Top 20 Linux Network Monitoring Tools Every Sysadmin Should Know

Monitoring network traffic on Linux is essential for system administrators, and a rich set of command‑line tools is available to help.

1) nethogs

nethogs groups bandwidth usage by process rather than by protocol, supporting IPv4 and IPv6. Run nethogs -p wlan0 to monitor a specific interface in promiscuous mode.

2) nload

nload provides real‑time traffic graphs for inbound and outbound bandwidth. Simply execute nload and use the left/right arrows to switch interfaces.

3) slurm

slurm displays network load as ASCII graphs and supports interactive keys (c, s, r, L, m, q). View its manual with man slurm and install via sudo apt-get install slurm.

4) iftop

iftop shows bandwidth per host pair on a selected interface. Install with sudo apt-get install iftop or yum -y install iftop.

5) collectl

collectl records system performance data in recording mode and can replay it later. Install with sudo apt-get install collectl or yum install collectl.

6) Netstat

Netstat displays TCP connections, routing tables, and interface statistics. Install the net-tools package ( sudo apt-get install net-tools or yum install net-tools) and run netstat to view current stats.

7) Netload

Netload, part of the netdiag suite, reports total bytes transferred since start. Install via yum install netdiag or sudo apt-get install netdiag and run netload wlan2 (replace wlan2 with your interface).

8) Nagios

Nagios is a powerful open‑source monitoring system with a web UI that aggregates alerts from Linux, Windows, routers, and printers.

9) EtherApe

EtherApe provides a graphical view of network traffic, scaling node size and color by protocol. Install with yum install etherape or sudo apt-get install etherape and run with sudo etherape.

10) tcpflow

tcpflow captures TCP streams and saves them to files for later analysis. Install with sudo apt-get install tcpflow or yum install tcpflow and capture with sudo tcpflow -i eth0 port 8000.

11) IPTraf

IPTraf provides console‑based network statistics, including packet/byte counts per interface. Install via sudo apt-get install iptraf or yum install iptraf and run sudo iptraf wlan2.

12) Speedometer

Speedometer draws a simple graph of upload and download rates on a given interface. Install with yum install speedometer or sudo apt-get install speedometer and run speedometer -r wlan2 -t wlan2.

13) Netwatch

Netwatch (part of netdiag) shows connection status and transfer rates. Install with yum install netwatch or sudo apt-get install netdiag and run sudo netwatch -e wlan2 -nt.

14) Trafshow

Trafshow reports active connections, protocols, and transfer rates, supporting pcap filters. Install via yum install trafshow or sudo apt-get install trafshow and run sudo trafshow -i wlan2.

15) Vnstat

Vnstat runs as a daemon recording traffic volume and can generate historical reports. Install with yum install vnstat or sudo apt-get install vnstat and view live stats with vnstat -l.

16) tcptrack

tcptrack displays active TCP connections in a top‑like interface. Install via sudo apt-get install tcptrack or yum install tcptrack and run sudo tcptrack -i wlan2.

17) CBM

CBM (Color Bandwidth Meter) shows real‑time bandwidth per device. Install with sudo apt-get install cbm and start with cbm.

18) bmon

bmon (Bandwidth Monitor) provides curses‑based, HTML, and ASCII output for interface statistics. Install with sudo apt-get install bmon and run bmon.

19) tcpdump

tcpdump captures packets matching a filter expression. Install with sudo apt-get install tcpdump or yum install tcpdump and capture on an interface with sudo tcpdump -i wlan2 (e.g., sudo tcpdump -i wlan2 'port 80').

20) ntopng

ntopng is the next‑generation version of ntop, providing a web‑based interface for network usage. Install dependencies with

sudo apt-get install libpcap-dev libglib2.0-dev libgeoip-dev redis-server wget libxml2-dev build-essential checkinstall

, download the source, compile, and install.

In conclusion, each of these tools offers distinct capabilities for monitoring network traffic, and together they provide a comprehensive toolbox for both novice and experienced Linux administrators.