Essential Linux Network Monitoring Tools: From nethogs to ntopng

If you need to monitor network traffic on a Linux system, a variety of command‑line tools are available, each with its own focus. The following overview covers the most common utilities, how they work, and how to install them on Debian/Ubuntu (apt) or Red Hat‑based (yum) distributions.

nethogs

Shows bandwidth usage per process, helping you identify which PID consumes the most network resources. It supports both IPv4 and IPv6.

Monitor a specific interface: nethogs eth0 Enable promiscuous mode for deeper sniffing:

nethogs -p wlan0

nload

A console application that visualizes real‑time traffic and bandwidth with two simple graphs. Switch between interfaces using the left/right arrow keys.

Run the tool:

nload

slurm

Displays network load using an ASCII graph and provides interactive keys (c, s, r, L, m, q) for mode switching.

Read the manual: man slurm Install on Debian/Ubuntu:

sudo apt-get install slurm

iftop

Shows bandwidth usage per host on a selected network interface, presenting a table of current connections.

Install on Debian/Ubuntu: sudo apt-get install iftop Install on Fedora/CentOS/RHEL:

yum -y install iftop

collectl

Collects system performance data in two modes: recording and replay.

Install on Debian/Ubuntu: sudo apt-get install collectl Install on Fedora/CentOS/RHEL:

yum install collectl

netstat

Displays incoming and outgoing packet statistics, TCP connections, routing tables, and interface details.

Install on Debian/Ubuntu: sudo apt-get install net-tools Install on Fedora/CentOS/RHEL: yum install net-tools Run the tool:

netstat

netwatch

Part of the netdiag suite; shows current connections and transfer rates for local and remote hosts.

Install on Debian/Ubuntu: sudo apt-get install netdiag Install on Fedora: yum install netwatch Run:

sudo netwatch -e wlan2 -nt

speedometer

Draws a simple graph of upload and download traffic on a given port.

Install on Fedora: yum install speedometer Install on Debian/Ubuntu: sudo apt-get install speedometer Run:

speedometer -r wlan2 -t wlan2

CBM (Color Bandwidth Meter)

Shows traffic usage for all network devices in a straightforward manner.

Install on Debian/Ubuntu: sudo apt-get install cbm Run:

cbm

bmon

Bandwidth Monitoring tool that provides curses‑based, HTML, and ASCII output.

Install on Debian/Ubuntu: sudo apt-get install bmon Run:

bmon

tcpdump

Captures packets on a network interface and can filter them with Boolean expressions.

Install on Debian/Ubuntu: sudo apt -get install tcpdump Install on Fedora/CentOS/RHEL: yum install tcpdump Capture on interface wlan2: sudo tcpdump -i wlan2 Capture only port 80:

sudo tcpdump -i wlan2 'port 80'

ntopng

Next‑generation version of ntop, providing a web‑based view of network usage similar to the top command for processes.

Install dependencies on Debian/Ubuntu:

sudo apt-get install libpcap-dev libglib2.0-dev libgeoip-dev redis-server wget libxml2-dev build-essential checkinstall

Download and compile ntopng:

sudo wget http://sourceforge.net/projects/ntop/files/ntopng/ntopng-1.1_6932.tgz/download
sudo tar zxfv ntopng-1.1_6932.tgz
cd ntopng-1.1_6932
./configure
make
sudo make install

iptraf

Console‑based network statistics application that shows TCP/UDP traffic, interface info, and packet/byte counts.

Install on Debian/Ubuntu: sudo apt-get install iptraf Install on Fedora/CentOS/RHEL: yum install iptraf Run on interface wlan2: sudo iptraf wlan2 General statistics: iptraf -g Detailed stats for eth0: iptraf -d eth0 TCP/UDP monitoring for eth0:

iptraf -z eth0

tcptrack

Displays TCP connection status, similar to top, with source/destination and bandwidth usage.

Install on Debian/Ubuntu: sudo apt-get install tcptrack Install on Fedora/CentOS/RHEL: yum install tcptrack Run on interface wlan2: sudo tcptrack -i wlan2 Monitor a specific port (e.g., 80):

tcptrack -i wlan2 port 80

trafshow

Reports active connections, protocols, and transfer rates, with optional pcap filtering.

Install on Fedora: yum install trafshow Install on Debian/Ubuntu: sudo apt-get install trafshow Run on interface wlan2: sudo trafshow -i wlan2 Show only TCP connections:

sudo trafshow -i wlan2 tcp

vnstat

Background daemon that records total data transferred and can generate usage reports.

Install on Fedora/CentOS/RHEL: yum install vnstat Install on Debian/Ubuntu: sudo apt-get install vnstat Show total traffic since daemon start: vnstat Live mode with per‑second updates: vnstat -l All tools mentioned are useful for system administrators and developers who need to monitor network bandwidth, diagnose issues, or analyze traffic patterns on Linux systems.