Iftop is a command-line tool that allows you to monitor network traffic in real-time. It displays a continuously updated list of network connections sorted by bandwidth usage. It is particularly useful for monitoring traffic on a specific network interface and identifying which hosts are generating the most traffic.
Overview
To use iftop, simply run the command followed by the name of the network interface you wish to monitor. For example, to monitor traffic on the eth0 interface, run the following command:
sudo iftop -i eth0
By default, iftop displays a scrolling list of connections ordered by bandwidth usage. Each connection is displayed with its source and destination IP addresses, as well as the amount of data transmitted and received. The current bandwidth usage is also displayed at the top of the screen.
You can use the following keys to interact with iftop while it is running:
- h: Display help screen
- n: Display IP addresses instead of hostnames
- N: Resolve hostnames (if DNS is configured)
- s: Toggle show source port
- d: Toggle show destination port
- t: Toggle show time in display
- p: Display ports instead of services
- P: Display services instead of ports
- b: Toggle bar graph display
- B: Cycle through available bandwidth units (bytes, kilobytes, megabytes, etc.)
- u: Display only connections involving a specific IP address or subnet (e.g. -u 192.168.1.0/24)
- f: Display only connections matching a specific filter expression (e.g. -f “port 80”)
Options
The following table lists all available options for iftop:
| Option | Description |
|---|---|
| -h | Display help screen |
| -i | Specify network interface to monitor |
| -n | Display IP addresses instead of hostnames |
| -N | Resolve hostnames (if DNS is configured) |
| -s | Toggle show source port |
| -d | Toggle show destination port |
| -t | Toggle show time in display |
| -p | Display ports instead of services |
| -P | Display services instead of ports |
| -b | Toggle bar graph display |
| -B | Cycle through available bandwidth units (bytes, kilobytes, megabytes, etc.) |
| -u | Display only connections involving a specific IP address or subnet |
| -f | Display only connections matching a specific filter expression |
Troubleshooting Tips
- If you receive an error message indicating that iftop cannot find the specified network interface, ensure that the interface name is spelled correctly and is currently active.
- If you are not seeing any traffic displayed in iftop, ensure that there is actually traffic flowing through the interface you are monitoring. You can use the
pingcommand to generate some traffic and confirm that it is being displayed in iftop.
Notes
- Iftop requires root privileges to run, so you must run it with
sudoor as the root user. - By default, iftop updates its display every 2 seconds. You can change this interval by using the
-Loption followed by the number of seconds you wish to use (e.g.-L 5for a 5-second update interval).