Monitoring Network Usage in Linux

1. Overview

In this article, we’ll be looking at different tools for monitoring network usage in Linux. Particularly, we’ll explore the following network monitoring tools:

• nload
• speedometer
• iftop
• nethogs

2. Network Monitoring Tools

There are a plethora of tools that we can use for monitoring network usage in Linux. We can loosely categorize these tools by how detail they display the network usage in a system.

On the one hand, there are tools that report the network usage per interface as a single figure. They simply sum up all the network traffic in the network interface.

On the other hand, there are tools that groups the network usage on a per-socket or per-process basis. They group different network traffic into their respective socket or process ID. Hence, this provides a finer detail on network bandwidth consumption.

Let’s take a look at these tools in Linux and how they can be used.

3. nload

nload is a command-line tool that displays the network usage on the system. It belongs to the category of network monitoring tool in Linux that simply sum up all the network traffic on a network interface.

3.1. Installation

For Debian based Linux, we can install it using apt-get:

$ apt-get install -y nload

On the other hand, we’ll use yum for RHEL based Linux:

$ yum install -y epel-release
$ yum install -y nload

3.2. Basic Usage

In the simplest form, nload can be invoked without any arguments:

$ nload

The command launches an interactive screen:

Device eth0 [172.17.0.2] (1/4):
============================================================Incoming:




                                          Curr: 1.09 kBit/s
                                          Avg: 760.00 Bit/s
                                          Min: 0.00 Bit/s
                                          Max: 1.09 kBit/s
                                          Ttl: 16.98 MByte
Outgoing:





                                          Curr: 1.09 kBit/s
                                          Avg: 760.00 Bit/s
                                          Min: 0.00 Bit/s
                                          Max: 1.09 kBit/s
                                          Ttl: 361.65 kByte

On the top of the display is the device we’re currently monitoring. Using the arrow keys left and right, we can cycle between the different network interfaces available in the system.

The rest of the screen shows the network usage for incoming and outgoing network traffic. Additionally, it provides a basic statistical figure such as average, minimum, and maximum figure.

3.2. Changing the Refresh Interval

By default, the network usage is updated once every 500 milliseconds. To change the refresh interval, we can pass the flag -t followed by an integer value in milliseconds.

For example, to refresh once every 2000 milliseconds:

$ nload -t 2000

The resulting screen will be updated once every 2 seconds.

3.3. Setting the Unit

To change the unit on the network traffic rate, we can use the flag -u:

$ nload -u m

The command above runs the nload program and displays the network traffic rate in terms of megabits per second.

The flag -u accepts the following values:

• b (for bits) or B (for bytes)
• k (for kilobits) or K (for kilobytes)
• m (for megabits) or M (for megabytes)
• g (for gigabits) or G (for gigabytes)

Additionally, we can change the unit of the total amount of data transferred using the flag -U. This flag also accepts similar values to the flag -u.

3.4. Displaying All Devices

We can make nload display all the network interfaces in a single screen using the flag -m.

$ nload -m

In this mode, we can look at the network usage for all the interfaces in one single screen. However, the graphs for the network traffic will not be displayed.

4. speedometer

speedometer is a network monitoring tool. Similar to nload, it doesn’t differentiate the network traffic on a network interface by socket or processes.

However, one thing that separates it from netload is that the display of speedometer is much more customizable.

4.1. Installation

On Debian based Linux, we’ll use apt-get to install speedometer:

$ apt-get install -y speedometer

Unfortunately, speedometer is unavailable in yum package manager.

4.2. Basic Usage

Let’s monitor the outgoing network traffic rate for our network interface eth0:

$ speedometer -t eth0

Running the command results in a graph showing up on the console output. Additionally, this graph is being constantly updated by the speedometer instance that is monitoring the interface eth0.

Then, we can see additional information at the bottom of the graph.

Starting from the left, the label TX: eth0 indicates that this is the graph for the transmission rate for the network interface eth0. Then, there are 3 numbers to the right of the label.

The first number represents the last sampled rate. Next, the second number represents a weighted average of the last 6 samples. The weights are such that the latest number has more weight than the older rate.

Finally, the 3rd number is a simple average of all past data points.

