Skip to main content
Back to Category

Bandwidth and Traffic Monitoring: vnstat, iftop, nethogs Guide

Historical stats with vnstat, real-time monitoring with iftop, per-process bandwidth with nethogs, nload usage, and interpreting results.

Read time: 13 min Network & DNS
bandwidth monitoringvnstatiftopnethogsnloadnetwork trafficbandwidthlinux network tools
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

Bandwidth and Traffic Monitoring: vnstat, iftop, nethogs Guide

Monitoring your server's network traffic is critical for detecting performance issues, optimizing bandwidth usage, and spotting abnormal activity. In this guide, we'll cover the most popular tools for monitoring network traffic on Linux — vnstat, iftop, nethogs, and nload.

vnstat — Historical Traffic Statistics

vnstat is a lightweight tool that stores traffic statistics for network interfaces in a database. It preserves historical data even after system restarts.

Installation

hljs bash
# Ubuntu/Debian
sudo apt update
sudo apt install vnstat -y

# CentOS/AlmaLinux
sudo dnf install vnstat -y

# Start the service
sudo systemctl enable vnstat
sudo systemctl start vnstat

Basic Usage

hljs bash
# Summary of all interfaces
vnstat

# Specific interface
vnstat -i eth0

# Hourly statistics
vnstat -h
vnstat -i eth0 -h

# Daily statistics
vnstat -d
vnstat -i eth0 -d

# Monthly statistics
vnstat -m
vnstat -i eth0 -m

# Weekly statistics
vnstat -w

# Live traffic (updates every 5 seconds)
vnstat -l
vnstat -i eth0 -l

# Summary of last 5 hours
vnstat -h 5

# JSON output (for script integration)
vnstat --json
vnstat -i eth0 --json

Reading vnstat Output

                      rx      /      tx      /     total    /   estimated
 eth0:
       2024-01-15    1.23 GiB  /    456 MiB  /    1.67 GiB
       2024-01-16    2.45 GiB  /    789 MiB  /    3.24 GiB
  • rx: Received (download) traffic
  • tx: Transmitted (upload) traffic
  • total: Total traffic
  • estimated: End-of-month estimate

vnstat Configuration

hljs bash
# Configuration file
sudo nano /etc/vnstat.conf

# Important settings:
# Interface "eth0"     # Interface to monitor
# MaxBandwidth 1000    # Maximum bandwidth (Mbit/s)
# SaveInterval 5       # Save interval (minutes)

# Reset database
vnstat --delete --force -i eth0
vnstat --add -i eth0

iftop — Real-Time Connection Monitoring

iftop is an interactive tool that shows in real time how much traffic is being exchanged with which IP addresses.

Installation

hljs bash
# Ubuntu/Debian
sudo apt install iftop -y

# CentOS/AlmaLinux
sudo dnf install iftop -y

Basic Usage

hljs bash
# Run on default interface
sudo iftop

# Specific interface
sudo iftop -i eth0

# Disable DNS resolution (faster)
sudo iftop -n

# Show port numbers
sudo iftop -P

# Filter specific network
sudo iftop -F 192.168.1.0/24

# Save output to file
sudo iftop -t -s 10 > /tmp/iftop_output.txt

iftop Keyboard Shortcuts

n  — Toggle DNS resolution
p  — Toggle port numbers
P  — Pause
s  — Toggle source address
d  — Toggle destination address
t  — Toggle traffic direction (in/out/both)
1  — 2-second average
2  — 10-second average
3  — 40-second average
q  — Quit

Reading iftop Output

                 12.5Kb          25.0Kb          37.5Kb          50.0Kb    62.5Kb
└────────────────────────────────────────────────────────────────────────────────
203.0.113.50   =>  203.0.113.1                    1.23Kb  2.45Kb  3.67Kb
                <=                                 4.56Kb  8.90Kb  12.3Kb
  • =>: Outgoing traffic (upload)
  • <=: Incoming traffic (download)
  • Three columns: 2s, 10s, 40s averages

nethogs — Per-Process Bandwidth

nethogs shows which application or process is using how much bandwidth. Ideal for finding the process generating high traffic.

Installation

hljs bash
# Ubuntu/Debian
sudo apt install nethogs -y

# CentOS/AlmaLinux
sudo dnf install nethogs -y

Basic Usage

hljs bash
# Monitor all interfaces
sudo nethogs

# Specific interface
sudo nethogs eth0

# Multiple interfaces
sudo nethogs eth0 eth1

# Set update interval (seconds)
sudo nethogs -d 2

# Traffic unit (KB/s)
sudo nethogs -v 1

# Traffic unit (MB/s)
sudo nethogs -v 2

# Traffic unit (GB/s)
sudo nethogs -v 3

Reading nethogs Output

NetHogs version 0.8.7

  PID USER     PROGRAM                      DEV        SENT      RECEIVED
 1234 www-data /usr/sbin/apache2            eth0       1.234     5.678 KB/sec
 5678 root     /usr/bin/wget                eth0       0.123     45.67 KB/sec
 9012 mysql    /usr/sbin/mysqld             eth0       2.345     1.234 KB/sec
  • PID: Process ID
  • USER: User running the process
  • PROGRAM: Application name
  • SENT: Data send rate
  • RECEIVED: Data receive rate

nethogs Keyboard Shortcuts

m  — Change traffic unit (KB/MB/GB)
r  — Sort by received traffic
s  — Sort by sent traffic
q  — Quit

nload — Bandwidth Graph

nload is a simple tool that displays network traffic as an ASCII graph in real time.

