How to Monitor Real-Time Network Bandwidth Using iftop in Linux

When users complain that a Linux web server is responding slowly, system administrators often use the top command to check for CPU or RAM bottlenecks. However, if the processor is mostly idle, the bottleneck is almost certainly network congestion. A massive file transfer or a DDoS attack might be saturating the server’s network card. To instantly visualize exactly which IP addresses are consuming your server’s bandwidth in real-time, you must install and use the iftop command.

What is the iftop Command?

The iftop utility is the network equivalent of the classic top command. Instead of displaying a live list of the most CPU-intensive processes, it displays a live, constantly updating list of the most bandwidth-intensive network connections flowing through a specific network interface (like eth0 or wlan0).

Because it acts as a packet sniffer to analyze raw network traffic, it is not usually installed by default, and it strictly requires administrative privileges to run. You can install it on Ubuntu/Debian by running sudo apt install iftop.

How to Monitor Bandwidth in Real-Time

To launch the monitor, you must execute the command using sudo. By default, iftop will automatically detect and bind to the first active network interface it finds.

sudo iftop

The terminal will lock into a full-screen, interactive monitoring dashboard. Here is how to read the interface:

• The Bar Graph (Top): The very top of the screen displays a logarithmic scale (e.g., 10Mb, 100Mb). As connections consume bandwidth, white bars will shoot across the screen relative to this scale, providing an instant visual cue of a bandwidth spike.
• The Connection List (Center): The main body of the screen lists the active connections. Each connection uses two lines of text: the top line shows outbound traffic (from your server to the foreign IP), and the bottom line shows inbound traffic (from the foreign IP to your server).
• The Traffic Rates (Right): On the far right side of the screen, you will see three columns of numbers. These represent the average data transfer rates calculated over the last 2 seconds, 10 seconds, and 40 seconds, allowing you to instantly determine if a spike is a brief anomaly or a sustained transfer.

Filtering the Dashboard

By default, iftop attempts to resolve all foreign IP addresses into human-readable domain names. This DNS resolution process can severely slow down the dashboard and cause the data to lag. While the dashboard is actively running on your screen, you can press the n key on your keyboard to toggle DNS resolution off, instantly forcing iftop to display raw IP addresses and speeding up the interface.

Additionally, you can press the p key to toggle port display on and off. This forces the dashboard to reveal exactly which port the traffic is utilizing (e.g., https or ssh), helping you instantly identify whether the bandwidth hog is a web visitor or a background database sync.