登录
Network Bandwidth Monitoring Tools: iftop, nload, bmon, and vnstat
When a server feels slow or a connection is saturated, the first question is usually “what is using the bandwidth?” The answer depends on what you need to see: the total rate on an interface, the individual connections moving the most data, a graph across several interfaces, or how much you have transferred this month. No single tool does all of this well, so it helps to know which one fits each question.
This guide compares four command-line bandwidth monitors: nload, iftop, bmon, and vnstat. Each one is small, available in the default repositories, and built for a different angle on network usage.
nload: Per-Interface Throughput
nload is the simplest of the four. It shows the incoming and outgoing rate on a single interface in real time, with a small ASCII graph and running statistics. It answers the question “how fast is this interface moving data right now?”
Install it on Ubuntu, Debian, and Derivatives:
sudo apt install nloadOn Fedora, RHEL, and Derivatives, install it with dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:
sudo dnf install nloadRun it with no arguments to monitor the default interface, or name an interface directly:
nload eth0The display splits into incoming and outgoing sections, each showing the current rate along with the average, minimum, maximum, and total transferred:
Device eth0 [192.168.1.50] (1/1):
Incoming:
Curr: 4.21 MBit/s
Avg: 2.88 MBit/s
Max: 9.10 MBit/s
Ttl: 1.42 GByte
Outgoing:
Curr: 512.00 kBit/s
Avg: 320.10 kBit/sWhen more than one interface is present, the left and right arrow keys cycle between them. Press q to quit. nload does not need root privileges, which makes it the quickest way to glance at raw throughput.
iftop: Bandwidth by Connection
nload tells you how much traffic is flowing, but not where it is going. iftop fills that gap. It works like top for the network, listing active connections sorted by bandwidth so you can see which hosts and ports are responsible for the load.
Install it on Ubuntu, Debian, and Derivatives:
sudo apt install iftopOn Fedora, RHEL, and Derivatives, use dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:
sudo dnf install iftopiftop needs to capture packets, so it must run as root. Point it at an interface:
sudo iftop -i eth0Each row shows a pair of hosts and the bandwidth between them, averaged over the last 2, 10, and 40 seconds:
=> 192.168.1.50 4.10Mb 3.85Mb 3.20Mb
192.0.2.14 <= 256Kb 210Kb 180KbBy default iftop resolves IP addresses to hostnames and port numbers to service names, which can be slow and can clutter the view. Three flags make it more useful on a busy server: -n skips DNS hostname lookups, -N shows ports as numbers instead of service names, and -P displays the port column so you can tell which service is responsible:
sudo iftop -i eth0 -nNPPress q to quit. When you need to find the connection saturating a link, iftop is the tool to reach for. To then identify the local process behind a port, pair it with the ss command
.
bmon: Multiple Interfaces at a Glance
bmon (bandwidth monitor) is the right choice when you want to watch several interfaces at once. It lists every interface with its current receive and transmit rates, and draws a live graph for the one you select, which is handy on routers, gateways, and virtualization hosts with many NICs and bridges.
Install it on Ubuntu, Debian, and Derivatives:
sudo apt install bmonOn Fedora, RHEL, and Derivatives, use dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:
sudo dnf install bmonLaunch it with no arguments:
bmonThe top pane lists all interfaces with their RX and TX rates. Use the arrow keys to highlight an interface, and the lower pane updates its graph to match. Press d to toggle detailed counters such as errors and dropped packets, and q to quit. bmon reads kernel counters and does not require root for basic monitoring.
vnstat: Historical Usage Over Time
The first three tools show what is happening now and forget it the moment you quit. vnstat is different: it runs as a background service, records traffic per interface into a database, and reports usage by hour, day, and month. It answers “how much data have I used this month?” rather than “what is the rate right now?”, which makes it the tool for usage caps and capacity planning.
Install it and enable the service on Ubuntu, Debian, and Derivatives:
sudo apt install vnstat
sudo systemctl enable --now vnstatOn Fedora, RHEL, and Derivatives, install the package first. On RHEL-compatible systems, enable EPEL first if the package is not available:
sudo dnf install vnstat
sudo systemctl enable --now vnstatvnstat needs time to collect data, because it samples the interface counters periodically rather than capturing packets. After it has been running for a while, view a summary:
vnstat eth0 since 2026-01-01
rx: 42.18 GiB tx: 8.04 GiB total: 50.22 GiB
monthly
rx | tx | total
------------------------+-------------+------------
2026-01 42.18 GiB | 8.04 GiB | 50.22 GiBSeveral flags change the reporting period: vnstat -h for hourly, vnstat -d for daily, and vnstat -m for monthly. For a live rate display similar to the other tools, use vnstat -l, which shows the current throughput until you press Ctrl+C. Because the daemon keeps logging, the history survives reboots.
Which Tool to Use
The four tools overlap a little but each has a clear best use:
| Tool | Shows | Needs root | Best for |
|---|---|---|---|
| nload | Per-interface in/out rate | No | A quick glance at total throughput |
| iftop | Per-connection bandwidth | Yes | Finding which host or port is using the link |
| bmon | All interfaces plus graphs | No | Hosts with many interfaces |
| vnstat | Historical hourly/daily/monthly totals | No | Tracking usage over time and quotas |
In practice, many administrators keep vnstat running for history and reach for iftop when they need to investigate a live spike.
Troubleshooting
command not found after installing
Confirm the package installed with apt list --installed | grep <tool> or dnf list installed <tool>. On Ubuntu, the package may be in the universe repository; on RHEL-compatible systems, you may need to enable EPEL first.
iftop shows no traffic
iftop must run as root and be pointed at the active interface. List interfaces with ip link and pass the correct one with -i. Traffic on the loopback interface will not appear unless you select lo.
vnstat reports “Not enough data available yet”
The daemon has not collected a full sampling interval. Confirm the service is running with systemctl status vnstat and wait a few minutes for the first data points.
Rates look wrong on a virtual interface
Bridges, bonds, and VLAN interfaces report aggregate counters. Monitor the underlying physical interface as well to see where the traffic actually enters the host.
FAQ
Which tool shows bandwidth per process?
None of these four map traffic to a process directly. iftop shows it per connection; to tie a connection to a process, use ss -tp or nethogs, which groups bandwidth by process.
Do these tools work over SSH?
Yes. All four are terminal applications and run fine in an SSH session, which is exactly how they are used on headless servers.
Does vnstat slow down the network?
No. vnstat reads interface counters periodically rather than inspecting packets, so its overhead is negligible even on busy links.
Can I monitor a specific interface only?
Yes. nload, iftop, and vnstat all accept an interface name (for example eth0), and bmon lets you select one from its list.
Conclusion
Pick the tool that matches the question: nload for a fast look at throughput, iftop to find the connection eating the link, bmon for many interfaces, and vnstat for usage history. When you need to move from bandwidth numbers to sockets and interface details, pair them with the lower-level ss and ip commands.
