What it does
iftop displays real-time network bandwidth usage by host pair. Instead of processes, it focuses on network flows between local and remote addresses, making it ideal for spotting heavy talkers on a link.
How it works (mechanical)
iftop captures packets using libpcap and aggregates
traffic by source/destination IP pairs. It periodically refreshes a curses-based
interface showing send/receive rates over rolling time windows.
- Packet capture via libpcap
- Aggregation by host pairs (flows)
- Rolling averages (2s / 10s / 40s)
- Interactive terminal UI
10 Practical Examples
# 1) Monitor default interface sudo iftop
# 2) Monitor a specific interface sudo iftop -i eth0
# 3) Disable DNS resolution (faster, clearer) sudo iftop -n
# 4) Show port numbers instead of service names sudo iftop -P
# 5) Monitor only a specific network sudo iftop -F 192.168.1.0/24
# 6) Filter traffic with BPF syntax sudo iftop -f "port 443"
# 7) Show cumulative totals sudo iftop -t
# 8) Non-interactive (text) output sudo iftop -t -s 10
# 9) Sort by transmitted traffic # (press 't' while running)
# 10) Quickly spot an external bandwidth hog sudo iftop -n -i eth0
Notes & Gotchas
- Root privileges are required for packet capture.
- Shows flows, not processes — pair with
nethogsif needed. - DNS resolution can obscure patterns; disable with
-n. - High packet rates can impact accuracy.
- Best used for live diagnosis, not long-term accounting.
Historical Context
iftop was inspired by top, adapting the interface to
network traffic. It became popular as a fast way to visualize bandwidth usage
before more advanced flow collectors and eBPF tools were common.
Modern Equivalent / Related Tools
- nethogs — per-process bandwidth usage
- iptraf-ng — interactive network monitoring
- ss — socket statistics
- tcpdump / tshark — packet-level analysis
- eBPF-based tools — high-resolution flow analysis