iftop - Network Bandwidth Monitor

calendarDec 12, 2024 · 6 min read · networking monitoring bandwidth iftop  ·
Share on: linkedincopy

Real-time network bandwidth monitoring with iftop.

Basic Usage

Monitor Default Interface

1# Monitor default network interface
2sudo iftop
3
4# Monitor specific interface
5sudo iftop -i eth0
6
7# Monitor wireless interface
8sudo iftop -i wlan0

Display Options

Filter by Host

 1# Show traffic to/from specific host
 2sudo iftop -f "host 192.168.1.100"
 3
 4# Show traffic to specific network
 5sudo iftop -f "net 192.168.1.0/24"
 6
 7# Show traffic on specific port
 8sudo iftop -f "port 80"
 9
10# Show traffic to specific host and port
11sudo iftop -f "host 192.168.1.100 and port 443"

Display Modes

 1# Show ports instead of services
 2sudo iftop -P
 3
 4# Show port numbers (not service names)
 5sudo iftop -N
 6
 7# Don't resolve hostnames (faster, shows IPs)
 8sudo iftop -n
 9
10# Show bandwidth in bytes (not bits)
11sudo iftop -B
12
13# Disable promiscuous mode (only show traffic to/from this host)
14sudo iftop -p

Output Formats

Text Mode (Non-Interactive)

1# Text output (useful for logging)
2sudo iftop -t -s 10
3
4# Text output with specific number of iterations
5sudo iftop -t -s 5 -L 10
6
7# Output to file
8sudo iftop -t -s 10 > bandwidth.log

Flags:

  • -t: Text mode (non-interactive)
  • -s N: Update every N seconds
  • -L N: Number of lines to display

Interactive Keys

While iftop is running, use these keys:

Display Options

 1h           Show/hide help
 2n           Toggle hostname resolution
 3N           Toggle port resolution
 4s/d         Toggle source/destination display
 5S/D         Toggle source/destination ports
 6p           Toggle promiscuous mode
 7P           Toggle port display
 8b           Toggle bar graph display
 9B           Toggle bytes/bits display
10t           Toggle text interface (cumulative/avg/peak)
11T           Toggle cumulative line totals
12j/k         Scroll display

Sorting

1< or >      Sort by source/destination
21/2/3       Sort by 2s/10s/40s average

Filtering

1f           Edit filter
2l           Set screen filter
3L           Set line display filter
4!           Shell command
5q           Quit

Filters (BPF Syntax)

Host Filters

 1# Single host
 2sudo iftop -f "host 192.168.1.100"
 3
 4# Multiple hosts
 5sudo iftop -f "host 192.168.1.100 or host 192.168.1.101"
 6
 7# Exclude host
 8sudo iftop -f "not host 192.168.1.100"
 9
10# Source host
11sudo iftop -f "src host 192.168.1.100"
12
13# Destination host
14sudo iftop -f "dst host 192.168.1.100"

Network Filters

1# Specific network
2sudo iftop -f "net 192.168.1.0/24"
3
4# Exclude network
5sudo iftop -f "not net 192.168.1.0/24"
6
7# Multiple networks
8sudo iftop -f "net 192.168.1.0/24 or net 10.0.0.0/8"

Port Filters

 1# Specific port
 2sudo iftop -f "port 80"
 3
 4# Multiple ports
 5sudo iftop -f "port 80 or port 443"
 6
 7# Port range
 8sudo iftop -f "portrange 8000-9000"
 9
10# Source port
11sudo iftop -f "src port 80"
12
13# Destination port
14sudo iftop -f "dst port 443"
15
16# Exclude port
17sudo iftop -f "not port 22"

Protocol Filters

 1# TCP only
 2sudo iftop -f "tcp"
 3
 4# UDP only
 5sudo iftop -f "udp"
 6
 7# ICMP only
 8sudo iftop -f "icmp"
 9
10# Specific protocol
11sudo iftop -f "ip proto 6"  # TCP
12sudo iftop -f "ip proto 17" # UDP

Combined Filters

 1# HTTP/HTTPS traffic
 2sudo iftop -f "port 80 or port 443"
 3
 4# SSH traffic to specific host
 5sudo iftop -f "host 192.168.1.100 and port 22"
 6
 7# All traffic except SSH
 8sudo iftop -f "not port 22"
 9
10# Web traffic from specific network
11sudo iftop -f "src net 192.168.1.0/24 and (port 80 or port 443)"
12
13# DNS queries
14sudo iftop -f "udp and port 53"