4.3. Displaying Multiple Graphs

We can display multiple graphs side by side using the flag -c. For example, we can display the receiving rate for interfaces eth0 and lo side by side:

$ speedometer -r eth0 -c -r lo

The flag -c serves as a delimiter that divides different graph definition. As we can see from the command, following the flag -c is the argument -r lo. That combination of flag defines a receiving traffic rate for interface lo.

Once executed, we can see 2 graphs lined side by side, reporting the incoming traffic to interfaces eth0 and lo.

5. iftop

iftop is a command-line tool that displays network usage by listening to the interface. In contrast to nload and speedometer, it monitors the network usage on each socket.

5.1. Installation

To install iftop on Debian based Linux, we’ll use apt-get:

$ apt-get install -y iftop

For RHEL based Linux:

$ yum install -y epel-release
$ yum install -y iftop

5.2. Basic Usage

We can launch iftop without any argument:

$ iftop

Running iftop without specifying a network interface causes it to listen on the first external interface it can find.

5.3. Monitoring a Specific Interface

Using the flag -i, we can run iftop on a specific interface:

$ iftop -i lo

The command above makes iftop listen on the lo interface.

5.4. Turning Off DNS Resolution

By default, iftop attempts to look up the IP for each socket connection in order to obtain its DNS. However, this might be undesirable as it imposes some network overhead during the DNS resolution.

To disable the DNS resolution, we can launch iftop with the flag -n:

$ iftop -n 

5.5. Monitoring a Specific Network

With iftop, it is also possible to monitor a particular network using the flag -F. For example, we can narrow down the network monitoring to the network block 192.168.0.1/16:

$ iftop -F 192.168.0.1/16

The command will start iftop that only monitor any traffic that flows in and out of any address that falls into the 192.168.0.1/16 network block.

Instead of a CIDR notation, a network mask can be used. For example, the command above command can be replaced using an explicit mask:

$ iftop -F 192.168.0.1/255.255.0.0

6. nethogs

nethogs is yet another command-line tool for monitoring network usage. It groups network traffic on a network interface by the process ID that generates or receives the network traffic. As a result, we’ll be able to monitor the network bandwidth consumption of different processes.

6.1. Installation

To install nethogs in Debian based Linux, we’ll use the apt-get command:

$ apt-get install -y nethogs

A similar installation can be performed on RHEL based Linux with yum:

$ yum install -y nethogs

6.2. Basic Usage

Let’s run the nethogs command without any arguments:

$ nethogs

Immediately we’ll be presented with an interactive screen.

The screen shows the bandwidth consumed by each process.

The PID column shows the process ID this row of information corresponds to. Then, the user that starts the process is displayed in the USER column. Subsequently, the PROGRAM column shows the program that is consuming the bandwidth.

On the DEV column, we can see the name of the interface. Finally, the SENT and RECEIVED columns show the number of bytes sent and received by this process respectively.

6.3. Interactive Control

To cycle between different display modes, we can press the m key. The different display modes available are kilobyte per second, kilobyte, byte, and megabyte.

Note that out of the four different modes, only the first is displaying rate information. The rest of the display modes are displaying the quantity of data transferred in different metrics prefix.

We can also interactively sort the rows by RECEIVED or SENT values. Pressing the r key will sort the rows by RECEIVED column. On the other hand, pressing the s key sorts the rows by SENT column.

6.4. Changing Refresh Interval

To change the refresh interval, we can use the flag -d:

$ nethogs -d 2

The command above starts a nethogs instance with a 2 seconds refresh rate.

6.5. Tracing Mode

For monitoring purpose, we can start nethogs in trace mode:

$ nethogs -t

In trace mode, the reports are generated and appended to the console output. Therefore, providing us a stream of reports over time that can be used for further processing.

7. Summary

In this article, we’ve looked at the different network monitoring tools that are available in Linux. Then, we started off by explaining how these tools can be grouped by the level of details they provide when reporting the network usage of a system.

After that, we’ve started off with the simplest tool nload. We see how nload reports the network usage on the network interface by summing up all the network traffic.

Additionally, we’ve also looked at the speedometer. Although it is quite similar to nload, speedometer provides varieties of display customization.

Then, we saw how iftop allows us to monitor the network traffic grouped by their respective connection socket. As a result, it provides more depth in the information when compared to nload and speedometer.

Finally, we explored how nethogs allows us to monitor the network traffic grouped by their respective process ID.