This is traffic-vis, a free network traffic monitor package.
traffic-vis is a tool to help determine which hosts have been
communicating on an IP network, with whom they have been communicating
and the volume of communication taking place on a host by host basis.

There isn't much documentation, but executing "traffic-vis -h" will
give you all the options. Basically, when run from the command-line,
traffic-vis will put the specified interface (or one of its choosing
if you were too lazy to specify one) into promiscuous mode and start
sniffing packets. These packets are summarised at three levels: total,
"per host" and "per peer relationship" (basically traffic between two
hosts). When interrupted with a SIGINT, SIGTERM or SIGHUP traffic-vis
will write a summary of the traffic it has observed to stdout. This
summary can be sorted in many ways.

This release brings a minor bugfix and HTML report generation. The
HTML reports are *much* easier to read then the ASCII ones :)

traffic-vis requires libpcap 0.4 to build. This is available from
ftp://ftp.ee.lbl.gov. Since it reads raw network frames, it needs to
be run as root (I strongly recommend against making it SUID).

You will also need glib. I have developed traffic-vis using glib-1.1.4
but I think older versions should work too. glib is available from
ftp://ftp.gimp.org/pub/gtk/v1.1/ RedHat users will probably want to
use the RPM version, this is included on the RedHat 5.2 CD in the 
directory "/gnome", otherwise it can be downloaded from 
ftp://ftp.gnome.org/pub/GNOME/redhat/latest/i386/

Traffic-vis has its very own homepage at
http://www.ilogic.com.au/~dmiller/traffic-vis.html

Your ideas, flames, bug-reports and (hopefully) patches greatfully
accepted.

Damien Miller <dmiller@ilogic.com.au>

