Top 8 Linux Tools to Monitor Real‑Time Network Traffic

In daily work we often need to view real‑time network interface traffic on Linux servers. The following tools are commonly used for this purpose.

sar

/proc/net/dev

ifstat

iftop

nload

iptraf‑ng

nethogs

Extensions

1. sar

The sar command, part of the sysstat package, provides per‑interface statistics, including packets per second and traffic volume. sar -n DEV 1 2 This command reads the default interface (usually eth0) once per second for two samples and displays the results.

2. /proc/net/dev

The /proc pseudo‑filesystem allows runtime access to kernel data structures. The file /proc/net/dev provides statistics for network adapters.

Note: Because /proc exists only in memory, the counters reset on reboot; they accumulate from system start to the moment the command is run.

Parameter description: bytes – total bytes sent or received packets – total packets sent or received errs – total transmission or reception errors drop – total dropped packets fifo – FIFO buffer errors frame – frame errors colls – detected collisions compressed – compressed packets carrier – carrier loss count multicast – multicast frames

Most real‑time traffic commands read this file and compute rates from the values.

3. ifstat

ifstat

is a tool for reporting network interface activity.

Installation

sudo apt-get update
sudo apt-get install ifstat

Options

-l – monitor loopback interface (lo) -a – monitor all detectable interfaces -z – hide interfaces with zero traffic -i <iface> – monitor a specific interface -s – query a remote host via SNMP -h – show brief help -n – suppress periodic header lines -t – prepend a timestamp to each line -T – report total bandwidth of all monitored interfaces -w – set column width manually -W – wrap lines that exceed terminal width -S – keep status on a single line (no scrolling) -b – display bandwidth in kbits/s instead of kbytes/s -q – quiet mode (no warnings) -v – show version information -d – specify a driver for data collection

Usage example

ifstat -tT

Parameter description: in – total bytes received out – total bytes transmitted

4. iftop

iftop

is a real‑time traffic monitor that shows TCP/UDP connections. It must be run as root.

Installation

sudo apt-get update
sudo apt-get install iftop

Options

iftop -h | [-npblNBP] [-i interface] [-f filter code] [-F net/mask] [-G net6/mask6]

Detailed options

-i – specify interface -n – display IP addresses only (no DNS) -B – display bandwidth in bytes (default is bits) -p – run in promiscuous mode (packet sniffing) -N – show port numbers only -P – show host and port information -F – filter a specific network, e.g., iftop -F 192.168.12.0/24 -m – set maximum scale for the traffic bar -t – text output mode -L – limit number of displayed lines -s <sec> – run for sec seconds then exit -L – specify alternate log file

Usage examples

sudo iftop -i eth0 -t -s 30 -L 100

Another view without the interactive UI:

sudo iftop -i eth0

The output can be divided into three parts: the top traffic scale bar, the main three‑column table (source, destination, and per‑connection rates), and the bottom summary rows (TX, RX, TOTAL with cumulative, peak, and recent rates).

5. nload

nload

is a console application that visualizes incoming and outgoing traffic with two graphs and provides total data exchanged, minimum/maximum bandwidth, etc.

Installation

sudo apt-get update
sudo apt-get install nload

Options

-a – set averaging period (seconds, default 300) -i – set maximum inbound scale (default 10240 kBit/s) -m – hide the graph, show only statistics -o – set maximum outbound scale (default 10240 kBit/s) -t – refresh interval in milliseconds (default 500) -u – unit for right‑hand values (auto, b, k, m, g) -U – unit for TTL column (auto, B, K, M, G) Devices – specify interfaces to monitor (default all)

Usage example

nload eth0

6. iptraf‑ng

iptraf‑ng

is a powerful tool for observing network flow from the hardware layer up to individual socket pairs.

Installation

sudo apt-get update
sudo apt-get install iptraf-ng

Options

iptraf-ng [options]: -h, --help show help -i start IP traffic monitor (use '-i all' for all interfaces) -d start detailed statistics on an interface -s start TCP/UDP monitor on an interface -z show packet size counts -l start LAN station monitor (use '-l all') -g start general interface statistics -B run in background (single interface only) -f clear all locks and counters -t run for a specified number of minutes -L specify alternate log file

Usage example

sudo iptraf-ng -s eth0

– shows per‑port traffic.

7. nethogs

nethogs

groups bandwidth usage by process, helping to identify which PID is consuming network resources.

Installation

sudo apt-get update
sudo apt-get install nethogs

Options

-V – print version -h – help -b – bughunt mode (implies tracemode) -d – update delay in seconds (default 1) -v – view mode (0=KB/s, 1=total KB, 2=total B, 3=total MB) -c – number of updates (0 = unlimited) -t – tracemode -p – chaotic mode (not recommended) -s – sort by sent column -a – monitor all devices, including loopback device – specific interface to monitor (default all non‑loopback)

During execution, press q to quit, s to sort by sent traffic, r to sort by received traffic, and m to toggle between total and per‑second modes.

Usage example

sudo nethogs eth0

8. Extensions

Other useful Linux traffic‑monitoring utilities include: ip – view total interface traffic stat – a versatile system‑information tool that can replace vmstat, iostat, netstat, nfsstat, and ifstat ss and netstat – inspect active connections and listening ports (ss is faster) nethogs – process‑oriented bandwidth monitor