tcptop(1m)

NAME
tcptop - display top TCP network packets by process. Uses DTrace.

SYNOPSIS
tcptop [-Ch] [-j|-Z] [interval [count]]

DESCRIPTION
This analyses TCP network packets and prints the responsible PID and UID, plus standard details such as IP address and port. This captures traffic of newly created TCP connections that were established while this program was running. It can help identify which processes is causing TCP traffic. Since this uses DTrace, only the root user or users with the dtrace_kernel privilege can run this command.

OPTIONS

-C  don't clear the screen

-j  print project IDs

-Z  print zone IDs

interval
    sample seconds between refreshing the screen

count
    number of samples

EXAMPLES

Print a report every 5 seconds,
    # tcptop

Don't clear the screen, scrolling output,
    # tcptop -C

Print project IDs,
    # tcptop -j

Print zone IDs,
    # tcptop -Z

FIELDS

UID user ID

PID process ID

CMD command name

LADDR
    local IP address

RADDR
    remote IP address

LPORT
    local port number

RPORT
    remote port number

SIZE
    packet size, bytes

load
    1 minute load average

TCPin
    total TCP inbound payload data

TCPout
    total TCP outbound payload data

ZONE
    zone ID

PROJ
    project ID

DOCUMENTATION
See the DTraceToolkit for further documentation under the Docs directory. The DTraceToolkit docs may include full worked examples with verbose descriptions explaining the output.

EXIT
tcptop will print reports until Ctrl-C is hit, or the specified count is reached.

AUTHOR
Brendan Gregg [Sydney, Australia]

SEE ALSO
tcpsnoop(1M), dtrace(1M)