When Linux servers experience sudden network congestion, packet drops, or saturated uplink bandwidth, identifying whether the bottleneck originates from an internal backup cron, a misconfigured reverse proxy, or an external DDoS attack requires immediate real-time bandwidth auditing. Two terminal-based utilities excel at distinct layers of network analysis: bmon (Bandwidth Monitor), which visualizes interface-level throughput curves using interactive ASCII graphs, and iftop, which displays a real-time table of host-pair socket connections sorted by active bandwidth consumption.
Installing bmon and iftop on Linux
Both packages are available across official package repositories for Debian, Ubuntu, CentOS, and Fedora systems:
# On Ubuntu and Debian systems
sudo apt update
sudo apt install bmon iftop -y
# On RHEL and Fedora systems
sudo dnf install epel-release -y
sudo dnf install bmon iftop -y| Tool Name | Primary Focus | Output Format | Elevation Required? |
|---|---|---|---|
| bmon | Interface throughput, error counters, packet rates. | Interactive curses graphical ASCII charts. | No |
| iftop | Host-pair bandwidth, socket destinations, port flows. | Real-time updating connection list with exponential moving averages. | Yes (sudo) |
Monitoring Multi-Interface Throughput with bmon
Launch bmon from your terminal shell:
bmonBy default, bmon displays all physical and virtual interfaces (Ethernet, Wi-Fi, Docker bridges, WireGuard tunnels) alongside their incoming (RX) and outgoing (TX) data rates:
- Press the Up/Down Arrow keys to cycle through listed interfaces.
- Press d to reveal real-time detailed counters, including CRC errors, frame drops, and collision counts.
- Press g to toggle graphical ASCII throughput curves that display historical peaks and troughs over 60-second windows.
- Press q to exit the interface.
Auditing Active Network Connections with iftop
While bmon isolates which physical network card is saturated, iftop identifies exactly which remote IP addresses and host pairs are responsible for consuming bandwidth. Because iftop operates by placing the network adapter into promiscuous packet-sniffing mode, it requires administrative root privileges:
sudo iftop -i eth0The display divides active connections into pairs of rows: the top row shows traffic directed to the remote host (=>), while the bottom row displays inbound traffic from the remote host (<=). Three columns on the right calculate exponential moving averages across 2 seconds, 10 seconds, and 40 seconds.
Interactive Filtering and Port Identification in iftop
Customize the display during a live monitoring session using internal hotkeys:
P : Toggles port display on/off (identifies whether traffic is HTTPS, SSH, or custom ports).
N : Toggles DNS hostname resolution (switches between numeric IPs and domain names).
S : Shows source ports only.
D : Shows destination ports only.
T : Toggles cumulative connection traffic display.
1/2/3 : Sorts the display by 2s, 10s, or 40s moving average columns.
l : Opens an interactive regex filter (e.g., filter only traffic matching "192.168.1.").Running Non-Interactive Reports for Scheduled Auditing
To capture network throughput in automated shell scripts without loading an interactive ncurses GUI, use bmon‘s text output module:
bmon -p eth0 -o 'ascii:quitafter=5'Combining bmon for interface trend analysis with iftop for host-level connection tracking provides network administrators with a lightweight, rapid diagnostic toolkit to neutralize traffic congestion without installing heavyweight agent software.