How to Monitor Network Traffic on Linux: 11 Essential Tools and Commands

Monitoring network traffic on Linux is crucial for web servers. Below is a summary of various tools and commands.

1. iptraf

iptraf is a real‑time text‑based network traffic monitor. Install on RHEL from the installation media (iptraf*.rpm) or on CentOS with yum install -y iptraf. Use PuTTY for display; SecureCRT may show garbled characters.

Features include IP traffic monitor, general interface statistics, detailed interface statistics. With the -B option it can run in background and save data to /var/log/iptraf.

2. nload

Not included by default; install from repositories.

3. ifstat

Not included by default; install from repositories.

4. sar (sysstat)

Install on RHEL from the installation media (sysstat*.rpm) or on CentOS with yum install -y sysstat. The sysstat package provides iostat, mpstat, and sar. sar can collect system statistics at intervals.

To monitor network traffic with sar: sar -n DEV interval count where interval is the sampling period in seconds and count is the number of samples (0 means continuous until interrupted). Example: sar -n DEV 1 4 Output fields include IFACE, rxpck/s, txpck/s, rxbyt/s, txbyt/s.

5. /proc/net/dev

Viewing this file directly is not very intuitive.

6. ifconfig

Also not very intuitive for traffic monitoring.

7. iftop

Install and run, e.g., iftop -i eth1.

8. mtr

Install with yum install -y mtr. Text‑based tool.

9. ntop

Provides a web interface and works on Windows as well. Installation guides are available online.

10. tcpdump + command pipeline

Install with yum install -y tcpdump. Example usage:

tcpdump -i eth0 -nv > 111
cat 111 | awk '{print $2}' | cut -d"." -f1-4 | grep 192.168 | sort | uniq -c | sort -rn | head

11. vnstat

Simple network traffic statistics tool; see http://wowubuntu.com/vnstat.html for details.