20 Linux Network Monitoring Tools You Might Not Know

1) nethogs

nethogs is a free tool that groups bandwidth by process (PID) rather than by protocol or subnet, making it ideal for identifying which application consumes network resources. It supports both IPv4 and IPv6.

To monitor a specific interface (e.g., eth0): nethogs eth0 To sniff in promiscuous mode, use the -p option: nethogs -p wlan0 The author notes using nethogs on Ubuntu 12.04 LTS for bandwidth monitoring.

2) nload

nload is a console application that visualizes real-time network traffic and bandwidth usage with two simple graphs. It allows switching monitored devices during runtime using left/right arrow keys.

Run simply with: nload The graphs display total transferred data, current, minimum, and maximum network rates.

3) slurm

slurm shows network load as an ASCII graph and supports interactive key bindings: c (classic mode), s (split graph), r (redraw), L (enable TX/RX lights), m (toggle between classic/split/large), q (quit).

Install on Ubuntu/Debian: sudo apt-get install slurm View all key bindings via man slurm.

4) iftop

iftop displays bandwidth usage per host connection on a specified interface. It listens on the first external interface by default and shows a table of current host-pair bandwidth.

Install on Ubuntu/Debian: sudo apt-get install iftop Install on CentOS/Fedora/RHEL:

yum -y install iftop

5) collectl

collectl collects system state data in two modes: Recording mode reads data from a running system and outputs to terminal, files, or a socket; Playback mode reads data from files generated by recording mode.

Install on Ubuntu/Debian: sudo apt-get install collectl Install on yum-based systems:

yum install collectl

6) Netstat

Netstat monitors incoming/outgoing packet statistics, TCP connections (upload/download), routing tables, network interfaces, and protocol statistics. It is part of the net-tools package.

Install on Ubuntu/Debian: sudo apt-get install net-tools Install on CentOS/Fedora/RHEL: yum install net-tools Run with: netstat More details via man netstat.

7) Netload

Netload (part of netdiag) shows a brief report of current network load and total bytes transferred since start. It has minimal features.

Install on Fedora: yum install netdiag Install on Ubuntu/Debian: sudo apt-get install netdiag Run with a specific interface (e.g., wlan2): netload wlan2 Find interface names with ip link show.

8) Nagios

Nagios is a powerful open-source monitoring system for servers, switches, routers, printers, and remote Linux/Windows hosts. It provides a web interface with graphical activity monitors accessible at http://localhost/nagios/ or http://localhost/nagios3/ (replace localhost with IP for remote access). It alerts on faults before they impact critical services.

9) EtherApe

EtherApe is a graphical network monitor for Unix, modeled after etherman. It supports link-layer, IP, and TCP modes; Ethernet, FDDI, Token Ring, ISDN, PPP, SLIP, WLAN devices; and various encapsulation formats. Hosts and links change size/color with traffic volume and protocol. It can filter traffic and read packets from a file or live network.

Install on CentOS/Fedora/RHEL: yum install etherape Install on Ubuntu/Debian: sudo apt-get install etherape Run as root: sudo etherape Then configure capture mode (IP, link-layer, TCP) and interface via the GUI.

10) tcpflow

tcpflow captures TCP connection data streams, reconstructs actual data flows, and stores each flow in a separate file for later protocol analysis or debugging. It handles retransmissions and out-of-order packets using TCP sequence numbers.

Install on Ubuntu/Debian: sudo apt-get install tcpflow Install on Fedora/CentOS/RHEL: yum install tcpflow If not in repo, manually install from http://pkgs.repoforge.org/tcpflow/ (64-bit example):

yum install --nogpgcheck http://pkgs.repoforge.org/tcpflow/tcpflow-0.21-1.2.el6.rf.x86_64.rpm

Capture traffic on port 8000 on eth0 (run in empty directory): sudo tcpflow -i eth0 port 8000 Stop with Ctrl-C.

11) IPTraf

IPTraf is a console-based network statistics utility for Linux, generating graphs for TCP packet/byte counts, interface info, activity indicators, TCP/UDP traffic breakdowns, and LAN station packet/byte counts.

