Iftop - Monitor Real-Time Traffic
iftop can be used to monitor real-time traffic on a network interface.
Syntax
-i set the network interface to monitor, e.g.: # iftop -i eth1
-B display traffic in bytes (default is bits), e.g.: # iftop -B
-n don’t resolve IP addresses
-N show port numbers directly by default instead of service names, e.g.: # iftop -N
-F show inbound/outbound traffic for a specific subnet, e.g. # iftop -F 10.10.1.0/24 or # iftop -F 10.10.1.0/255.255.255.0
-h (display this message), help — shows argument information
-p with this option, the middle list shows local-host information, and IPs outside the local host also appear;
-b make the average-traffic bar graph shown by default;
-f not very familiar with this one yet — used for filtering computed packets;
-P make both host information and port information shown by default;
-m set the maximum value of the scale at the top of the interface, divided into five major segments, e.g.: # iftop -m 100M. Some operations after entering the iftop screen (note case-sensitivity)
h show help;
s hide/show the local host;
d hide/show the remote destination host;
press t to toggle the display format between 2-line/1-line/send-only/receive-only;
press N to toggle showing port numbers or port service names;
press S to toggle whether local port information is shown;
press D to toggle whether remote destination host port information is shown;
p hide/show port information;
press P to toggle pause/resume display;
press b to toggle whether the average-traffic bar graph is shown;
press B to toggle computing the average traffic over 2, 10, or 40 seconds;
press T to toggle whether total traffic per connection is shown;
press l to open the screen filter, enter the characters to filter on (e.g. an IP), and after pressing enter the screen only shows traffic information related to that IP;
press L to toggle the scale shown at the top of the screen; different scales change the traffic bar graph;
press j or k to scroll the connection records shown on screen up or down;
press 1, 2, or 3 to sort by one of the three traffic columns shown on the right;
press < to sort by the local hostname or IP on the left;
press > to sort by the remote destination host’s hostname or IP;
press o to toggle whether only current connections are shown, pinned in place;
press f to edit the filter code — this is a translated description, I haven’t actually used this one yet!
press ! to use a shell command — haven’t used this either! Not sure what commands are actually useful here!
press q to quit monitoring.
Example
iftop -i eth0
10.10.10.219 => 10.10.10.52 0.98kb 1.48kb 1.59kb
<= 160b 160b 208b
10.10.10.255 => 10.10.10.52 0b 0b 0b
<= 0b 54b 21b
255.255.255.255 => 10.10.10.194 0b 0b 0b
<= 0b 0b 155b
Shown at the top of the interface is a ruler-like scale range, used as a ruler for the traffic bar graphs below.
The <= and => arrows in the middle indicate the direction of traffic; the three columns of values after them represent the average network traffic sent over the last 2, 10, and 40 seconds respectively. By default, sorting is based on the average network traffic over the last ten seconds.
Some global statistics are shown at the bottom
TX: cum: 5.57kB peak: 4.02kb rates: 0.98kb 1.54kb 1.71kb
RX: 1.81kB 3.22kb 160b 271b 569b
TOTAL: 7.37kB 5.32kb 1.14kb 1.80kb 2.27kb
TX: outbound traffic
RX: inbound traffic
TOTAL: total traffic
cum: cumulative traffic since iftop started running
peak: peak traffic
rates: the average traffic over the past 2s, 10s, and 40s respectively