.TH "tcptrack" 1
.SH NAME
tcptrack \- Monitor TCP connections on the network
.SH SYNOPSIS
.B tcptrack
tcptrack [-dfhvp] [-r <seconds>] -i <interface> [<filter expression>]
.SH DESCRIPTION
tcptrack displays the status of TCP connections that it sees on a given
network interface. tcptrack monitors their state and displays information
such as state, source/destination addresses and bandwidth usage in a sorted,
updated list very much like the top(1) command.

The filter expression is a standard pcap filter expression (identical to the
expressions used by tcpdump(8)) which can be used to filter down the
characteristics of TCP connections that tcptrack will see. See tcpdump(8)
for more information about the syntax of this expression.

.SH OPTIONS
.TP
.B \-d
Only track connections that were started after tcptrack was started. Do not
try to detect existing connections.
.TP
.B \-f
Enable fast average recalculation. TCPTrack will calculate the average
speeds of connections by using a running average. TCPTrack will use more
memory and CPU time, but averages will seem closer to real time and will be
updated more than once per second. The number of times per second that
averages will be recalculated in fast mode is a compile-time setting that
defaults to 10 times per second.
.TP
.B \-h
Display command line help
.TP
.B \-i [interface]
Grab packets from the specified network interface.
.TP
.B \-p
Do not put the interface being sniffed into promiscuous mode.
.TP
.B \-r [seconds]
Wait this many seconds before removing a closed connection from the display.
Defaults to 2 seconds. See also the pause interactive command (below).
.TP
.B \-v
Display tcptrack version
.SH "INTERACTIVE COMMANDS"
The following keys may be pressed while tcptrack is running to change
runtime options:

.B p
- Pause/unpause display. No new connections will be added to the display,
and all currently displayed connections will remain in the display.

.B q
- Quit tcptrack.

.B s
- Enable/disable sorting. 
.SH "SEE ALSO"
tcpdump(8), pcap(3), 
http://www.rhythm.cx/~steve/devel/tcptrack
.SH BUGS
Currently the interface is not very flexible. Display timing settings (such
as the refresh interval) can only be changed by editing the source code
(defs.h in particular). See the TODO file included with the source
distribution for further bugs.