▶Prefer to watch? This video runs the guide's main commands on a real Ubuntu 24.04 machine, with on-screen captions and no voiceover. Click to play, or watch it on YouTube. It is part of the Networking and Firewalls playlist.
iftop [options]
sudo iftop -i eth0
iftop shows live network bandwidth use per connection, like top does for CPU. It answers
"who is using all my bandwidth right now, and where is the traffic going?". It needs root
(sudo) because it captures packets. Install it with:
sudo apt install iftop | sudo dnf install iftop | brew install iftop
Start it
sudo iftop # first (or default) interface
sudo iftop -i eth0 # a chosen interface
sudo iftop -n # do not resolve hostnames (faster, clearer)
sudo iftop -N # do not resolve port numbers to names
sudo iftop -nNP # numbers only, and show ports
sudo iftop -P # show ports next to hosts
sudo iftop -B # show bandwidth in bytes instead of bits
sudo iftop -b # turn off the bar graphs
sudo iftop -t # text mode: print to the terminal (no interactive screen)
sudo iftop -t -s 10 # text mode for 10 seconds, then exit
sudo iftop -F 192.168.1.0/24 # measure a network (in/out direction)
sudo iftop -f "port 443" # capture filter (tcpdump/BPF syntax)
sudo iftop -m 10M # fix the top of the scale (bar graph)
sudo iftop -c ~/.iftoprc # use a config file
Sensible everyday choice: sudo iftop -nNP -i eth0
Reading the screen
12.5Kb 25.0Kb 37.5Kb 50.0Kb 62.5Kb
server.lan => client1.lan 1.2Kb 980b 870b
<= 45Kb 30Kb 25Kb
- Top bar (scale) Each tick is a bandwidth level; the colored bar shows the current rate
- Each host pair uses two lines: => is traffic sent out, <= is traffic received
- Three columns on the right are the average rates over the last 2, 10 and 40 seconds
- Bottom left TX (sent) and RX (received) cumulative totals for the session
- Bottom, "cum" Total data since iftop started
- Bottom, "peak" Highest rate seen
- Bottom, "rates" Current average rates (2s / 10s / 40s)
- TOTAL line All traffic combined
Units are bits per second by default (Kb = kilobits). Use -B for bytes.
Keys while running
h or ? Help
n Toggle hostname resolution
N Toggle port name resolution
p Toggle port display
P Pause the display
b Toggle the bandwidth bar graphs
B Cycle the averaging period for the bars (2s, 10s, 40s)
t Cycle line display: two lines, one line, sent only, received only
s / d Show or hide the source / destination host and port
1 / 2 / 3 Sort by the 2s / 10s / 40s column
< / > Sort by source name / destination name
o Freeze the current order (stop re-sorting)
j / k Scroll the list down / up
f Edit the filter code (tcpdump style) while running
l Screen filter: show only hosts matching a text
L Change the scale of the bar graph (linear or logarithmic)
T Toggle cumulative totals for each connection
q Quit
Filters (BPF, same syntax as tcpdump)
sudo iftop -f "port 22" # only SSH
sudo iftop -f "not port 22" # everything except your own SSH session
sudo iftop -f "host 8.8.8.8" # one host
sudo iftop -f "net 10.0.0.0/8" # one network
sudo iftop -f "tcp port 443 or tcp port 80" # web traffic
sudo iftop -f "udp" # UDP only
sudo iftop -F 192.168.1.0/24 -G 2001:db8::/64 # tell iftop which networks are "local" (IPv4 and IPv6)
Text mode (for logs and scripts)
sudo iftop -t -s 10 -n # 10-second snapshot as text
sudo iftop -t -s 30 -nNP -L 20 # top 20 lines, ports as numbers
sudo iftop -nNP -t -s 60 > bandwidth.txt # save a minute of results
Text mode prints the totals and the busiest flows when the timer ends. Good for cron jobs.
Config file (~/.iftoprc)
interface: eth0
dns-resolution: no
port-resolution: no
show-bars: yes
promiscuous: no
port-display: source-and-dest
line-display: two-line
sort: 10s
Save the current settings from a running iftop session by editing this file by hand.
Reload with: sudo iftop -c ~/.iftoprc
Practical workflows
# Who is using all my bandwidth?
sudo iftop -nNP -i eth0
# sort with 1, 2 or 3, watch the biggest pair at the top
# Is one client downloading something huge?
sudo iftop -nNP -i eth0 -f "host 192.168.1.50"
# Ignore my own SSH session so it does not distort the numbers
sudo iftop -nNP -f "not port 22"
# Web server traffic only
sudo iftop -nNP -f "port 80 or port 443"
# Which remote hosts are we sending to? (sent only)
sudo iftop -nNP # then press t until the display shows only sent traffic
# Take a 30-second snapshot and save it
sudo iftop -nNP -t -s 30 > snapshot.txt
# Then find out WHAT process owns that traffic
sudo ss -tunp | grep 203.0.113.9
sudo lsof -nP -i @203.0.113.9
iftop vs other network tools
iftop Bandwidth per connection, live (which hosts)
nethogs Bandwidth per PROCESS (which program)
iptraf-ng Interactive statistics, per interface and protocol
nload Simple in/out graph for an interface
bmon Bandwidth per interface with graphs
vnstat Long-term traffic history and totals
ifstat / sar -n DEV Quick per-interface counters
tcpdump Actual packets, for a close look
ip -s link Total counters since boot
Common problems
"pcap_open_live: Operation not permitted" Run with sudo
"pcap_open_live: eth0: No such device" Wrong name: check ip -br link (e.g. enp3s0)
Only see the machine's own traffic You cannot see other machines' traffic on a switched network unless you are the gateway or use a mirror port
Numbers look 8 times too big iftop shows bits per second by default: use -B for bytes
Screen is slow or laggy Use -n and -N to turn off name lookups
Hostnames wrong or missing DNS lookups are slow or fail: use -n
Loopback traffic missing Use -i lo, since it is a separate interface
Multiple interfaces iftop watches one at a time: run one per interface, or use -i any where supported
Tips
Use -nNP so iftop does not slow down or confuse you with DNS lookups, and you see real port numbers.
Remember the units: Kb is kilobits. Divide by 8 for kilobytes, or start with -B.
Filter out your own SSH session (-f "not port 22") so you see the traffic that matters.
Use 1, 2 and 3 to sort by the 2, 10 and 40 second averages. The 40s column shows steady, long-running transfers.
Pause with P to read the screen without it moving.
iftop shows hosts, not programs. To find the program behind a connection, use nethogs, ss -tunp, or lsof -i.
On a switched network, iftop only sees traffic to and from the machine it runs on, unless it runs on a router or a mirror port.
Text mode (-t -s N) is ideal for cron jobs and quick logging.
Only monitor traffic on networks you are allowed to inspect.
