Lesser‑Known Linux Network Monitoring Tools You Should Try

If you need to monitor network activity on a Linux system, the command line offers many ready‑made tools. Below is a curated list of utilities, each with a brief description, installation instructions for Debian/Ubuntu (apt) and Red Hat‑based (yum) systems, and sample commands.

1) nethogs

nethogs groups bandwidth by process rather than by protocol or subnet, supporting both IPv4 and IPv6. It is useful for identifying which PID is consuming network resources.

nethogs -p wlan0

2) nload

nload provides real‑time traffic monitoring with two simple graphs, showing total transferred data and min/max rates. Switch devices with the left/right arrow keys.

nload

3) slurm

slurm displays load with an ASCII graph and offers interactive keys (c, s, r, L, m, q) for mode switching and screen redraw.

man slurm

sudo apt-get install slurm

4) iftop

iftop shows bandwidth per host on a selected interface, presenting a table of current connections.

sudo apt-get install iftop

yum -y install iftop

5) collectl

collectl records system state data in two modes: record (live display or file/socket output) and replay (reading from recorded files).

sudo apt-get install collectl

yum install collectl

6) Netstat

Netstat reports incoming/outgoing packet statistics, showing TCP connections, routing tables, and interface metrics.

sudo apt-get install net-tools

yum install net-tools

netstat

7) Netload (part of netdiag)

Netload reports current load and total bytes transferred since the program started.

# yum install netdiag

sudo apt-get install netdiag

netload wlan2

8) Nagios

Nagios is an open‑source monitoring system that aggregates alerts from Linux, Windows, routers, switches, and printers, providing a web interface for centralized status.

9) EtherApe

EtherApe visualizes network traffic with nodes sized and colored by bandwidth, supporting many link‑layer and IP protocols.

yum install etherape

sudo apt-get install etherape

sudo etherape

10) tcpflow

tcpflow captures TCP streams and stores each flow in a separate file for later analysis, handling retransmissions and out‑of‑order packets.

sudo apt-get install tcpflow

# yum install tcpflow

sudo tcpflow -i eth0 port 8000

11) IPTraf

IPTraf provides console‑based network statistics, including packet/byte counts per TCP/UDP flow and per interface.

$ sudo apt-get install iptraf

# yum install iptraf

$ sudo iptraf wlan2

12) Speedometer

Speedometer draws a simple graph of upload and download traffic on a given port.

# yum install speedometer

$ sudo apt-get install speedometer

$ speedometer -r wlan2 -t wlan2

13) Netwatch (part of netdiag)

Netwatch shows connections to remote hosts and per‑connection transfer rates.

# yum install netwatch

$ sudo apt-get install netdiag

$ sudo netwatch -e wlan2 -nt

14) Trafshow

Trafshow reports active connections, protocols used, and transfer rates, with optional pcap filters.

# yum install trafshow

$ sudo apt-get install trafshow

$ sudo trafshow -i wlan2

15) Vnstat

Vnstat runs as a daemon, recording total transferred data and providing historical usage reports.

# yum install vnstat

$ sudo apt-get install vnstat

$ vnstat

$ vnstat -l

16) tcptrack

tcptrack lists TCP connections with source/destination, bandwidth usage, and can filter by port.

$ sudo apt-get install tcptrack

# yum install tcptrack

sudo tcptrack -i wlan2

# tcptrack -i wlan2 port 80

17) CBM

CBM (Color Bandwidth Meter) displays traffic for all network devices in a simple, color‑coded view.

$ sudo apt-get install cbm

$ cbm

18) bmon

bmon (Bandwidth Monitor) offers curses‑based, HTML, and ASCII output for real‑time bandwidth debugging.

$ sudo apt-get install bmon

$ bmon

19) tcpdump

tcpdump captures packets matching a boolean expression on a given interface, useful for debugging network issues.

$ sudo apt -get install tcpdump

# yum install tcpdump

$ sudo tcpdump -i wlan2

$ sudo tcpdump -i wlan2 'port 80'

20) ntopng

ntopng, the next‑generation version of ntop, visualizes network usage similarly to top for processes. It requires libpcap and other dependencies and must be compiled from source.

$ sudo apt-get install libpcap-dev libglib2.0-dev libgeoip-dev redis-server wget libxml2-dev build-essential checkinstall

$ sudo wget http://sourceforge.net/projects/ntop/files/ntopng/ntopng-1.1_6932.tgz/download
$ sudo tar zxfv ntopng-1.1_6932.tgz
$ cd ntopng-1.1_6932
$ sudo ./configure
$ sudo make
$ sudo make install

Each of these tools has distinct strengths—some focus on per‑process bandwidth, others on visual graphs or packet capture—allowing system administrators and Linux users to choose the most appropriate utility for monitoring network traffic.