How to see active connections and bandwidth usage on Linux
The iftop command is one of the tools that is great for shows active connections and bandwidth usage on a Linux system. As the name implies, it is like ’top’ but for network connections.
Show active connections
iftop
By default most options are enabled. This may be useful, but also confusing if you are looking for specific traffic. A few good shortcuts include n (hostnames), N (service names).
224.0.0.251:5353 <= 192.168.1.16:5353 604B 2,36Kb 483b 121b
192.168.1.25:40238 <= 12.20.9.18:443 31,1KB 444b 134b 67b
224.0.0.251:5353 <= 192.168.1.34:5353 142B 568b 114b 28b
192.168.1.25:54226 <= 192.168.1.170:1313 96,5KB 0b 83b 19,2Kb
192.168.1.25:54228 <= 192.168.1.170:1313 96,8KB 0b 83b 95b
255.255.255.255:10001 <= 192.168.1.1:35558 9,56KB 0b 51b 38b
192.168.1.25:47184 <= 192.168.1.170:1313 573B 0b 42b 115b
192.168.1.25:47196 <= 192.168.1.170:1313 573B 0b 42b 115b
255.255.255.255:10001 <= 192.168.1.9:60489 4,78KB 0b 26b 19b
192.168.1.25:50982 <= 192.168.1.170:22 22,7KB 0b 0b 4,00Kb
192.168.1.25:47736 <= 192.168.1.170:22 12,4KB 0b 0b 2,49Kb
192.168.1.25:33012 <= 5.6.2.140:443 6,42KB 0b 0b 1,28Kb
TX: cum: 1,70MB peak: 205Kb rates: 244b 344b 16,3Kb
RX: 5,98MB 450Kb 3,35Kb 1,03Kb 29,5Kb
TOTAL: 7,68MB 495Kb 3,59Kb 1,37Kb 45,9Kb
Bandwidth usage
To better see which connection is causing a lot of traffic, enable the bars using the b key. Depending on how traffic is distributed, it may be useful to switch between a linear or logarithmic scale with the L key.