Installation

hljs bash
# Ubuntu/Debian
sudo apt install nload -y

# CentOS/AlmaLinux
sudo dnf install nload -y

Basic Usage

hljs bash
# Default interface
nload

# Specific interface
nload eth0

# Multiple interfaces (switch with arrow keys)
nload eth0 eth1

# Update interval (milliseconds)
nload -t 500

# Traffic unit
nload -u h  # Human readable
nload -u m  # Mbit/s
nload -u k  # Kbit/s

Reading nload Output

Device eth0 [203.0.113.50] (1/1):
================================================================================
Incoming:                                           Outgoing:

Curr: 1.23 MBit/s                              Curr: 456.78 KBit/s
Avg:  987.65 KBit/s                            Avg:  234.56 KBit/s
Min:  123.45 KBit/s                            Min:  45.67 KBit/s
Max:  2.34 MBit/s                              Max:  789.01 KBit/s
Ttl:  1.23 GByte                               Ttl:  456.78 MByte

Other Useful Tools

bmon — Bandwidth Monitor

hljs bash
sudo apt install bmon -y
bmon
# Shows all interfaces graphically

ss — Socket Statistics

hljs bash
# List active connections
ss -tuln

# Show connection count
ss -s

# Filter by specific port
ss -tuln sport = :80

# Show connection states
ss -tan | awk '{print $1}' | sort | uniq -c | sort -rn

Traffic Statistics with ip Command

hljs bash
# Interface statistics
ip -s link show eth0

# All interfaces
ip -s link

# Continuous monitoring
watch -n 1 'ip -s link show eth0'

Raw Statistics with /proc/net/dev

hljs bash
# Instant traffic statistics
cat /proc/net/dev

# Specific interface
grep eth0 /proc/net/dev

# Simple bandwidth calculation script
#!/bin/bash
IFACE=eth0
RX1=$(grep $IFACE /proc/net/dev | awk '{print $2}')
TX1=$(grep $IFACE /proc/net/dev | awk '{print $10}')
sleep 1
RX2=$(grep $IFACE /proc/net/dev | awk '{print $2}')
TX2=$(grep $IFACE /proc/net/dev | awk '{print $10}')
echo "RX: $((($RX2-$RX1)/1024)) KB/s"
echo "TX: $((($TX2-$TX1)/1024)) KB/s"

Interpreting Results

Detecting Abnormal Traffic

hljs bash
# Find processes generating high traffic
sudo nethogs eth0

# Check suspicious connections
ss -tuln
netstat -tuln

# List external IP connections
ss -tn | grep ESTABLISHED | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn

Bandwidth Usage Report

hljs bash
# Monthly usage summary
vnstat -m

# Daily usage graph
vnstat --oneline

# All-time top 10 usage
vnstat --top10

You can create automated reports by combining vnstat with cron:

hljs bash
# Send report every night at midnight
0 0 * * * vnstat --json > /var/log/vnstat_daily.json

iftop and nethogs require root privileges. For security, run these tools only when needed and store outputs securely.

Conclusion

vnstat is ideal for historical traffic statistics, iftop for real-time connection monitoring, nethogs for per-process bandwidth analysis, and nload for visual traffic graphs. Using these tools together, you can comprehensively monitor your server's network traffic, detect abnormal activity, and optimize bandwidth usage.

Frequently Asked Questions

What is the difference between vnstat and iftop?

vnstat stores historical traffic statistics (hourly, daily, monthly) in a database and generates reports. iftop shows in real time how much traffic is being exchanged with which IP addresses. The two complement each other.

How do I find which process is consuming bandwidth?

With 'sudo nethogs eth0' you can see in real time which application is using how much bandwidth. The process name is displayed along with PID and user information.

Where is vnstat data stored?

vnstat data is stored in an SQLite database in the /var/lib/vnstat/ directory. A separate database file is created for each network interface.

How do I track my monthly bandwidth limit?

You can see monthly usage with 'vnstat -m'. You can write your own monitoring scripts by getting JSON output with 'vnstat --json'. You can also track your bandwidth usage from the REXE panel.

Why does iftop require root privileges?

iftop uses raw sockets to capture network packets. This operation requires root privileges on Linux. Alternatively, you can run it without root using 'sudo setcap cap_net_raw+ep /usr/sbin/iftop'.

Related Articles

Nameserver Change: Domain DNS Transfer Guide

What are nameservers, how to change NS at your registrar, propagation time, checking with whois/dig, and common registrar interfaces guide.

11 min
nameserverns changedns transfer
Network TrafficInbound— GbpsOutbound— Gbps