Common Use Cases

Monitor Web Server Traffic

1# HTTP/HTTPS traffic
2sudo iftop -i eth0 -f "port 80 or port 443" -P
3
4# Show top bandwidth consumers
5sudo iftop -i eth0 -f "port 80 or port 443" -n -P

Monitor Database Connections

 1# PostgreSQL
 2sudo iftop -f "port 5432"
 3
 4# MySQL
 5sudo iftop -f "port 3306"
 6
 7# Redis
 8sudo iftop -f "port 6379"
 9
10# MongoDB
11sudo iftop -f "port 27017"

Monitor Specific Application

1# Docker containers (bridge network)
2sudo iftop -i docker0
3
4# Kubernetes pods
5sudo iftop -i cni0
6
7# VPN traffic
8sudo iftop -i tun0

Find Bandwidth Hogs

1# Show all traffic, sorted by bandwidth
2sudo iftop -n -P -B
3
4# Text mode, log top consumers
5sudo iftop -t -s 10 -n -P -B -L 20 > bandwidth_report.txt

Logging & Monitoring

Continuous Logging

1# Log every 10 seconds
2while true; do
3  sudo iftop -t -s 10 -n -P -B -L 10 >> /var/log/bandwidth.log
4  echo "---" >> /var/log/bandwidth.log
5  sleep 10
6done

One-Time Snapshot

1# Capture 30 seconds of data
2sudo iftop -t -s 30 -n -P -B > bandwidth_snapshot.txt

Top N Connections

1# Show top 10 connections
2sudo iftop -t -s 10 -n -P -L 10

Comparison with Other Tools

iftop vs nethogs

1# iftop: Shows connections between hosts
2sudo iftop -i eth0
3
4# nethogs: Shows bandwidth per process
5sudo nethogs eth0

Use iftop when:

  • You want to see which remote hosts are using bandwidth
  • You need to monitor specific ports or protocols
  • You want real-time connection-level monitoring

Use nethogs when:

  • You want to see which local processes are using bandwidth
  • You need per-application monitoring

iftop vs iptraf-ng

1# iftop: Connection-based view
2sudo iftop
3
4# iptraf-ng: Packet-level statistics
5sudo iptraf-ng

Configuration File

Create ~/.iftoprc

 1# ~/.iftoprc or /etc/iftoprc
 2
 3# Interface to monitor
 4interface: eth0
 5
 6# DNS resolution
 7dns-resolution: yes
 8port-resolution: yes
 9
10# Display options
11show-bars: yes
12promiscuous: no
13port-display: on
14
15# Bandwidth units
16use-bytes: no
17
18# Filter
19filter-code: port 80 or port 443
20
21# Update interval
22line-display: two-line

Installation

 1# Debian/Ubuntu
 2sudo apt install iftop
 3
 4# RHEL/CentOS/Fedora
 5sudo yum install iftop
 6# or
 7sudo dnf install iftop
 8
 9# Arch Linux
10sudo pacman -S iftop
11
12# macOS (Homebrew)
13brew install iftop
14
15# FreeBSD
16sudo pkg install iftop

Troubleshooting

Permission Denied

1# iftop requires root privileges
2sudo iftop
3
4# Or add user to pcap group (Debian/Ubuntu)
5sudo usermod -a -G pcap $USER
6# Logout and login again

Interface Not Found

1# List available interfaces
2ip link show
3# or
4ifconfig -a
5
6# Use correct interface name
7sudo iftop -i eth0

High CPU Usage

1# Disable DNS resolution
2sudo iftop -n
3
4# Disable port resolution
5sudo iftop -N
6
7# Increase update interval
8sudo iftop -s 10

Quick Reference

CommandDescription
sudo iftopMonitor default interface
sudo iftop -i eth0Monitor specific interface
sudo iftop -nDon't resolve hostnames
sudo iftop -PShow ports
sudo iftop -BShow bytes (not bits)
sudo iftop -f "port 80"Filter by port
sudo iftop -f "host 192.168.1.100"Filter by host
sudo iftop -t -s 10Text mode, 10s updates

Interactive Keys

KeyAction
hHelp
nToggle hostname resolution
PToggle port display
bToggle bar graph
tCycle through display modes
1/2/3Sort by 2s/10s/40s average
qQuit

Tips

  • Use -n and -N for faster display (no DNS/port lookups)
  • Use -B to see bandwidth in bytes (easier to read)
  • Press t multiple times to cycle through different views
  • Use filters to focus on specific traffic
  • Combine with nethogs for complete bandwidth picture
  • Use text mode (-t) for logging and automation
  • Press 1, 2, or 3 to sort by different time averages

Related Snippets