Netwatch?

[Freddie Cash]

On Thu, July 6, 2006 9:35 am, Chris Maness wrote:
> Freddie Cash wrote:
>> On Wed, July 5, 2006 2:08 pm, Chris Maness wrote:

>>> Used to have this cool little tool on my slackware box to monitor
>>>  network traffic.  Just curious as to why it has not been ported
>>> (are there any issues with it?)

>>> http://linux.maruhn.com/sec/netwatch.html

>>> p.s.  What would be a good substitute for now?

>> Install trafshow instead.

> This program seems to stay in memory after the shell closes and eats
> up processor time.  Top showed this thing at 98%.  Does this app. have
> a bug?

I've never had a problem with it, but I've never let it run for more
than 5 minutes at a time while tracking down a problem station.  And
I've always quit it manually using CTRL+C or Q.

Doing a quick test on a 6.0-p4 system, I can reproduce this issue,
though:
  in terminal 1:
    ssh to remote system
    su - to root
    start trafshow

  in terminal 2:
    ssh to remote system
    su - to root
    kill -9 the first instance of csh
    check ps to make sure it's dead but trafshow is still alive
    check top and see 0% idle, ~66% system and ~33% user, with
trafshow at the top of the process list
    kill trafshow in top, get 99% idle

Not sure if this is a bug in csh, trafshow, both, or something else.

----
Freddie Cash
fcash at ocis.net