<h1 id="terminology">Terminology</h1>
<ul>
<li>connection - a bi-directional communication channel between two programs over a network</li>
<li>client - the initiator of a connection</li>
<li>server - the receiver of the connection</li>
<li>port - a common term for the address of a program or service on a given machine</li>
<li>5-tuple - the combination of protocol, client machine network address, client port, server machine network address, server port that uniquely identifies a connection</li>
<li>flow - a grouping of packets to be treated in a common way</li>
<li>microflow - a flow with a fine level of granularity such as the packets from one direction of traffic in a connection</li>
</ul>
<h1 id="the-topflowsh-script">The topflow.sh Script</h1>
<pre><code>#!/bin/sh

# Start a capture in the background that drops the packets
# and just reports the flow events
pktin $1 | nftrk -d -f /tmp/flows.txt &amp;
PID=$!

# On CTRL-C clean kill the capture and clean up
trap &quot;kill $PID ; rm -f /tmp/flows.txt /tmp/topflows.txt /tmp/namecache.txt ; exit 0&quot; INT TERM

# Once per second do
#   look at the last 100 flows
#   sort them by 5-tuple
#   remove duplicates
#   convert ports, protocols and addresses to names
#   sort by data usage per flow in reverse order (highest first)
#   a little more pretty printing
#   only take the top 20 lines
#   clear the screen and print the result
while [ 1 ] ; do
    tail -100 /tmp/flows.txt |
            sort -s -t &#39;|&#39; -k 3,3 |
            awk -f uniqflows.awk  |
            awk -f prflow.awk  |
            sort -s -t &#39;,&#39; -k 3 -r |
            awk -f columns.awk |
            head -20 &gt; /tmp/topflows.txt
    clear
    cat /tmp/topflows.txt
    sleep 1
done
</code></pre>
<p>You can find the complete code at: <a href="https://gitlab.com/onics/onics-examples" class="uri">https://gitlab.com/onics/onics-examples</a></p>
