When packets that are too short to be valid IP packets happen to start
with 0x45 or 0x60, iftop will still try to read source and destination
addresses, which will usually just be random garbage.
Note the assumption about what libpcap guarantees in the comments to
handle_ip_packet():
* It is assumed that the snaplen (currently hard-coded to 1000) is
* big enough to always capture the IP header past the L2 encap, and
* that pcap never truncates the packet to less than snaplen; in
* other words, that pcaphdr->caplen = MIN(pcaphdr->len, snaplen).
Add a "-u unit" CLI option, as well as a "bandwidth-unit" configuration
file option. With "-u packets", traffic is accounted using packets per
second; the other options are "-u bits" and "-u bytes".
"-B" is still recognized as synonym to "-u bytes".
The default is "-u bits", keeping the current behaviour of iftop
(everything is in bits/s, except the cumulative totals).
iftop would display portions of mac address with large ffffff prefixes.
Make if_hw_addr type consistent. Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
Paul Warren