When troubleshooting network latency spikes, saturated bandwidth pipes, or suspicious outbound socket connections on Linux servers, basic command-line tools like netstat, ss, or ifconfig provide static snapshot tables that fail to communicate dynamic traffic flows. While full packet sniffers like tcpdump capture granular byte payloads, parsing millions of raw packets in real time during a production incident is overwhelming.
iptraf-ng (IP Traffic Monitor Next Generation) is an interactive, ncurses-based IP LAN monitoring console built specifically for Linux administrators. It captures packet streams crossing system network interfaces and compiles them into real-time visual dashboards detailing active TCP connections, UDP flows, ICMP flags, packet byte counters, and interface utilization rates. This guide explains how to install and navigate iptraf-ng on Linux.
Installing iptraf-ng on Linux
iptraf-ng is available in the official repositories of all major Linux distributions:
On Ubuntu / Debian
sudo apt update && sudo apt install iptraf-ng -yOn Fedora / RHEL / CentOS
sudo dnf install iptraf-ng -yOn Arch Linux
sudo pacman -S iptraf-ngLaunching and Navigating the Console
Because capturing raw Ethernet socket frames requires administrative network capabilities, launch iptraf-ng with sudo:
sudo iptraf-ngThe application presents an interactive curses menu navigated using the Up/Down arrow keys and Enter.
Key Operational Monitoring Modes
1. IP Traffic Monitor
The primary diagnostic view in iptraf-ng. When launched against an interface (e.g. eth0 or All interfaces):
- Displays all active TCP connections in two-line pairs (source IP:port to destination IP:port).
- Shows connection states:
ESTABLISHED,SYN-SENT,FIN-WAIT-1,CLOSED. - Displays live packet counters, active byte flow rates, and TCP window size flags.
- Bottom pane logs non-TCP packets, including UDP datagrams, ICMP echo requests, and ARP broadcasts.
2. General Interface Statistics
Displays a comprehensive tabular overview of all physical and virtual interfaces (including eth0, wlan0, docker0, and lo):
- Live Total Packets, IP Packets, and Non-IP Packets.
- Incoming vs Outgoing kilobyte transfer rates per second (kB/s).
- Packet checksum error rates and dropped buffer counts.
3. Detailed Interface Statistics
Provides a deep protocol breakdown for a selected network adapter, categorizing traffic by TCP, UDP, ICMP, IP checksum errors, and broadcast packet percentages.
Diagnostic Modes Comparison Table
| Menu Option | Primary Output | Recommended Incident Scenario |
|---|---|---|
| IP Traffic Monitor | Active socket-level connections | Pinpointing rogue outbound connections and DDoS floods |
| General Statistics | Aggregated interface throughput | Identifying which network card is saturating bandwidth |
| TCP/UDP Statistical Breakdown | Port usage and protocol distribution | Determining if traffic is Web (80/443), DNS (53), or custom |
| LAN Station Monitor | MAC address packet volumes | Detecting high-bandwidth local LAN clients on a subnet |