Which one when¶
| Question | Tool |
|---|---|
| Which remote hosts is this machine talking to, and how fast? | iftop (or jnettop) |
| Which local process is using the bandwidth? | nethogs |
| Detailed per-interface / per-protocol counters, in a curses UI | iptraf-ng |
| One-line-per-interval NIC utilisation, script-friendly | nicstat |
| Long-term traffic history with a web UI | vnstat or ntopng |
All of them need root because they read packets or per-socket data directly.
iftop — per-connection view¶
sudo dnf install iftop # or apt-get install iftop
sudo iftop -i eth0 -nNP
-n skips DNS lookups, -N skips port name lookups, -P shows ports. Inside the UI: t cycles the display mode, s/d toggles source/destination, p toggles ports, and q quits. The three columns are averages over 2, 10, and 40 seconds. jnettop presents a similar host-by-host view.
nethogs — per-process view¶
sudo dnf -y install nethogs
sudo nethogs eth0
Groups traffic by process rather than by connection, which is the fast answer to "what is eating my uplink?". m changes units and q quits.
iptraf-ng¶
sudo dnf install iptraf-ng
sudo iptraf-ng
A menu-driven curses tool with IP traffic monitor, per-interface statistics, and LAN station monitor views.
nicstat¶
nicstat 1 5
Prints utilisation, saturation, and packet rates per interface every second for five samples. It is like iostat for NICs, which makes it easy to feed into scripts.
ntopng¶
ntopng is the successor to the older ntop: a web-based flow and traffic analyser. It is heavier to run and worth it when you need per-host history and application classification.