iftop
iftop is a real-time network bandwidth monitoring tool that displays bandwidth usage by network connection. Inspired by the layout of top, iftop shows a live-updating list of network connections sorted by bandwidth consumption, with visual bar graphs showing inbound and outbound traffic rates. It is the standard tool for identifying which hosts or services are consuming your network bandwidth.
Key Features
- Per-connection bandwidth — Display bandwidth usage broken down by source and destination host
- Inbound/outbound bars — Visual bar graphs for received and transmitted traffic rates
- Aggregate totals — Cumulative transmit, receive, and total bandwidth at the bottom
- Port filtering — Filter traffic by port number to focus on specific services (e.g., HTTP, SSH)
- Host resolution — DNS resolution and custom host labelling for readable output
- Custom ranges — Set custom network ranges for organised grouping
- Logging support — Capture bandwidth data to file for offline analysis
- Peak traffic display — Shows 2s, 10s, and 40s average traffic rates
Why Use It
iftop is indispensable for quickly identifying bandwidth hogs on your network. Unlike nload (which shows interface totals) or nethogs (which groups by process), iftop shows individual connections — making it the best tool for finding which remote hosts a specific machine is talking to and how much data is flowing.
Use Cases
- Bandwidth consumption analysis — Identify which connections are using the most bandwidth
- Network troubleshooting — Detect unexpected high-bandwidth connections or data exfiltration
- Traffic monitoring — Verify that critical services (web, database) are within expected bandwidth ranges
- Capacity planning — Understand network utilisation patterns for bandwidth provisioning
Platform
Linux, macOS (via Homebrew), BSD, Solaris
Licence
GNU General Public License v2.0