t start, time_t now, int y, int x, WINDOW * win); #endif /* IPTRAF_NG_TIMER_H */ iptraf-ng-1.1.4/src/tui/0000775000076400007640000000000012173477703015271 5ustar npajkovsnpajkovsiptraf-ng-1.1.4/src/tui/README0000664000076400007640000000206612173477703016155 0ustar npajkovsnpajkovs========================================================================= IPTraf User Interface Support Library README ------------------------------------------------------------------------- Some of the more reusable user-interface functions originally part of the IPTraf source tree have been recoded and moved to this directory as a support library. This way it would be easier for interested developers to use these functions in other programs. Full programming information will be provided in an upcoming separate release of this library although documentation may be provided via mail should there be any requests for it. Then again, there's always the IPTraf source code. RELEASE INFORMATION This is currently code derived from IPTraf, and is for now released under the GNU General Public License version 2 or any later version. I may release it as a separate package soon under a less restrictive license. Should you be interested in this little library, and you have a concern regarding the GPL, I can still be reached privately via . Gerard iptraf-ng-1.1.4/src/tui/input.c0000664000076400007640000000727112173477703016603 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** input.c - a custom keyboard input module ***/ #include "iptraf-ng-compat.h" #include "input.h" void tx_initfields(struct FIELDLIST *list, int leny, int lenx, int begy, int begx, int dlgtextattr, int fieldattr) { list->list = NULL; list->fieldwin = newwin(leny, lenx, begy, begx); list->fieldpanel = new_panel(list->fieldwin); tx_stdwinset(list->fieldwin); wtimeout(list->fieldwin, -1); wattrset(list->fieldwin, dlgtextattr); tx_colorwin(list->fieldwin); update_panels(); doupdate(); list->dlgtextattr = dlgtextattr; list->fieldattr = fieldattr; } void tx_addfield(struct FIELDLIST *list, unsigned int len, unsigned int y, unsigned int x, const char *initstr) { struct FIELD *newfield; unsigned int i; newfield = xmalloc(sizeof(struct FIELD)); if (list->list == NULL) { list->list = newfield; newfield->prevfield = newfield; newfield->nextfield = newfield; } else { newfield->prevfield = list->list->prevfield; list->list->prevfield->nextfield = newfield; list->list->prevfield = newfield; newfield->nextfield = list->list; } newfield->xpos = x; newfield->ypos = y; newfield->len = len; newfield->tlen = strlen(initstr); newfield->buf = xmallocz(len + 1); strncpy(newfield->buf, initstr, len); if (newfield->tlen > (len)) newfield->tlen = len; wattrset(list->fieldwin, list->fieldattr); wmove(list->fieldwin, y, x); for (i = 1; i <= len; i++) wprintw(list->fieldwin, " "); wmove(list->fieldwin, y, x); wprintw(list->fieldwin, "%s", newfield->buf); update_panels(); doupdate(); } void tx_getinput(struct FIELDLIST *list, struct FIELD *field, int *exitkey) { int ch; int y, x; int endloop = 0; wmove(list->fieldwin, field->ypos, field->xpos); wattrset(list->fieldwin, list->fieldattr); wprintw(list->fieldwin, "%s", field->buf); update_panels(); doupdate(); do { ch = wgetch(list->fieldwin); switch (ch) { case KEY_BACKSPACE: case 7: case 8: case KEY_DC: case KEY_LEFT: case 127: if (field->tlen > 0) { getyx(list->fieldwin, y, x); x--; wmove(list->fieldwin, y, x); wprintw(list->fieldwin, " "); wmove(list->fieldwin, y, x); field->tlen--; field->buf[field->tlen] = '\0'; } break; case 