How to Monitor Linux Network Traffic with vnstat, iftop, and nethogs

vnstat: Interface traffic statistics

Install vnstat via yum or apt‑get, then run the following command to view real‑time traffic on a specific interface (e.g., eth0): vnstat -i eth0 -l Press Ctrl+C to stop monitoring; the tool will then display a summary of the traffic captured during the session. Additional options are available via vnstat --help.

iftop: Real‑time bandwidth inspection

iftop

monitors live traffic on a network interface, shows hostnames, ports, and can filter by subnet. Install it first, then start monitoring with: iftop -i eth1 Common options: -B: display traffic in bytes (default is bits) -n: show IP addresses instead of hostnames -N: show port numbers instead of service names

Interactive key bindings while iftop runs:

n : toggle between IP and hostname for the local machine

s : toggle display of local host information

d : toggle display of remote host information

t : switch between two‑line, one‑line, send‑only, and receive‑only views

N : toggle between port numbers and service names

S : toggle display of local port information

D : toggle display of remote port information

p : toggle display of port information

nethogs: Per‑process bandwidth usage (recommended)

nethogs

shows bandwidth consumption grouped by process. Install it, then use the following commands:

Refresh every 5 seconds: nethogs -d 5 Monitor a single interface: nethogs eth0 Monitor multiple interfaces: nethogs eth0 eth1 Interactive shortcuts within nethogs:

m : change display units

r : sort by traffic amount

s : sort by sent traffic

q : quit the program