iftop in Linux

1. What Is iftop?

iftop displays real-time bandwidth usage on a network interface. It shows active IP connections, inbound/outbound traffic rates, and totals, making it ideal for analyzing live network loads and pinpointing high-traffic sources.

2. Installing iftop

Install via your package manager:

sudo apt install iftop        # Debian / Ubuntu

sudo yum install iftop        # CentOS / RHEL

sudo pacman -S iftop          # Arch Linux

3. Running iftop

Basic usage on interface eth0:

sudo iftop -i eth0

If omitted, iftop may select a default interface or return an error.

4. Interactive Keys

Key	Function
h	Show help
t	Toggle traffic display modes
s / S	Sort by send or receive
p	Show port numbers
n / N	Toggle DNS name resolution
q	Quit

5. Common iftop Options

• -i: Specify interface

sudo iftop -i ens33

• -n: Disable DNS resolution

sudo iftop -n

• -P: Show ports with IP

sudo iftop -P

• -f: Apply a BPF filter (e.g., HTTP traffic)

sudo iftop -f "port 80"

6. Practical Use Cases

• Track high-bandwidth connections or services
• Identify IPs causing slowdowns
• Monitor performance of firewalls and NAT setups
• Quick traffic overview during network stress

7. Security and Tips

• Run with sudo to access network interfaces
• Encrypted traffic like HTTPS is visible by IP and volume, not content
• Use -i to target the correct interface on multi-NIC systems

8. Comparing Tools

Feature	iftop	nload	iptraf
Live bandwidth monitoring	✅	✅	✅
IP-level detail	✅	❌	✅
Interactive terminal view	✅	✅	✅
BPF filtering	✅	❌	✅

9. Conclusion

iftop is a concise and practical network monitoring tool for Linux. It helps administrators analyze traffic volume, detect unusual activity, and manage network performance—all in real time. Its filtering, sorting, and live metrics make it ideal for server diagnostics and daily usage.