9: case 27: case 24: case 13: case 10: case KEY_UP: case KEY_DOWN: endloop = 1; *exitkey = ch; break; case 12: tx_refresh_screen(); break; default: if ((field->tlen < field->len) && ((ch >= 32) && (ch <= 127))) { wprintw(list->fieldwin, "%c", ch); if (ch == ' ') { getyx(list->fieldwin, y, x); wmove(list->fieldwin, y, x); } field->buf[field->tlen + 1] = '\0'; field->buf[field->tlen] = ch; field->tlen++; } break; } doupdate(); } while (!endloop); } void tx_fillfields(struct FIELDLIST *list, int *aborted) { struct FIELD *field; int exitkey; int endloop = 0; field = list->list; curs_set(1); do { tx_getinput(list, field, &exitkey); switch (exitkey) { case 9: case KEY_DOWN: field = field->nextfield; break; case KEY_UP: field = field->prevfield; break; case 13: case 10: *aborted = 0; endloop = 1; break; case 27: case 24: *aborted = 1; endloop = 1; break; } } while (!endloop); curs_set(0); } void tx_destroyfields(struct FIELDLIST *list) { struct FIELD *ptmp; struct FIELD *pnext; list->list->prevfield->nextfield = NULL; ptmp = list->list; pnext = list->list->nextfield; do { free(ptmp); ptmp = pnext; if (pnext != NULL) { pnext = pnext->nextfield; } } while (ptmp != NULL); del_panel(list->fieldpanel); delwin(list->fieldwin); } iptraf-ng-1.1.4/src/tui/input.h0000664000076400007640000000163012173477703016601 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_INPUT_H #define IPTRAF_NG_TUI_INPUT_H /*** input.h - structure declarations and function prototypes for input.c ***/ #include "winops.h" #define CTRL_X 24 struct FIELD { char *buf; unsigned int len; unsigned int tlen; unsigned int xpos; unsigned int ypos; struct FIELD *prevfield; struct FIELD *nextfield; }; struct FIELDLIST { struct FIELD *list; WINDOW *fieldwin; PANEL *fieldpanel; int dlgtextattr; int fieldattr; }; void tx_initfields(struct FIELDLIST *list, int leny, int lenx, int begy, int begx, int dlgtextattr, int dlgfieldattr); void tx_addfield(struct FIELDLIST *list, unsigned int len, unsigned int y, unsigned int x, const char *initstr); void tx_getinput(struct FIELDLIST *list, struct FIELD *field, int *exitkey); void tx_fillfields(struct FIELDLIST *list, int *aborted); void tx_destroyfields(struct FIELDLIST *list); #endif /* IPTRAF_NG_TUI_INPUT_H */ iptraf-ng-1.1.4/src/tui/labels.c0000664000076400007640000000202112173477703016672 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /* * labels.c - some common keyhelp printing routines for the iptraf * user interface library */ #include "iptraf-ng-compat.h" #include "winops.h" void tx_printkeyhelp(char *keytext, char *desc, WINDOW * win, int highattr, int textattr) { wattrset(win, highattr); wprintw(win, "%s", keytext); wattrset(win, textattr); wprintw(win, "%s", desc); } void tx_menukeyhelp(int textattr, int highattr) { move(LINES - 1, 1); tx_printkeyhelp("Up/Down", "-Move selector ", stdscr, highattr, textattr); tx_printkeyhelp("Enter", "-execute", stdscr, highattr, textattr); tx_coloreol(); } void tx_listkeyhelp(int textattr, int highattr) { move(LINES - 1, 1); tx_printkeyhelp("Up/Down", "-move pointer ", stdscr, highattr, textattr); tx_printkeyhelp("Enter", "-select ", stdscr, highattr, textattr); tx_printkeyhelp("X/Ctrl+X", "-close list", stdscr, highattr, textattr); tx_coloreol(); } iptraf-ng-1.1.4/src/tui/labels.h0000664000076400007640000000045012173477703016703 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_LABELS_H #define