Bandwidth and Traffic Monitoring: vnstat, iftop, nethogs Guide

Monitoring your server's network traffic is critical for detecting performance issues, optimizing bandwidth usage, and spotting abnormal activity. In this guide, we'll cover the most popular tools for monitoring network traffic on Linux — vnstat, iftop, nethogs, and nload.

vnstat — Historical Traffic Statistics

vnstat is a lightweight tool that stores traffic statistics for network interfaces in a database. It preserves historical data even after system restarts.

Installation

hljs bash

# Ubuntu/Debian
sudo apt update
sudo apt install vnstat -y

# CentOS/AlmaLinux
sudo dnf install vnstat -y

# Start the service
sudo systemctl enable vnstat
sudo systemctl start vnstat

Basic Usage

hljs bash

# Summary of all interfaces
vnstat

# Specific interface
vnstat -i eth0

# Hourly statistics
vnstat -h
vnstat -i eth0 -h

# Daily statistics
vnstat -d
vnstat -i eth0 -d

# Monthly statistics
vnstat -m
vnstat -i eth0 -m

# Weekly statistics
vnstat -w

# Live traffic (updates every 5 seconds)
vnstat -l
vnstat -i eth0 -l

# Summary of last 5 hours
vnstat -h 5

# JSON output (for script integration)
vnstat --json
vnstat -i eth0 --json

Reading vnstat Output

                      rx      /      tx      /     total    /   estimated
 eth0:
       2024-01-15    1.23 GiB  /    456 MiB  /    1.67 GiB
       2024-01-16    2.45 GiB  /    789 MiB  /    3.24 GiB

rx: Received (download) traffic
tx: Transmitted (upload) traffic
total: Total traffic
estimated: End-of-month estimate

vnstat Configuration

hljs bash

# Configuration file
sudo nano /etc/vnstat.conf

# Important settings:
# Interface "eth0"     # Interface to monitor
# MaxBandwidth 1000    # Maximum bandwidth (Mbit/s)
# SaveInterval 5       # Save interval (minutes)

# Reset database
vnstat --delete --force -i eth0
vnstat --add -i eth0

iftop — Real-Time Connection Monitoring

iftop is an interactive tool that shows in real time how much traffic is being exchanged with which IP addresses.

Installation

hljs bash

# Ubuntu/Debian
sudo apt install iftop -y

# CentOS/AlmaLinux
sudo dnf install iftop -y

Basic Usage

hljs bash

# Run on default interface
sudo iftop

# Specific interface
sudo iftop -i eth0

# Disable DNS resolution (faster)
sudo iftop -n

# Show port numbers
sudo iftop -P

# Filter specific network
sudo iftop -F 192.168.1.0/24

# Save output to file
sudo iftop -t -s 10 > /tmp/iftop_output.txt

iftop Keyboard Shortcuts

n  — Toggle DNS resolution
p  — Toggle port numbers
P  — Pause
s  — Toggle source address
d  — Toggle destination address
t  — Toggle traffic direction (in/out/both)
1  — 2-second average
2  — 10-second average
3  — 40-second average
q  — Quit

Reading iftop Output

                 12.5Kb          25.0Kb          37.5Kb          50.0Kb    62.5Kb
└────────────────────────────────────────────────────────────────────────────────
203.0.113.50   =>  203.0.113.1                    1.23Kb  2.45Kb  3.67Kb
                <=                                 4.56Kb  8.90Kb  12.3Kb

=>: Outgoing traffic (upload)
<=: Incoming traffic (download)
Three columns: 2s, 10s, 40s averages

nethogs — Per-Process Bandwidth

nethogs shows which application or process is using how much bandwidth. Ideal for finding the process generating high traffic.

