iftop: Bandwidth usage per connection

Monitoring Network Bandwidth per Connection with iftop on Linux

When administering servers or networks, it's crucial to understand where bandwidth is being used. Tools like iftop provide a real-time view into network bandwidth utilization by connection. Unlike some other tools that aggregate total traffic, iftop focuses on individual connections, making it easier to see who is consuming your bandwidth. In this article, we'll explore how to install and use iftop on various Linux distributions.

What is iftop?

iftop is a command-line tool that provides a live view of network traffic between hosts. It displays a list of network connections from your system to other systems, showing data such as the amount of data being transferred, the source and destination addresses, and overall bandwidth usage. This is especially useful for troubleshooting network performance issues and ensuring that no unauthorized services are using network resources.

Installing iftop

Ubuntu and Debian (Using apt)

Update your package list:
```
sudo apt update
```
Install iftop:
```
sudo apt install iftop
```

Fedora (Using dnf)

Install iftop: sh sudo dnf install iftop

openSUSE (Using zypper)

Install iftop: sh sudo zypper install iftop

Basic Usage of iftop

To start monitoring your network's bandwidth usage, simply run iftop from your terminal:

sudo iftop

When you run iftop, it will open an interface showing the live traffic usage. By default, the display shows the source host on the left, the destination host on the right, and the bandwidth rates between these hosts.

Key Commands Inside iftop

P: To toggle port display.
n: To toggle the display of hostnames and IP addresses.
T: Show cumulative history rather than instantaneous bandwidth.
q: Quit iftop.

Understanding the Output

The main panel of iftop shows send and receive rates per connection:

<=> indicates both the upstream and downstream bandwidth.
=> shows send rate (from local to remote).
<= shows receive rate (from remote to local).

The data is updated every two seconds by default, but this can be adjusted with command-line options.

Filtering Traffic

iftop allows for traffic filtering using the pcap filter syntax. For example, to only monitor traffic on port 22, you can use:

sudo iftop -f 'port 22'

This can be very helpful when you are interested in a particular type of traffic or diagnosing issues with specific services.

Summary

iftop is a powerful tool that offers a clear window into the bandwidth usage of your network by each connection. Its real-time insight can be a life-saver for system and network administrators looking to pinpoint issues or keep an eye on system resources without installing complex monitoring solutions. Whether you're managing a single server or an entire data center, iftop provides the visibility you need to ensure your network is performing well. Choose your Linux distribution, install iftop, and start monitoring your network more effectively today.