IPTRAF_NG_TUI_LABELS_H void tx_printkeyhelp(char *keytext, char *desc, WINDOW * win, int highattr, int textattr); void tx_menukeyhelp(int textattr, int highattr); void tx_listkeyhelp(int textattr, int highattr); #endif /* IPTRAF_NG_TUI_LABELS_H */ iptraf-ng-1.1.4/src/tui/listbox.c0000664000076400007640000001035112173477703017121 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /* * listbox.c - scrollable listbox management module */ #include "iptraf-ng-compat.h" #include "winops.h" #include "labels.h" #include "listbox.h" #include "msgboxes.h" void tx_init_listbox(struct scroll_list *list, int width, int height, int startx, int starty, int mainattr, int borderattr, int selectattr, int keyattr) { memset(list, 0, sizeof(struct scroll_list)); list->borderwin = newwin(height, width, starty, startx); list->borderpanel = new_panel(list->borderwin); wattrset(list->borderwin, borderattr); tx_box(list->borderwin, ACS_VLINE, ACS_HLINE); list->win = newwin(height - 2, width - 2, starty + 1, startx + 1); list->panel = new_panel(list->win); wattrset(list->win, mainattr); tx_colorwin(list->win); list->mainattr = mainattr; list->selectattr = selectattr; list->height = height; list->width = width; list->keyattr = keyattr; tx_stdwinset(list->win); scrollok(list->win, 0); } void tx_set_listbox_title(struct scroll_list *list, char *text, int x) { mvwprintw(list->borderwin, 0, x, " %s ", text); } void tx_add_list_entry(struct scroll_list *list, char *node, char *text) { struct textlisttype *ptmp; ptmp = xmallocz(sizeof(struct textlisttype)); strncpy(ptmp->text, text, MAX_TEXT_LENGTH); ptmp->nodeptr = node; if (list->textlist == NULL) { list->textlist = ptmp; ptmp->prev_entry = NULL; } else { list->texttail->next_entry = ptmp; ptmp->prev_entry = list->texttail; } list->texttail = ptmp; ptmp->next_entry = NULL; } void tx_show_listbox(struct scroll_list *list) { int i = 0; struct textlisttype *tptr = list->textlist; while ((i <= list->height - 3) && (tptr != NULL)) { mvwprintw(list->win, i, 1, tptr->text); tptr = tptr->next_entry; i++; } update_panels(); doupdate(); } void tx_operate_listbox(struct scroll_list *list, int *keystroke, int *aborted) { int ch; int endloop = 0; int row = 0; char padding[MAX_TEXT_LENGTH]; char sp_buf[10]; if (list->textlist == NULL) { tui_error(ANYKEY_MSG, "No list entries"); *aborted = 1; return; } list->textptr = list->textlist; tx_listkeyhelp(list->mainattr, list->keyattr); update_panels(); doupdate(); while (!endloop) { snprintf(sp_buf, 9, "%%%zuc", list->width - strlen(list->textptr->text) - 3); snprintf(padding, MAX_TEXT_LENGTH - 1, sp_buf, ' '); wattrset(list->win, list->selectattr); mvwprintw(list->win, row, 0, " %s%s", list->textptr->text, padding); ch = wgetch(list->win); wattrset(list->win, list->mainattr); mvwprintw(list->win, row, 0, " %s%s", list->textptr->text, padding); switch (ch) { case KEY_UP: if (list->textptr == NULL) continue; if (list->textptr->prev_entry != NULL) { if (row == 0) { scrollok(list->win, 1); wscrl(list->win, -1); scrollok(list->win, 0); } else row--; list->textptr = list->textptr->prev_entry; } break; case KEY_DOWN: if (list->textptr == NULL) continue; if (list->textptr->next_entry != NULL) { if (row == list->height - 3) { scrollok(list->win, 1); wscrl(list->win, 1); scrollok(list->win, 0); } else row++; list->textptr = list->textptr->next_entry; } break; case 13: *aborted = 0; endloop = 1; break; case 27: case 'x': case 'X': case 24: *aborted = 1; endloop = 1; case 12: case 'l': case 