iftop Command

The iftop command displays real-time network bandwidth usage on a specific interface, showing which connections are using the most bandwidth. It's like top for network traffic.

Syntax

iftop [OPTIONS]

Description

The iftop command provides a real-time display of network bandwidth usage by individual connections. It shows which hosts are communicating with your system and how much bandwidth each connection is using.

Key features:

  • Real-time bandwidth monitoring
  • Per-connection traffic analysis
  • Sortable display by various criteria
  • Traffic filtering capabilities
  • Historical bandwidth averages
Note: iftop requires root privileges to capture network packets and may need to be installed separately on some systems.

Installation

Ubuntu/Debian

sudo apt update sudo apt install iftop

RHEL/CentOS/Fedora

# RHEL/CentOS sudo yum install iftop # Fedora sudo dnf install iftop

macOS

brew install iftop

Common Options

Option Description
-i interface Monitor specific network interface
-n Don't resolve hostnames
-N Don't resolve port numbers to services
-p Run in promiscuous mode
-P Show port numbers
-b Don't display bar graphs
-B Display bandwidth in bytes/sec instead of bits/sec
-f filter Use BPF filter expression
-F net/mask Show traffic flows in/out of network
-c config Use alternative config file

Examples

Basic bandwidth monitoring

sudo iftop

Monitors bandwidth usage on the default network interface

Monitor specific interface

sudo iftop -i eth0

Monitors bandwidth usage on the eth0 interface

Don't resolve hostnames

sudo iftop -n

Shows IP addresses instead of resolving to hostnames

Show port numbers

sudo iftop -P

Displays port numbers for each connection

Display in bytes per second

sudo iftop -B

Shows bandwidth in bytes/sec instead of bits/sec

Monitor specific network

sudo iftop -F 192.168.1.0/24

Shows traffic flows in/out of the 192.168.1.0/24 network

Filter HTTP traffic

sudo iftop -f "port 80"

Monitors only HTTP traffic on port 80

Filter HTTPS traffic

sudo iftop -f "port 443"

Monitors only HTTPS traffic on port 443

Monitor traffic to specific host

sudo iftop -f "host 8.8.8.8"

Shows only traffic to/from Google's DNS server

Combine options

sudo iftop -i eth0 -n -P -B

Monitors eth0, shows IPs and ports, displays bytes/sec

Monitor without bar graphs

sudo iftop -b

Displays bandwidth data without visual bar graphs

Filter TCP traffic only

sudo iftop -f "tcp"

Shows only TCP connections

Interactive Commands

While iftop is running, you can use these keyboard shortcuts:

Key Action
q Quit iftop
h Toggle help display
n Toggle hostname resolution
N Toggle port resolution
p Toggle port display
P Pause display
b Toggle bar graph display
B Toggle bytes/bits display
T Toggle cumulative totals
j/k Scroll up/down through connections
s/S Sort by source/destination
</> Sort by TX/RX bandwidth
o Freeze current order
f Edit filter code
l Set screen filter

Understanding iftop Output

The iftop display shows:

  • Connection pairs - Source and destination hosts/IPs
  • Bandwidth bars - Visual representation of traffic volume
  • TX/RX rates - Transmit and receive rates for each connection
  • Cumulative totals - Total bytes transferred
  • Peak rates - Maximum observed bandwidth
  • Average rates - 2s, 10s, and 40s averages

The bottom section displays:

  • TX/RX totals - Total transmit/receive rates
  • TOTAL - Combined TX and RX rates
  • Peak - Peak bandwidth observed
  • Cumulative - Total bytes since start

Common Use Cases

When to Use iftop
  • Bandwidth Monitoring - Identify high-bandwidth connections
  • Network Troubleshooting - Find sources of network congestion
  • Security Analysis - Detect unusual network activity
  • Performance Tuning - Optimize network usage
  • Capacity Planning - Understand network utilization patterns

See also