.TH TRAFSHOW 1 "August 1998"
.SH NAME
trafshow - full screen show network traffic
.SH SYNOPSIS
.B trafshow
[\fI-eCfknNOpv -c\fP num \fI-i\fP name \fI-r\fP sec \fI-t\fP sec]
[\fI-F\fP file | \fIexpr\fP]
.SH DESCRIPTION
.PP
.I TrafShow
continuously display the information regarding packet traffic on the
configured network interface that match the boolean \fBexpression\fP.
It periodically sorts and updates this information.
.br
This funny program may be useful for locating suspicious network
traffic on the net or to evaluate current utilization of the network
interface.
.SH OPTIONS
.TP
.B \-c
Exit after receiving \fBnumber\fP of packets.
.TP
.B \-C
Try to force ansi color mode. May be used when description of your
current terminal has no color capability in termcap/terminfo data base.
.TP
.B \-e
Show the \fBEthernet\fP traffic rather than \fBIP\fP. It is possible to
switch between them by pressing the ENTER key.
.TP
.B \-f
Print `foreign' internet addresses numerically rather than symbolically.
.TP
.B \-F
Use \fBfile\fP as input for the filter expression.
.TP
.B \-i
Listen on network interface \fBname\fP. If unspecified, \fBtrafshow\fP
searches the system interface list for the lowest numbered, configured
up interface (excluding loopback).
.TP
.B \-k
Disable input keyboard checking. It is intended to avoid loss of packets.
.TP
.B \-m
[src-ip M] [dst-ip M] [src-port M] [dst-port M] [proto M]
.br
Mask the specified field with mask M (which should be specified
as an hex number e.g. 0xffff0000) before further processing
of the packet. This allows to aggregate traffic in the display
to ease analysis.
.br
.The masks for all field not specified will be set to 0.
.TP
.B \-n
Don't convert host addresses and port numbers to names.
.TP
.B \-N
Don't print domain name qualification of host names.
.TP
.B \-O
Don't run the packet-matching code optimizer. This is useful only if you
suspect a bug in the optimizer.
.TP
.B \-p
Don't put the interface into promiscuous mode.
.TP
.B \-r
Set screen refresh interval to \fBseconds\fP.
.TP
.B \-t
Set max timeout in DNS query to \fBseconds\fP.
.TP
.B \-v
Print detailed version information and exit.
.TP
.B expr
Select which packets will be displayed. If no \fBexpression\fP is given,
all packets on the net will be displayed. Otherwise, only packets for
which \fBexpression\fP is `true' will be displayed.
.br
For more details refer to \fBtcpdump\fP(1) man page.
.SH FILES
.TP
.B /etc/trafshow
The default colors configuration file if any.
.TP
.B $HOME/.trafshow
The personal file with the user defined colors.
.SH COLORS
.PP
If \fBtrafshow\fP has been compiled with modern curses libraries such
as \fBSlang\fP or \fBNcurses\fP it been able to show colored traffic
on color-capable terminal.
.PP
The syntax of trafshow color configuration file as follow:
.TP
.B default fcolor:bcolor
Set the default screen background color-pair
.TP
.B port[/proto] fcolor:bcolor
Set color pattern by service port
.TP
.B from[/mask][:port] to[/mask][:port] proto fcolor:bcolor
Set color pattern by pair of from-to addresses
.PP
The wildcard `*' do match ANY in pattern.
Where fcolor is foreground color and bcolor is background color.
.br
The fcolor and bcolor may be one of the following:
.TP
.B black  red  green  yellow  blue  magenta  cyan  white
It posible to indicate color as number from 0 to 7.
.PP
The upper-case \fBF\fPcolor mean \fBbright\fP *on*.
The upper-case \fBB\fPcolor mean \fBblink\fP *on*.
.SH SEE ALSO
netstat(1), tcpdump(1), bpf(4)
.SH ACKNOWLEDGEMENTS
Thanks to Van Jacobson <van@helios.ee.lbl.gov> and
Steven McCanne <mccanne@helios.ee.lbl.gov>,
all of Lawrence Berkeley Laboratory,
University of California, Berkeley, CA.
.SH AUTHOR
Vladimir Vorobyev <bob@turbo.nsk.su>.
.SH BUGS
The trafshow functions such as resizeing and coloring under \fBxterm\fP
mainly depended of curses library.