Best way to find out the top source IP addresses from the State Table?

superbree

Our state table size is quite large. We have a state count of over 200,000 thousand. This is normal for our traffic. My question is what is the best way to find out a top 10 or top talkers list of IP address based on the number of source states?

I have tried and cannot use "states summary" from the diagnostics tab as it crashes because of the size of the state table with the following error.

"Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 32 bytes) in /usr/local/www/diag_states_summary.php on line 60"

Is there a simple package or a simple way of getting the same information from the "states summary" report found on the diagnostics tab but only for the top source IP states (maybe top 10) and not a report for every IP address from the states table?

I hope that made sense.

Thank you for any replies or suggestions.

-Paul

charliem

You may find the 'pftop' console command helpful. Like the normal 'top', it's interactive by default., but it can be scripted as well. There's a man page here: http://www.eee.metu.edu.tr/~canacar/pftop/pftop.8.html, though I'm not sure the pfSense pftop is in sync with the one described there. The help text from pftop in a recent 2.2 snapshot:

  pfTop Help

      c  - toggle state Cache            f  - set state Filter
      h  - Help (this page)              n  - set Number of lines
      o  - next sort Order               p  - Pause display
      r  - Reverse sort order            s  - Set update interval
      v  - next View                     q  - Quit

     0-8 - select view directly
     SPC - update immediately
     ^L  - refresh display
     ^G  - clear command entry line

     cursor keys - scroll display

   Sorting shortcuts:

      A  - Age            B  - Bytes          D  - Dest. port
      E  - Expiry         F  - From           N  - None
      P  - Packets        S  - Src. port      T  - To
      R  - Rate           K  - peaK