iftop
iftop shows ongoing bandwidth usage on a network interface
Typical usage: diagnosing network issues, identifying bandwidth bottlenecks, and monitoring data traffic to and from a systemIntroduction into iftop
The iftop command is a Linux tool to see the bandwidth by host. It listens to network traffic on the specified network interface or the first one it can find. It needs root access to be able to listen to this traffic.
In most cases it is advised to run iftop with the -n option to reduce additional traffic caused by DNS , which translates all IP addresses to hostnames.
Iftop can be instructed to monitor the traffic per network with the -F option, which might be useful to see traffic going to specific networks.
The filters that iftop uses are those from pcap, a packet capture library. The syntax is there the same as tools like tcpdump.
Project details
| Background information | |
|---|---|
| Author | Paul Warren |
| First release version | 0.1 |
| First release date | 2002-03-29 |
| License | GPLv2 or later |
| Requires root permissions | yes |
Installation
When iftop is not installed by default, it can be added to the system using the relevant software package.
Package information for iftop
| Operating system | Package name | Installation |
|---|---|---|
| AlmaLinux | iftop | |
| Arch Linux | iftop | |
| Debian | iftop | |
| Fedora | iftop | |
| Red Hat Enterprise Linux | iftop | |
| Rocky Linux | iftop | |
| Ubuntu | iftop | |
Your Linux distribution using a different package? Share your feedback.
Usage
Available options
| Option | Description |
|---|---|
| -h | Show usage summary |
| -n | No lookup for hostnames |
| -N | No lookup for service names |
| -p | Promiscuous mode to include traffic not going via the interface |
| -P | Show port numbers |
| -l | Include traffic on link-local IPv6 |
| -m | Set upper limit for scale (with K/M/G suffix) |
| -B | Bandwidth in bytes/sec instead of bits/sec |
| -i IFACE | Define interface IFACE |
| -f FILTER | Define a filter with FILTER |
| -F NETMASK | Define the network mask filter using NETMASK (e.g. /24) |
| -G NETMASK6 | Define the IPv6 network mask filter using NETMASK6 |
| -c FILE | Define configuration file using FILE |
| -t | No ncursus output, instead print to STDOUT |
Missing an option in this overview? Share your feedback.
Shortcuts and keys
| Key or key combination | Action |
|---|---|
| 1 | Sort by first column |
| 2 | Sort by second column |
| 3 | Sort by third column |
| < | Sort by source |
| > | Sort by destination |
| b | Toggle bar display |
| d | Aggregate traffic by destination |
| f | Define filter code |
| h (or ?) | Show help |
| j | Move down, useful with 'o' |
| k | Move up, useful with 'o' |
| l | Define POSIX extended regular expression to filter hostnames |
| n | Enable or disable hostnames |
| o | Freeze current screen order |
| p | Show or hide ports |
| s | Aggregate traffic by source |
| t | Cycle through the display modes |
| B | Cycle through bar graph period (2/10/40 seconds) |
| D | Show or hide destination port |
| L | Toggle between lineair or logarithimic scale |
| N | Enable or disable service names for ports |
| P | Pause or unpause output |
| S | Show or hide source port |
| T | Show totals |
Examples using iftop
Bandwidth usage
Show active connections and bandwidth usage
iftopFilter connections
Only show connections originating from our system to a destination on port 80 (http)
iftop -f 'dst port 80'Frequently Asked Questions
What is the iftop command and its purpose?
The command iftop shows ongoing bandwidth usage on one or more network interfaces and is a great tool for troubleshooting network issues.
Which package provides the iftop command?
The command iftop is provided by the iftop package.
Relevant articles using the iftop command
The following articles include an example on how to use iftop and might be worth further exploring.
- Network
- How to see active connections and bandwidth usage on Linux
- How to see the number of open connections on Linux
Related and similar commands
Linux has a lot of tools and commands available and sometimes you just need that little other tool. Here is a list of commands that are similar or related to iftop:
| Command | Category | Summary |
|---|---|---|
| dig | DNS | Performs DNS requests |
| fuser | files and sockets | Show processes using a file or socket |
| ip | networking | Shows network configuration and information |
| nstat | network | Network statistics and counters |
| resolvectl | network | Name resolution information from resolve daemon |
| ss | sockets | Shows information about sockets |
| tcpdump | network sniffing | Monitors network traffic on specified interface |
Also 💙 the command-line or terminal? Here is a set of cheat sheets for Linux to get more done from within the shell: