FreeBSD - rate - Swiss-Army-knife traffic analyzer

/usr/ports/net-mgmt/rate

EXAMPLES
To determine overall traffic on eth3:

# rate -i eth3 -R


To estimate bandwidth consumed by WWW traffic on ppp0, bit units:

# rate -i ppp0 -f 'port 80' -Rb


To print top 20 nodes from 10.0.0.0/8 that are receiving the highest
number of bytes (including transfers between hosts inside the
10.0.0.0/8 network) every 5 seconds:

# rate -i eth0 -r 5 -Aa 20 -lc 10.0.0.0/8


Same as above, but w/color output and screen clearing:

# rate -i eth0 -r 5 -w -c -Aa 20 -lc 10.0.0.0/8


Show 10 nodes from 10.0.0.0/8 and 192.168.0.0/16 that generated the
largest overall number of packets, generate reports on a keypress
(RETURN), ANSI color output:

# rate -i eth0 -ck -Ac 10.0.0.0/8 -c 192.168.0.0/16 -a 10 -OPT


Estimate ICMP traffic exchanged with the 10.0.0.0/8 subnet, wait for
SIGUSR1, then dump the counters for each host in 192.168.0.0/24 to a
file named FILE, then quit.

# rate -i eth1 -f 'icmp and net 10.0.0.0/8' -q 1 -gl -A -c
192.168.0.0/24 -d > FILE


Show most active (considering transferred bytes) conversations detected
on eth3, color output on keypress; save the option set under the name
'streams':

# rate -S streams -i eth3 -ckTrs 25 -MB


Recall the 'streams' operation mode:

# rate -L streams



On a keypress, show a list of 3 nodes that have sent the highest amount
of packets since the application started; color output:

# rate -i eth3 -ckTrvn 3 -SOP


Show currently visited web pages:

# rate -f 'dst port 80' -E -o 'Host: \2 Browser: \1' -ie 'User-Agent:
\([^\r\n]+\)\r\n.*Host: \([^\r\n]+\)\r\n'


View addresses e-mails are being sent from:

# rate -i eth1 -f 'dst port 25' -E -ie 'MAIL FROM: \([^\r\n]+\)'