| -6 | Display filter lists and states for IPv6, if available. |
| -a | Display the accounting filter list and show bytes counted against each rule. |
| -A | Display packet authentication statistics. |
| -C | This option is only valid in combination with -t. Display "closed" states as well in the top. Normally, a TCP connection is not displayed when it reaches the CLOSE_WAIT protocol state. With this option enabled, all state entries are displayed. |
| -d | Produce debugging output when displaying data. |
| -D <addrport> |
| | This option is only valid in combination with -t. Limit the state top display to show only state entries whose destination IP address and port match the addrport argument. The addrport specification is of the form ipaddress[,port]. The ipaddress and port should be either numerical or the string "any" (specifying any IP address resp. any port). If the -D option is not specified, it defaults to "-D any,any". |
| -f | Show fragment state information (statistics) and held state information (in the kernel) if any is present. |
| -g | Show groups currently configured (both active and inactive). |
| -h | Show per-rule the number of times each one scores a "hit". For use in combination with -i. |
| -i | Display the filter list used for the input side of the kernel IP processing. |
| -I | Swap between retrieving "inactive"/"active" filter list details. For use in combination with -i. |
| -n | Show the "rule number" for each rule as it is printed. |
| -o | Display the filter list used for the output side of the kernel IP processing. |
| -P <protocol> |
| | This option is only valid in combination with -t. Limit the state top display to show only state entries that match a specific protocol. The argument can be a protocol name (as defined in /etc/protocols) or a protocol number. If this option is not specified, state entries for any protocol are specified. |
| -R | Don’t try to resolve addresses to hostnames and ports to services while printing statistics. |
| -s | Show packet/flow state information (statistics only). |
| -sl | Show held state information (in the kernel) if any is present (no statistics). |
| -S <addrport> |
| | This option is only valid in combination with -t. Limit the state top display to show only state entries whose source IP address and port match the addrport argument. The addrport specification is of the form ipaddress[,port]. The ipaddress and port should be either numerical or the string "any" (specifying any IP address resp. any port). If the -S option is not specified, it defaults to "-S any,any". |
| -t | Show the state table in a way similar to the way top(1) shows the process table. States can be sorted using a number of different ways. This option requires curses(3) and needs to be compiled in. It may not be available on all operating systems. See below, for more information on the keys that can be used while ipfstat is in top mode. |
| -T <refreshtime> |
| | This option is only valid in combination with -t. Specifies how often the state top display should be updated. The refresh time is the number of seconds between an update. Any positive integer can be used. The default (and minimal update time) is 1. |
| -v | Turn verbose mode on. Displays more debugging information. |
|