Install on Ubuntu/Debian: sudo apt-get install iptraf Install on yum-based systems: yum install iptraf Run with interface (e.g., wlan2) as root: sudo iptraf wlan2 Common options: iptraf -g — general interface statistics iptraf -d eth0 — detailed statistics for eth0 iptraf -z eth0 — TCP/UDP monitor for eth0 iptraf -s eth0 — packet size/count for eth0

Check interface names with ip link show.

12) Speedometer

Speedometer draws a graph of upstream/downstream traffic through a given interface.

Install on yum-based systems: yum install speedometer Install on Ubuntu/Debian: sudo apt-get install speedometer Run (replace wlan2 with your interface):

speedometer -r wlan2 -t wlan2

13) Netwatch

Netwatch (part of netdiag) displays current connections between the local host and remote hosts, along with data transfer rates per connection.

Install on Fedora: yum install netwatch On CentOS/RHEL, enable rpmforge repo first. Install netdiag on Ubuntu/Debian: sudo apt-get install netdiag Run: sudo netwatch -e wlan2 -nt Replace wlan2 with your interface (find via ip link show).

14) Trafshow

Trafshow reports active connections, protocols used, and per-connection transfer rates. It supports pcap-style filters to isolate specific connections.

Install on Fedora: yum install trafshow On CentOS/RHEL, enable rpmforge. Install on Ubuntu/Debian: sudo apt-get install trafshow Run on interface wlan2: sudo trafshow -i wlan2 Monitor only TCP connections:

sudo trafshow -i wlan2 tcp

15) Vnstat

Vnstat runs a background daemon that continuously logs traffic volume and can generate historical usage reports.

Install on yum-based systems (enable EPEL first): yum install vnstat Install on Ubuntu/Debian: sudo apt-get install vnstat Run without options for total traffic since daemon start: vnstat Live bandwidth monitoring: vnstat -l Stop with Ctrl-C to see summary output.

16) tcptrack

tcptrack displays TCP connection state on a given interface, similar to top. It shows a sorted, updating list of source/destination addresses and bandwidth usage.

Install on Ubuntu/Debian: sudo apt-get install tcptrack On Fedora: yum install tcptrack. On CentOS/RHEL, install rpmforge first:

wget http://apt.sw.be/redhat/el6/en/x86_64/rpmforge/RPMS/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
rpm -Uvh rpmforge-release*rpm
yum install tcptrack

Run as root on interface wlan2: sudo tcptrack -i wlan2 Monitor a specific port (e.g., 80):

tcptrack -i wlan2 port 80

17) CBM (Color Bandwidth Meter)

CBM shows traffic usage for all network devices. Simple to use; source and latest versions at http://www.isotton.com/utils/cbm/.

Install on Ubuntu/Debian: sudo apt-get install cbm Run:

cbm

18) bmon

bmon (Bandwidth Monitoring) is a debugging and real-time bandwidth monitor that retrieves statistics from various input modules. Output options include curses-based UI, lightweight HTML, and ASCII.

Install on Ubuntu/Debian: sudo apt-get install bmon Run:

bmon

19) tcpdump

tcpdump captures and prints packet contents matching a boolean expression on a specified interface, useful for debugging network/server issues.

Install on Ubuntu/Debian: sudo apt-get install tcpdump Install on Fedora/CentOS/RHEL: yum install tcpdump Run as root on interface wlan2: sudo tcpdump -i wlan2 Capture only port 80 traffic:

sudo tcpdump -i wlan2 'port 80'

20) ntopng

ntopng is the next-generation ntop, a network probe showing network usage akin to top for processes. Based on libpcap, portable across Unix, macOS, and Win32.

Install dependencies on Ubuntu/Debian:

sudo apt-get install libpcap-dev libglib2.0-dev libgeoip-dev redis-server wget libxml2-dev build-essential checkinstall

Compile and install manually:

sudo wget http://sourceforge.net/projects/ntop/files/ntopng/ntopng-1.1_6932.tgz/download
sudo tar zxfv ntopng-1.1_6932.tgz
sudo cd ntopng-1.1_6932
sudo ./configure
sudo make
sudo make install

Usage tutorials available for both command-line and web interface.

Conclusion

The article covers a range of Linux network load monitoring tools, each with unique features and options, all helping administrators and beginners monitor network traffic effectively.