Monitor Real-Time Linux Network Traffic Using nload, iftop, sar & Scripts

nload Tool

nload provides real‑time bandwidth monitoring for network interfaces. It is not installed by default; install it on CentOS/RHEL with:

$ yum install -y epel-release
$ yum install -y nload

Run nload and you will see a split screen showing incoming and outgoing traffic, current, average, minimum and maximum values for the selected device (e.g., eth0).

iftop Tool

iftop also needs to be installed manually. Install it with:

# need epel repository
$ yum install -y epel-release
$ yum install -y iftop

After installation, execute iftop to view an interactive interface. The top bar shows a scale ruler, the arrows indicate traffic direction, and the columns display TX (sent), RX (received), TOTAL, Cumm, peak, and rates for the last 2 s, 10 s and 40 s.

sar Command

The sar command is part of the sysstat package and can report a wide range of system statistics, including per‑interface network traffic. Install sysstat and run:

$ sar -n DEV 1 2

The -n option accepts six switches: DEV (interface stats), EDEV (error stats), NFS (client), NFSD (server), SOCK (socket), ALL (all above).

# Example output (truncated)
09:52:28 AM IFACE   rxpck/s txpck/s rxkB/s txkB/s …
eth0      2.02    1.01    0.13   0.16   …
lo        0.00    0.00    0.00   0.00   …

Real‑time Monitoring Script 1

This shell script calculates per‑second traffic by reading /proc/net/dev, comparing the current and previous counters, and formatting the result in B/s, KB/s or MB/s.

# network.sh
ethn=$1
while true; do
  RX_pre=$(cat /proc/net/dev | grep $ethn | awk '{print $2}')
  TX_pre=$(cat /proc/net/dev | grep $ethn | awk '{print $10}')
  sleep 1
  RX_next=$(cat /proc/net/dev | grep $ethn | awk '{print $2}')
  TX_next=$(cat /proc/net/dev | grep $ethn | awk '{print $10}')
  clear
  echo -e "t RX $(date +%k:%M:%S) TX"
  RX=$((RX_next-RX_pre))
  TX=$((TX_next-TX_pre))
  if [[ $RX -lt 1024 ]]; then
    RX="${RX}B/s"
  elif [[ $RX -gt 1048576 ]]; then
    RX=$(echo $RX | awk '{print $1/1048576 "MB/s"}')
  else
    RX=$(echo $RX | awk '{print $1/1024 "KB/s"}')
  fi
  if [[ $TX -lt 1024 ]]; then
    TX="${TX}B/s"
  elif [[ $TX -gt 1048576 ]]; then
    TX=$(echo $TX | awk '{print $1/1048576 "MB/s"}')
  else
    TX=$(echo $TX | awk '{print $1/1024 "KB/s"}')
  fi
  echo "$ethn t $RX   $TX "
done

Sample execution shows increasing byte counts for eth0 each second.

Real‑time Monitoring Script 2

This alternative script also reads /proc/net/dev but uses awk to extract the inbound and outbound byte counters, then prints them each second.

# network_flow.sh
NIC=$1
while true; do
  OLD_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
  OLD_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
  sleep 1
  NEW_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
  NEW_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
  clear
  IN=$(printf "%.1fB/s" $((NEW_IN-OLD_IN)))
  OUT=$(printf "%.1fB/s" $((NEW_OUT-OLD_OUT)))
  echo "       traffic in $(date +%k:%M:%S)  traffic out"
  echo "$NIC   $IN              $OUT"
done

Running the script with eth0 prints per‑second inbound and outbound traffic, e.g., eth0 732.0B/s 948.0B/s.