Top 20 Linux Command-Line Tools for Real-Time Network Monitoring

If you need to monitor network traffic on a Linux system, a variety of command-line tools are available, each with its own strengths for displaying bandwidth usage, per‑process traffic, or detailed packet information.

1) nethogs

nethogs groups bandwidth by process rather than by protocol or subnet, supporting both IPv4 and IPv6. It is useful for identifying which PID is consuming network resources.

<code>nethogs -p wlan0</code>

2) nload

nload provides real‑time visual graphs of incoming and outgoing traffic for a selected interface, showing total transferred data and min/max rates.

<code>nload</code>

3) slurm

slurm displays network load using an ASCII graph and supports interactive keys for mode switching, screen redraw, and TX/RX LED toggling.

<code>man slurm</code>

4) iftop

iftop monitors bandwidth usage per host pair on a chosen interface, presenting the data in a table similar to top.

<code>sudo apt-get install iftop</code>

5) collectl

collectl records system state data in two modes: recording (live display or file output) and playback (reading from recorded files).

<code>sudo apt-get install collectl</code>

6) Netstat

Netstat shows TCP connections, routing tables, and interface statistics. It is part of the net‑tools package.

<code>sudo apt-get install net-tools</code>

7) Netload

Netload, part of the netdiag suite, reports current network load and total bytes transferred since start.

<code>sudo apt-get install netdiag</code>

8) Nagios

Nagios is a powerful open‑source monitoring system that provides a web interface to track the health of Linux, Windows, routers, switches, and printers, issuing alerts before issues impact services.

9) EtherApe

EtherApe is a graphical network monitor for Unix that visualizes traffic by node size and color, supporting multiple link‑layer and IP protocols.

10) tcpflow

tcpflow captures TCP streams and stores each flow in separate files for later analysis, correctly handling retransmissions and out‑of‑order packets.

<code>sudo apt-get install tcpflow</code>

11) IPTraf

IPTraf is a console‑based network statistics tool that displays TCP/UDP traffic, interface info, and packet counts.

<code>sudo apt-get install iptraf</code>

12) Speedometer

Speedometer draws a simple graph of upload and download rates for a specified port.

<code>sudo apt-get install speedometer</code>

13) Netwatch

Netwatch, part of netdiag, shows connection status and data transfer rates for local and remote hosts.

<code>sudo apt-get install netdiag</code>

14) Trafshow

Trafshow reports active connections, protocols, and per‑connection transfer rates, supporting pcap filters.

<code>sudo apt-get install trafshow</code>

15) Vnstat

Vnstat runs as a daemon, continuously logging traffic volume and can generate historical usage reports.

<code>sudo apt-get install vnstat</code>

16) tcptrack

tcptrack displays the state of TCP connections on a given interface, similar to top, and can filter by port.

<code>sudo apt-get install tcptrack</code>

17) CBM

CBM (Color Bandwidth Meter) shows bandwidth usage for all network devices in a simple colored display.

<code>sudo apt-get install cbm</code>

18) bmon

bmon (Bandwidth Monitor) provides real‑time bandwidth statistics with curses, HTML, or ASCII output.

<code>sudo apt-get install bmon</code>

19) tcpdump

tcpdump captures and prints packets that match a given expression, useful for debugging network issues.

<code>sudo apt-get install tcpdump</code>

20) ntopng

ntopng is the next‑generation version of ntop, offering a web‑based interface to visualize network usage across platforms. It requires building from source on Debian/Ubuntu.

<code>sudo apt-get install libpcap-dev libglib2.0-dev libgeoip-dev redis-server wget libxml2-dev build-essential checkinstall</code>

In conclusion, these Linux network monitoring tools each have distinct features and options, but all can help you effectively monitor and analyze network traffic.