Monitor Linux Network Traffic with vnstat, iftop, and nethogs

vnstat – Interface Traffic Statistics

Install vnstat using yum or apt-get, then run vnstat -i eth0 -l to display real‑time traffic on the eth0 interface. Press Ctrl+C to stop monitoring; the tool then prints a summary of the captured traffic.

iftop – Bandwidth Usage Inspection

iftop

monitors real‑time traffic per connection, can filter by network segment, resolve hostnames, and display port information. Basic usage example: iftop -i eth1. Common options include: -B – display traffic in bytes instead of bits. -n – show IP addresses without DNS lookup. -N – show numeric port numbers.

Interactive keys let you toggle what is shown while the program runs: n – switch between showing the local IP and hostname. s – toggle display of the local host information. d – toggle display of the remote host information. t – cycle through different line formats (2‑line, 1‑line, send‑only, receive‑only). N – toggle between numeric ports and service names. S – toggle display of local port information. D – toggle display of remote port information. p – toggle display of port information.

nethogs – Per‑Process Bandwidth Utilization

Install nethogs and use it to see which processes consume network bandwidth. Example commands: nethogs -d 5 – refresh the display every 5 seconds. nethogs eth0 – monitor traffic on the eth0 interface. nethogs eth0 eth1 – monitor multiple interfaces simultaneously.

While running, several interactive keys are available: m – change the unit of measurement. r – sort processes by total traffic. s – sort processes by sent traffic. q – quit the program.