When a connection has been established before
iptraf starts monitoring the connection, the "Packets" column shows how many packets
iptraf has detected, and the
> (a "greater than sign") in front of it indicates that there were probably more packet before monitoring started.
When a connection has been monitored since it started,
iptraf knows exactly how many packets have been sent, and shows a
= in the column preceding the "Packets" column.
So, entries with
> are partial, while those with
= are not.
The IPTraf documentation doesn't actually mention the use of
= explicily, but says the following about the
Some early entries may have a > symbol in front of its packet count. This means the connection was already established when the monitor started. In other words, the figures indicated do not reflect the counts since the start of the TCP connection, but rather, since the start of the traffic monitor. Eventually, these > entries will close (or time out) and disappear. TCP entries without the > were initiated after the traffic monitor started, and the counts indicate the totals of the connection itself. Just consider entries with > partial.