iftop: Display bandwidth usage per interface

Understanding and Monitoring Network Bandwidth with iftop on Linux

As network administrators or just curious users, it’s vital to keep an eye on the bandwidth usage to ensure efficient network operations. Whether you're troubleshooting a slow network or ensuring no unauthorized traffic is consuming your bandwidth, knowing what's happening on your network interface is essential. This is where iftop becomes an indispensable tool. iftop is a real-time console-based network bandwidth monitoring tool, perfect for visualizing network traffic as it shows a list of network connections from or to your system.

In this blog, we'll explore how to install and use iftop on various Linux distributions using apt, dnf, and zypper package managers, and provide a quick guide on how to interpret the data it presents.

Installing iftop

On Ubuntu/Debian:

For systems that use the apt package manager (like Ubuntu and Debian), installing iftop is straightforward. You will need to update your package list and install the software. Open your terminal and input the following commands:

sudo apt update
sudo apt install iftop

On Fedora:

For Fedora users, the dnf package manager is used. Installing iftop is as simple as it is for Debian systems. Run these commands in the terminal:

sudo dnf makecache --refresh
sudo dnf install iftop

On openSUSE:

openSUSE users can utilize zypper, the command-line interface of the Zypper package manager, to install iftop. Here’s how it can be done:

sudo zypper refresh
sudo zypper install iftop

Using iftop

To start monitoring with iftop, simply open your terminal and execute the command sudo iftop. This command needs root privileges because capturing packets off the network interface requires elevated permissions.

When you run iftop, it will display the network interfaces to monitor (if there's more than one available). You can also specify an interface directly by using sudo iftop -i eth0, where eth0 is the name of the interface you wish to monitor.

Interpreting the output

iftop displays a list of network connections, the amount of data being transferred in both directions, and the total bandwidth usage. The main elements include:

• Source and destination: The leftmost columns show the source and destination IP addresses (or hostnames if resolvable).

• => and <= symbols: These indicate the direction of the traffic — "=>" from source to destination and "<=" from destination to source.

• Bars and Numbers: Bars indicate the relative amount of bandwidth usage compared to the full width. Numbers next to the bars show the exact data rate in kilobits or megabits per second.

Conclusion

iftop is a powerful tool for network administrators and users who need to keep an eye on network usage and performance. With simple installation on various Linux distributions and straightforward usage, it's an essential tool in your network monitoring toolkit. Remember that observing network traffic periodically can help you spot issues before they become critical, ensuring a smooth and efficient network environment.

Happy monitoring!