WebTrafficIQ / iftop outgoing traffic analyzer

Outgoing traffic analyzer

Paste or choose text captured from iftop to summarize peer IPs and inbound/outbound rates. This page does not log in to your server or upload your data. A high transfer rate is a lead to investigate, not proof that anyone is stealing data.

Paste terminal text or a text capture from iftop -n -N -t -s 30. Use numeric addresses and ports where possible. Rates are shown as bytes per second; this sample does not reveal the transferred content or total bytes over time.

What this analyzer can show

The report groups parsed iftop rows by peer address and estimates their current rates from iftop’s 2-, 10- and 40-second windows. It marks which rows appear outbound or inbound, and highlights high sustained egress for a human to check.

For best direction estimates, include iftop’s IP address is: header or enter the server/interface IP above. Without it, direction is inferred from iftop’s arrow markers and the usual local-host-first display.

What it cannot prove

iftop shows traffic volume and endpoints, not the contents, process owner, authorization or intent. A large upload may be an ordinary backup, deployment or application response. This tool cannot determine whether data was stolen, identify malware, or verify an IP reputation.

The rate columns are rolling rates, not cumulative bytes transferred. A single capture cannot establish a baseline or explain why traffic occurred. Check the owning process and compare against expected jobs and historical monitoring before taking action.

Privacy

Logs routinely contain personal data, internal hostnames, usernames and sometimes credentials. Files and pasted text are processed entirely in your browser and are never sent to QCRAMAI. Review and redact before sharing any exported output. Each analysis is limited to 200,000 non-empty lines and files to 25 MB.