Installation

hljs bash

# Ubuntu/Debian
sudo apt install nethogs -y

# CentOS/AlmaLinux
sudo dnf install nethogs -y

Basic Usage

hljs bash

# Monitor all interfaces
sudo nethogs

# Specific interface
sudo nethogs eth0

# Multiple interfaces
sudo nethogs eth0 eth1

# Set update interval (seconds)
sudo nethogs -d 2

# Traffic unit (KB/s)
sudo nethogs -v 1

# Traffic unit (MB/s)
sudo nethogs -v 2

# Traffic unit (GB/s)
sudo nethogs -v 3

Reading nethogs Output

NetHogs version 0.8.7

  PID USER     PROGRAM                      DEV        SENT      RECEIVED
 1234 www-data /usr/sbin/apache2            eth0       1.234     5.678 KB/sec
 5678 root     /usr/bin/wget                eth0       0.123     45.67 KB/sec
 9012 mysql    /usr/sbin/mysqld             eth0       2.345     1.234 KB/sec

PID: Process ID
USER: User running the process
PROGRAM: Application name
SENT: Data send rate
RECEIVED: Data receive rate

nethogs Keyboard Shortcuts

m  — Change traffic unit (KB/MB/GB)
r  — Sort by received traffic
s  — Sort by sent traffic
q  — Quit

nload — Bandwidth Graph

nload is a simple tool that displays network traffic as an ASCII graph in real time.

Installation

hljs bash

# Ubuntu/Debian
sudo apt install nload -y

# CentOS/AlmaLinux
sudo dnf install nload -y

Basic Usage

hljs bash

# Default interface
nload

# Specific interface
nload eth0

# Multiple interfaces (switch with arrow keys)
nload eth0 eth1

# Update interval (milliseconds)
nload -t 500

# Traffic unit
nload -u h  # Human readable
nload -u m  # Mbit/s
nload -u k  # Kbit/s

Reading nload Output

Device eth0 [203.0.113.50] (1/1):
================================================================================
Incoming:                                           Outgoing:

Curr: 1.23 MBit/s                              Curr: 456.78 KBit/s
Avg:  987.65 KBit/s                            Avg:  234.56 KBit/s
Min:  123.45 KBit/s                            Min:  45.67 KBit/s
Max:  2.34 MBit/s                              Max:  789.01 KBit/s
Ttl:  1.23 GByte                               Ttl:  456.78 MByte

Other Useful Tools

bmon — Bandwidth Monitor

hljs bash

sudo apt install bmon -y
bmon
# Shows all interfaces graphically

ss — Socket Statistics

hljs bash

# List active connections
ss -tuln

# Show connection count
ss -s

# Filter by specific port
ss -tuln sport = :80

# Show connection states
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

Traffic Statistics with ip Command

hljs bash

# Interface statistics
ip -s link show eth0

# All interfaces
ip -s link

# Continuous monitoring
watch -n 1 'ip -s link show eth0'

Raw Statistics with /proc/net/dev

hljs bash

# Instant traffic statistics
cat /proc/net/dev

# Specific interface
grep eth0 /proc/net/dev

# Simple bandwidth calculation script
#!/bin/bash
IFACE=eth0
RX1=$(grep $IFACE /proc/net/dev | awk '{print $2}')
TX1=$(grep $IFACE /proc/net/dev | awk '{print $10}')
sleep 1
RX2=$(grep $IFACE /proc/net/dev | awk '{print $2}')
TX2=$(grep $IFACE /proc/net/dev | awk '{print $10}')
echo "RX: $((($RX2-$RX1)/1024)) KB/s"
echo "TX: $((($TX2-$TX1)/1024)) KB/s"

Interpreting Results

Detecting Abnormal Traffic

hljs bash

# Find processes generating high traffic
sudo nethogs eth0

# Check suspicious connections
ss -tuln
netstat -tuln

# List external IP connections
ss -tn | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn

Bandwidth Usage Report

hljs bash

# Monthly usage summary
vnstat -m

# Daily usage graph
vnstat --oneline

# All-time top 10 usage
vnstat --top10

You can create automated reports by combining vnstat with cron:

hljs bash

# Send report every night at midnight
0 0 * * * vnstat --json > /var/log/vnstat_daily.json

iftop and nethogs require root privileges. For security, run these tools only when needed and store outputs securely.

Conclusion

vnstat is ideal for historical traffic statistics, iftop for real-time connection monitoring, nethogs for per-process bandwidth analysis, and nload for visual traffic graphs. Using these tools together, you can comprehensively monitor your server's network traffic, detect abnormal activity, and optimize bandwidth usage.

Bandwidth and Traffic Monitoring: vnstat, iftop, nethogs Guide

Table of Contents