'L': tx_refresh_screen(); break; } } *keystroke = ch; } void tx_hide_listbox(struct scroll_list *list) { hide_panel(list->panel); hide_panel(list->borderpanel); update_panels(); doupdate(); } void tx_unhide_listbox(struct scroll_list *list) { show_panel(list->panel); show_panel(list->panel); update_panels(); doupdate(); } void tx_close_listbox(struct scroll_list *list) { del_panel(list->panel); del_panel(list->borderpanel); delwin(list->win); delwin(list->borderwin); update_panels(); doupdate(); } void tx_destroy_list(struct scroll_list *list) { struct textlisttype *ttmp = list->textlist; struct textlisttype *ctmp; if (ttmp != NULL) { ctmp = ttmp->next_entry; while (ttmp != NULL) { free(ttmp); ttmp = ctmp; if (ctmp != NULL) ctmp = ctmp->next_entry; } } } iptraf-ng-1.1.4/src/tui/listbox.h0000664000076400007640000000272612173477703017135 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_LISTBOX_H #define IPTRAF_NG_TUI_LISTBOX_H #define MAX_TEXT_LENGTH 240 struct textlisttype { char text[MAX_TEXT_LENGTH]; int cellwidth[10]; /* up to 10 cells per line */ char *nodeptr; /* generic pointer, cast to appropriate type */ struct textlisttype *next_entry; struct textlisttype *prev_entry; }; struct scroll_list { char *mainlist; /* generic pointer, cast to appropriate type */ char *mlistptr; /* generic pointer, cast to appropriate type */ struct textlisttype *textlist; /* list of raw text entries */ struct textlisttype *texttail; struct textlisttype *textptr; int height; int width; int mainattr; int selectattr; int keyattr; char *exitkeys; WINDOW *win; PANEL *panel; WINDOW *borderwin; PANEL *borderpanel; }; void tx_init_listbox(struct scroll_list *list, int width, int height, int startx, int starty, int mainattr, int borderattr, int selectattr, int keyattr); void tx_set_listbox_title(struct scroll_list *list, char *text, int x); void tx_add_list_entry(struct scroll_list *list, char *node, char *text); void tx_show_listbox(struct scroll_list *list); void tx_operate_listbox(struct scroll_list *list, int *keystroke, int *aborted); void tx_hide_listbox(struct scroll_list *list); void tx_unhide_listbox(struct scroll_list *list); void tx_close_listbox(struct scroll_list *list); void tx_destroy_list(struct scroll_list *list); #define tx_destroy_listbox tx_destroy_list #endif /* IPTRAF_NG_TUI_LISTBOX_H */ iptraf-ng-1.1.4/src/tui/menurt.c0000664000076400007640000001425612173477703016757 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** menurt.c - ncurses-based menu definition module ***/ #include "iptraf-ng-compat.h" #include "menurt.h" #include "winops.h" #include "labels.h" /* initialize menu system */ void tx_initmenu(struct MENU *menu, int y1, int x1, int y2, int x2, int borderattr, int normalattr, int highattr, int barnormalattr, int barhighattr, int descattr) { menu->itemlist = NULL; menu->itemcount = 0; strcpy(menu->shortcuts, ""); menu->x1 = x1; menu->y1 = y1; menu->x2 = x2; menu->y2 = y2; menu->menuwin = newwin(y1, x1, y2, x2); menu->menupanel = new_panel(menu->menuwin); menu->menu_maxx = x1 - 2; keypad(menu->menuwin, 1); meta(menu->menuwin, 1); noecho(); wtimeout(menu->menuwin, -1); /* block until input */ notimeout(menu->menuwin, 0); /* disable Esc timer */ nonl(); cbreak(); menu->borderattr = borderattr; menu->normalattr = normalattr; menu->highattr = highattr; menu->barnormalattr = barnormalattr; menu->barhighattr = barhighattr; menu->descriptionattr = descattr; } /* add menu item */ void tx_additem(struct MENU *menu, char *item, char *desc) { struct ITEM *tnode; char cur_option[OPTIONSTRLEN_MAX]; char thekey[2]; if (menu->itemcount >= 25) return; tnode = xmalloc(sizeof(struct ITEM)); if (item != NULL) { strcpy(tnode->option, item); strcpy(tnode->desc, desc); tnode->itemtype = REGULARITEM; strcpy(cur_option, item); strtok(cur_option, "^"); strcpy(thekey, strtok(NULL, "^")); thekey[0] = toupper(thekey[0]); strcat(menu->shortcuts, thekey); } else { tnode->itemtype = SEPARATOR; strcat(menu->shortcuts, "^"); /* mark shortcut position for seps */ } if (menu->itemlist == NULL) { menu->itemlist = tnode; } else { menu->lastitem->next = tnode; tnode->prev = menu->lastitem; } menu->itemlist->prev = tnode; menu->lastitem = tnode; tnode->next = menu->itemlist; menu->itemcount++; } /* show each individual item */ void tx_showitem(struct MENU *menu, struct ITEM *itemptr, int selected) { int hiattr = 0; int loattr = 0; int ctr; char curoption[OPTIONSTRLEN_MAX]; char padding[OPTIONSTRLEN_MAX]; if (itemptr->itemtype == REGULARITEM) { switch (selected) { case NOTSELECTED: hiattr = menu->highattr; loattr = menu->normalattr; break; case SELECTED: hiattr = menu->barhighattr; loattr = menu->barnormalattr; break; } strcpy(curoption, itemptr->option); wattrset(menu->menuwin, loattr); wprintw(menu->menuwin, "%s", strtok(curoption, "^")); wattrset(menu->menuwin, hiattr); wprintw(menu->menuwin, "%s", strtok(NULL, "^")); wattrset(menu->menuwin, loattr); wprintw(menu->menuwin, "%s", strtok(NULL, "^")); strcpy(padding, ""); for (ctr = strlen(itemptr->option); ctr <= menu->x1 - 1; ctr++) strcat(padding, " "); wprintw(menu->menuwin, "%s", padding); } else { wattrset(menu->menuwin, menu->borderattr); whline(menu->menuwin, ACS_HLINE, menu->menu_maxx); } update_panels(); doupdate(); } /* repeatedly calls tx_showitem to display individual items */ void tx_showmenu(struct MENU *menu) { struct ITEM *itemptr; /* points to each item in turn */ int ctr = 1; /* counts each item */ wattrset(menu->menuwin, menu->borderattr); /* set to bg+/b */ tx_colorwin(menu->menuwin); /* color window */ tx_box(menu->menuwin, ACS_VLINE, ACS_HLINE); /* draw border */ itemptr = menu->itemlist; /* point to start */ wattrset(menu->menuwin, menu->normalattr); do { /* display items */ wmove(menu->menuwin, ctr, 1); tx_showitem(menu, itemptr, NOTSELECTED); /* show items, initially unselected */ ctr++; itemptr = itemptr->next; } while (ctr <= menu->itemcount); update_panels(); doupdate(); } void menumoveto(struct MENU *menu, struct ITEM **itemptr, unsigned int row) { struct ITEM *tnode; unsigned int i; tnode = menu->itemlist; for (i = 1; i < row; i++) tnode = tnode->next; *itemptr = tnode; } /* * Actually do the menu operation after all the initialization */ void tx_operatemenu(struct MENU *menu, int *position, int *aborted) { struct ITEM *itemptr; int row = *position; int endloop = 0; int ch; char *keyptr; tx_menukeyhelp(menu->normalattr, menu->highattr); *aborted = 0; menumoveto(menu, &itemptr, row); menu->descwin = newwin(1, COLS, LINES - 2, 0); menu->descpanel = new_panel(menu->descwin); do { wmove(menu->menuwin, row, 1); tx_showitem(menu, itemptr, SELECTED); /* * Print item description */ wattrset(menu->descwin, menu->descriptionattr); tx_colorwin(menu->descwin); wmove(menu->descwin, 0, 0); wprintw(menu->descwin, " %s", itemptr->desc); update_panels(); doupdate(); wmove(menu->menuwin, row, 2); ch = wgetch(menu->menuwin); wmove(menu->menuwin, row, 1); tx_showitem(menu, itemptr, NOTSELECTED); switch (ch) { case KEY_UP: if (row == 1) row = menu->itemcount; else row--; itemptr = itemptr->prev; if (itemptr->itemtype == SEPARATOR) { row--; itemptr = itemptr->prev; } break; case KEY_DOWN: if (row == menu->itemcount) row = 1; else row++; itemptr = itemptr->next; if (itemptr->itemtype == SEPARATOR) { row++; itemptr = itemptr->next; } break; case 12: tx_refresh_screen(); break; case 13: endloop = 1; break; /* case 27: endloop = 1;*aborted = 1;row=menu->itemcount;break; */ case '^': break; /* ignore caret key */ default: keyptr = strchr(menu->shortcuts, toupper(ch)); if ((keyptr != NULL) && keyptr - menu->shortcuts < menu->itemcount) { row = keyptr - menu->shortcuts + 1; endloop = 1; } } } while (!endloop); *position = row; /* position of executed option is in *position */ del_panel(menu->descpanel); delwin(menu->descwin); update_panels(); doupdate(); } void tx_destroymenu(struct MENU *menu) { struct ITEM *tnode; struct ITEM *tnextnode; if (menu->itemlist != NULL) { tnode = menu->itemlist; tnextnode = menu->itemlist->next; tnode->prev->next = NULL; while (tnode != NULL) { free(tnode); tnode = tnextnode; if (tnextnode != NULL) tnextnode = tnextnode->next; } } del_panel(menu->menupanel); delwin(menu->menuwin); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/tui/menurt.h0000664000076400007640000000243612173477703016761 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_MENURT_H #define IPTRAF_NG_TUI_MENURT_H /*** menu.h - declaration file for my menu library ***/ #define SELECTED 1 #define NOTSELECTED 0 #define SEPARATOR 0 #define REGULARITEM 1 #define OPTIONSTRLEN_MAX 50 #define DESCSTRLEN_MAX 81 #define SHORTCUTSTRLEN_MAX 25 struct ITEM { char option[OPTIONSTRLEN_MAX]; char desc[DESCSTRLEN_MAX]; unsigned int itemtype; struct ITEM *prev; struct ITEM *next; }; struct MENU { struct ITEM *itemlist; struct ITEM *selecteditem; struct ITEM *lastitem; int itemcount; int postn; int x1, y1; int x2, y2; unsigned int menu_maxx; WINDOW *menuwin; PANEL *menupanel; WINDOW *descwin; PANEL *descpanel; int borderattr; int normalattr; int highattr; int barnormalattr; int barhighattr; int descriptionattr; char shortcuts[SHORTCUTSTRLEN_MAX]; }; void tx_initmenu(struct MENU *menu, int y1, int x1, int y2, int x2, int borderattr, int normalattr, int highattr, int barnormalattr, int barhighattr, int descattr); void tx_additem(struct MENU *menu, char *item, char *desc); void tx_showitem(struct MENU *menu, struct ITEM *itemptr, int selected); void tx_showmenu(struct MENU *menu); void tx_operatemenu(struct MENU *menu, int *row, int *aborted); void tx_destroymenu(struct MENU *menu); #endif /* IPTRAF_NG_TUI_MENURT_H */ iptraf-ng-1.1.4/src/tui/msgboxes.c0000664000076400007640000000375012173477703017271 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /* * msgboxes.c - message and error box display functions */ #include "iptraf-ng-compat.h" #include "winops.h" int ERR_BORDER_ATTR; int ERR_TEXT_ATTR; int ERR_PROMPT_ATTR; int INFO_BORDER_ATTR; int INFO_TEXT_ATTR; int INFO_PROMPT_ATTR; void tx_init_error_attrs(int border, int text, int prompt) { ERR_BORDER_ATTR = border; ERR_TEXT_ATTR = text; ERR_PROMPT_ATTR = prompt; } void tx_init_info_attrs(int border, int text, int prompt) { INFO_BORDER_ATTR = border; INFO_TEXT_ATTR = text; INFO_PROMPT_ATTR = prompt; } void tui_error_va(const char *prompt, const char *err, va_list vararg) { WINDOW *win = newwin(4, 70, (LINES - 4) / 2, (COLS - 70) / 2); PANEL *panel = new_panel(win); wattrset(win, ERR_BORDER_ATTR); tx_colorwin(win); tx_box(win, ACS_VLINE, ACS_HLINE); wmove(win, 2, 2); wattrset(win, ERR_PROMPT_ATTR); wprintw(win, "%s", prompt); wattrset(win, ERR_TEXT_ATTR); wmove(win, 1, 2); vw_printw(win, err, vararg); update_panels(); doupdate(); int response; do { response = wgetch(win); if (response == 12) tx_refresh_screen(); } while (response == 12); del_panel(panel); delwin(win); update_panels(); doupdate(); } void tui_error(const char *prompt, const char *err, ...) { va_list params; va_start(params, err); tui_error_va(prompt, err, params); va_end(params); } void tx_infobox(char *text, char *prompt) { WINDOW *win; PANEL *panel; int ch; win = newwin(4, 50, (LINES - 4) / 2, (COLS - 50) / 2); panel = new_panel(win); wattrset(win, INFO_BORDER_ATTR); tx_colorwin(win); tx_box(win, ACS_VLINE, ACS_HLINE); wattrset(win, INFO_TEXT_ATTR); mvwprintw(win, 1, 2, text); wattrset(win, INFO_PROMPT_ATTR); mvwprintw(win, 2, 2, prompt); update_panels(); doupdate(); do { ch = wgetch(win); if (ch == 12) tx_refresh_screen(); } while (ch == 12); del_panel(panel); delwin(win); update_panels(); doupdate(); } iptraf-ng-1.1.4/src/tui/msgboxes.h0000664000076400007640000000071212173477703017271 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_MSGBOXES_H #define IPTRAF_NG_TUI_MSGBOXES_H #define ANYKEY_MSG "Press a key to continue" void tx_init_error_attrs(int border, int text, int prompt); void tx_init_info_attrs(int border, int text, int prompt); void tx_infobox(char *text, char *prompt); void tui_error(const char *prompt, const char *err, ...) __printf(2,3); void tui_error_va(const char *prompt, const char *err, va_list vararg); #endif /* IPTRAF_NG_TUI_MSGBOXES_H */ iptraf-ng-1.1.4/src/tui/winops.c0000664000076400007640000000364012173477703016757 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ /*** winops.c - screen configuration and setup functions ***/ #include "iptraf-ng-compat.h" void tx_stdwinset(WINDOW * win) { meta(win, TRUE); keypad(win, TRUE); notimeout(win, 0); scrollok(win, 1); } void tx_refresh_screen(void) { endwin(); doupdate(); curs_set(0); } void tx_colorwin(WINDOW * win) { int ctr; char *blankpad; blankpad = (char *) xmalloc(sizeof(char) * (getmaxx(win) + 1)); strcpy(blankpad, ""); for (ctr = 0; ctr < getmaxx(win); ctr++) { strcat(blankpad, " "); } scrollok(win, 0); for (ctr = 0; ctr < getmaxy(win); ctr++) { wmove(win, ctr, 0); wprintw(win, "%s", blankpad); } scrollok(win, 1); free(blankpad); } void tx_wcoloreol(WINDOW * win) { int x, curx; int y __unused; int cury __unused; char sp_buf[10]; getyx(win, cury, curx); getmaxyx(win, y, x); sprintf(sp_buf, "%%%dc", x - curx - 1); scrollok(win, 0); wprintw(win, sp_buf, ' '); } /* * This function is written to address a strange symptom in ncurses 5.2, at * least on RedHat 7.3. The border drawn by the box() macro (actually an alias * for a call to wborder()) no longer uses the color attributes set by * wattrset(). However, the addch() and wvline() functions still do. * * The tx_box function is a drop-in replacement for box(). */ void tx_box(WINDOW *win, int vline, int hline) { int winwidth; int winheight; int i; scrollok(win, 0); getmaxyx(win, winheight, winwidth); winheight--; winwidth--; mvwaddch(win, 0, 0, ACS_ULCORNER); mvwhline(win, 0, 1, hline, winwidth - 1); mvwaddch(win, 0, winwidth, ACS_URCORNER); for (i = 1; i < winheight; i++) { mvwaddch(win, i, 0, vline); mvwaddch(win, i, winwidth, vline); } mvwaddch(win, winheight, 0, ACS_LLCORNER); mvwhline(win, winheight, 