Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
TCPPROF(1)		FreeBSD	General	Commands Manual		    TCPPROF(1)

     tcpprof --	report profile of network traffic

     tcpprof [-?hdnpR] [-f filter expr]	[-i interface] [-P port] [-r filename]
	     [-s seconds] [-S letters] [-t lines]

     tcpprof reports a profile of network traffic by ranking it	by link	type,
     ip	protocol, TCP/UDP port,	ip address, or network address.

     Network information is collected either by	reading	data from filename, or
     by	directly monitoring the	network	interface interface.  The default ac-
     tion for tcpprof is to automatically search for an	appropriate interface,
     and to generate a profile before it exits.

     When reading data from filename, tcpprof will display the profile and
     exit immediately after the	entire file has	been processed.	 When collect-
     ing data from interface, tcpprof will keep	running	unless the -s option
     had been specified.

     The options are as	follows:

     -f	filter expr
		 Filter	the packets according the rules	given by filter	expr.
		 For the syntax	of these rules,	see tcpdump(1).	 The argument
		 must be quoted	if it contains spaces in order to separate it
		 from other options.

     -h, -?	 Display version and a brief help message.

     -d		 tcpprof will track the	source and destination information
		 separately, where applicable, and identify source data	with a
		 ">" and destination data with "<".  For example, a "http <"
		 statistic signifies all traffic with destination port 80
		 (http). This option only applies to port, host	and network

     -i	interface
		 Do a live capture (rather than	read from a file) on the in-
		 terface interface given on the	command	line.  If interface is
		 "auto"	then tcpprof tries to find an appropriate one by it-

     -P	port	 This tells tcpprof to ignore TCP and UDP ports	greater	than
		 or equal to port when displaying port statistics.  This is
		 not the same as filtering these port numbers out of the data
		 set.  This way, packets with i.e. the source port above port
		 and the destination port below	port will be able to still
		 count the lower port number as	a statistic.  In addition,
		 this doesn't affect the other statistic types (link, proto-
		 col, etc.)

     -p		 Set the interface into	non-promiscuous	mode (promiscuous is
		 the default) when doing live captures.

     -r	filename
		 Read all data from filename, which may	be a regular file, a
		 named pipe or "-" to read it's	data from standard input. Ac-
		 ceptable file formats include pcap (tcpdump(1)	files) and
		 "snoop" format	files.	filename is usually a file created by
		 the tcpdump(1)	command	using the "-w" option.

     -S	letters	 Tells tcpprof which statistics	to display.  letters must be a
		 string	of one or more of the following	letters:

		 l     show stats about	the link layer

		 i     show stats about	all ip protocols

		 p     show stats about	TCP/UDP	ports

		 h     show stats about	hosts/ip addresses

		 n     show stats about	network	addresses

		 a     a synonym for "liphn"

     -s	seconds	 When monitoring an interface, tcpprof runs for	only seconds
		 seconds, and then quits.  Has no effect when reading data
		 from a	file.

     -t	lines	 When printing a profile of the	data, tcpprof will display a
		 maximum of lines lines	for each statistic.

     Upon receiving a SIGINT, tcpprof will print any remaining statistics, and
     then exit.

     /dev/bpfn	  the packet filter device

	   tcpprof -i fxp0 -S a

     Displays a	complete profile of network data passing through the fxp0 net-
     work interface, after the user enters ^C (control C).

	   tcpprof -r file.dump	-S a

     Displays a	complete profile of network data from the tcpdump(1) generated
     file "file.dump".

     tcpdump(1), pcap(3), bpf(4)

     tcpprof was first written along side tcpstat in Winter 1998 using FreeBSD
     3.0, and then finaly retrofited for Linux in Spring 2000.	It became in-
     stalled along with	tcpstat	since version 1.5.

     Paul Herman <>
     Cologne, Germany.

     Please send all bug reports to this address.

     Not tested	with link types	other than Ethernet, PPP, and "None" types.

     There may be problems reading non-IPv4 packets across platforms when
     reading null type link layers.  This is due to a lack of a	standardized
     packet type descriptor in libpcap for this	link type.

     Snoop file	formats	cannot be read from stdin or named pipes.

FreeBSD	13.0		       December	22, 2001		  FreeBSD 13.0


Want to link to this manual page? Use this URL:

home | help