Recommend three excellent tools specially prepared for operation and maintenance novices!

Get detailed information about your network connections with iftop, nethogs, and vnstat. You can learn a lot about your current network with these three Linux commands. iftop tracks network connections by process number, nethogs quickly tells you which processes are hogging your bandwidth, and vnstat runs in the background as a nice lightweight daemon and keeps a real-time log of your network usage.

iftop

[[312107]]

The awesome iftop can listen on the network interface you specify and present it in top style.

This is a great little tool for finding network congestion, measuring speeds, and keeping track of total network traffic. Seeing how much bandwidth you are using is often quite astonishing, especially for those of us who still remember phone lines, modems, and "high speeds" that screamed kb and real-time baud rates. We stopped using baud rates a long time ago in favor of bit rates. Baud rate is a measure of signal variation, and while it is sometimes the same as bit rate, it is not usually.

If you have only one network interface, you can just run iftop. However, iftop requires root privileges:

If you have multiple network interfaces, specify the interface you want to monitor:

Just like the top command, you can change the display options while the command is running:

• h Switch to help interface.
• n Whether to resolve the domain name.
• s switches the display of the source address, and d switches the display of the destination address.
• S Whether to display the port number.
• N Whether to resolve the port; if resolution is turned off, the port number will be displayed.
• t switches to text display. The default display mode requires ncurses. I personally think that the display mode in Figure 1 is better in organization and readability.
• p Pause display updates.
• q quits the program.

Figure 1: Well-organized and readable text display.

Iftop will not stop monitoring traffic when you switch display settings. You can also monitor a single host. This requires the IP address and subnet mask of the host. Now, I was curious about how much load Pandora could bring to my meager bandwidth. So I first used the dig command to find their IP address:

What about the subnet mask? ipcalc will tell us:

Now, provide the IP address and subnet mask to iftop:

Isn't that great? I was also surprised to find that Pandora uses about 500kb per hour on my network. And like most streaming services, Pandora's traffic grows rapidly and relies on caching to stabilize.

You can do the same for IPv6 addresses using the -G option. Consulting the friendly man page can help you learn about iftop's other features, including using personal configuration files to customize your default options and using custom filtering.

nethogs

When you want to quickly see who is sucking up your bandwidth, nethogs is a quick and easy way to do it. You need to run it as root and specify the interface to listen on. It will show you a bunch of applications and their process numbers, so you can kill any of them if you want.

nethogs doesn't have many options: cycle through kb/s, kb, b, mb, sort by received and sent packets, adjust the refresh delay. See man nethogs for details, or run nethogs -h.

vnstat

vnstat is the easiest to use network data collection tool. It is very lightweight and does not require root privileges. It runs in the background as a daemon, so it can record your network data in real time. A single vnstat command can display the accumulated data.

By default it will show all network interfaces. Use the -i option to select a specific interface. It is also possible to merge data for multiple interfaces like this:

You can filter the display in several ways:

• -h Display hourly statistics.
• -d Display statistics by day.
• -w and -m display statistics by week and month respectively.
• Use the -l option to view live updates.

The following command will delete the database for wlan1 and stop monitoring it:

The following command will create an alias for one of your network interfaces. This example uses a wired interface name in Ubuntu 16.04:

By default, vnstat monitors eth0. You can modify this in /etc/vnstat.conf or create your own personal configuration file in your home directory. See man vnstat for a complete guide.

You can also install vnstati to create simple color maps (Figure 2):

Figure 2: You can use vnstati to create simple color maps.