iftop

Show the bandwidth usage

$ sudo iftop

$ sudo iftop -i [interface]

$ sudo iftop -P

$ sudo iftop -b

$ sudo iftop -n

$ <?>

iftop [-BhinNPpV] [-i interface] [-f filter] [interface]

-B
    Display rates in bytes/sec instead of bits/sec.

-h
    Show help and exit.

-i ifname
    Monitor specific interface (default: first non-loopback).

-n
    Disable hostname (DNS) resolution.

-N
    Disable port number to service name resolution.

-P
    Display port numbers alongside IPs.

-f filter
    Berkeley Packet Filter expression to limit captured packets.

-p port
    Monitor only traffic on specified local port.

-u pattern
    Prefix label for ports matching regex pattern.

-V
    Enable verbose output.

iftop is a command-line utility for real-time monitoring of network bandwidth usage on Linux systems. Modeled after top, it provides a dynamic, full-screen display (using ncurses) showing live traffic statistics for a selected network interface. The interface lists active connections sorted by bandwidth consumption, with columns displaying instantaneous, 2-second, 10-second, and 40-second average rates.

Key elements include source/destination IP addresses (or hostnames if DNS resolution is enabled), ports, and transfer rates in bits/sec (or bytes/sec with option). Bidirectional traffic is indicated by => for TX/RX. It captures packets via libpcap, making it efficient for identifying bandwidth hogs, diagnosing network issues, or auditing traffic on servers.

Features: customizable filters with BPF syntax, port/service display toggles, IPv4/IPv6 support, text/snapshot outputs in newer versions. Ideal for sysadmins needing quick insights without heavy tools like Wireshark.

Requires root or CAP_NET_RAW capability.
High-traffic interfaces may cause CPU overhead.
Not suited for long-term logging; use vnstat.
Loopback/virtual interfaces often unsupported.

Top: highest bandwidth.
=>: TX rate | RX rate
Columns: now | 2s | 10s | 40s avg.
Source=>Dest format.

iftop : monitor default interface.
iftop -i eth0 -P -B : eth0, ports, bytes.
iftop -f 'port 80 or port 443' : HTTP/HTTPS only.

Created by Paul Miller in 2003 as open-source alternative to commercial tools. Inspired by top, first release around 2004. Maintained sporadically; version 1.0 in 2011, 1.2 (stable) in 2013 with IPv6, filters. Now in most distros' repos.

nethogs(1), bmon(1), iptraf(8), netstat(8), tcpdump(1), iftop(8)