What is iftop?
When investigating network congestion or unexpected traffic spikes on a Linux server, standard tools like top only show CPU and memory usage. iftop is a command-line utility that acts exactly like top, but for network usage. It displays a real-time, continuously updated list of network connections and the bandwidth they are currently consuming.
Step 1: Install iftop
Because iftop relies on packet capture libraries, it is often not installed by default. You can install it using your distribution’s package manager.
For Debian/Ubuntu systems:
sudo apt update && sudo apt install iftop -y
For RHEL/CentOS systems (requires the EPEL repository):
sudo yum install epel-release -y
sudo yum install iftop -y
Step 2: Launch iftop on the Default Interface
iftop must be run with root privileges to capture packets. To monitor the first active network interface it finds, simply type:
sudo iftop
You will see a dual-column display showing the source and destination IP addresses, along with three columns of data representing the average bandwidth used over the last 2, 10, and 40 seconds.
Step 3: Monitor a Specific Interface
Servers often have multiple network interfaces (e.g., one for public traffic, one for internal databases). To monitor a specific interface, such as eth1 or ens33, use the -i flag:
sudo iftop -i eth1
Step 4: Disable DNS Resolution
By default, iftop attempts to resolve IP addresses into hostnames. In a busy network, DNS resolution can slow down the tool and generate additional DNS traffic, skewing your results. To start iftop without DNS resolution, use the -n flag:
sudo iftop -n
You can also toggle this feature dynamically while the program is running by pressing the n key.
Step 5: Filter Traffic by Subnet
If you only want to see traffic moving in and out of a specific subnet, you can use the -F flag followed by the network CIDR block. For example, to only monitor traffic associated with the 192.168.1.0/24 network, run:
sudo iftop -F 192.168.1.0/24
Press q at any time to exit the monitoring interface.