1, hline, winwidth - 1); mvwaddch(win, winheight, winwidth, ACS_LRCORNER); } iptraf-ng-1.1.4/src/tui/winops.h0000664000076400007640000000064612173477703016767 0ustar npajkovsnpajkovs#ifndef IPTRAF_NG_TUI_WINOPS_H #define IPTRAF_NG_TUI_WINOPS_H /*** stdwinset.h - prototype declaration for setting the standard window settings for IPTraf ***/ #define tx_coloreol() tx_wcoloreol(stdscr) void tx_stdwinset(WINDOW * win); void tx_refresh_screen(void); void tx_colorwin(WINDOW * win); void tx_wcoloreol(WINDOW * win); void tx_box(WINDOW * win, int vline, int hline); #endif /* IPTRAF_NG_TUI_WINOPS_H */ iptraf-ng-1.1.4/src/usage.c0000664000076400007640000000261112173477703015740 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" static void vreportf(const char *prefix, const char *err, va_list params) { char msg[4096]; vsnprintf(msg, sizeof(msg), err, params); fprintf(stderr, "%s%s\n", prefix, msg); } static __noreturn void die_builtin(const char *err, va_list params) { vreportf("fatal: ", err, params); exit(129); } static void error_builtin(const char *err, va_list params) { vreportf("error: ", err, params); } void die(const char *err, ...) { va_list params; va_start(params, err); die_builtin(err, params); va_end(params); } void error(const char *err, ...) { va_list params; va_start(params, err); error_builtin(err, params); va_end(params); } void die_errno(const char *fmt, ...) { va_list params; char fmt_with_err[1024]; char str_error[256], *err; size_t i, j; err = strerror(errno); for (i = j = 0; err[i] && j < sizeof(str_error) - 1; ) { if ((str_error[j++] = err[i++]) != '%') continue; if (j < sizeof(str_error) - 1) { str_error[j++] = '%'; } else { /* No room to double the '%', so we overwrite it with * '\0' below */ j--; break; } } str_error[j] = 0; snprintf(fmt_with_err, sizeof(fmt_with_err), "%s: %s", fmt, str_error); va_start(params, fmt); die_builtin(fmt_with_err, params); va_end(params); } iptraf-ng-1.1.4/src/wrapper.c0000664000076400007640000000260512173477703016317 0ustar npajkovsnpajkovs/* For terms of usage/redistribution/modification see the LICENSE file */ /* For authors and contributors see the AUTHORS file */ #include "iptraf-ng-compat.h" // Die if we can't allocate size bytes of memory. void *xmalloc(size_t size) { void *ptr = malloc(size); if (ptr == NULL && size != 0) die("Out of memory, xmalloc failed"); return ptr; } void *xmallocz(size_t size) { void *ptr = xmalloc(size); memset(ptr, 0, size); return ptr; } void *xcalloc(size_t nmemb, size_t size) { void *ptr = calloc(nmemb, size); if (!ptr && (!nmemb || !size)) die("Out of memory, xcalloc failed"); return ptr; } void *xrealloc(void *ptr, size_t size) { void *ret = realloc(ptr, size); if (!ret && !size) die("Out of memory, xrealloc failed"); return ret; } // Die if we can't copy a string to freshly allocated memory. char *xstrdup(const char *s) { if (!s) return NULL; char *t = strdup(s); if (!t) die("Out of memory, %s failed", __func__); return t; } int strtoul_ui(char const *s, int base, unsigned int *result) { unsigned long ul; char *p; errno = 0; ul = strtoul(s, &p, base); if (errno || *p || p == s || (unsigned int) ul != ul) return -1; *result = ul; return 0; } int strtol_i(char const *s, int base, int *result) { long ul; char *p; errno = 0; ul = strtol(s, &p, base); if (errno || *p || p == s || (int) ul != ul) return -1; *result = ul; return 0; } iptraf-ng-1.1.4/version0000664000076400007640000000000612173477703015305 0ustar npajkovsnpajkovs1.1.4