How to Monitor Network Bandwidth with vnstat and iftop

Monitoring network bandwidth helps you understand traffic patterns, identify bandwidth hogs, and plan for capacity. vnstat provides long-term statistics while iftop shows real-time per-connection bandwidth usage.

vnstat: Long-Term Traffic Monitoring

# Install vnstat
sudo apt install vnstat
sudo systemctl enable --now vnstat

# Wait a few minutes for initial data collection
# Then view statistics:

# Daily summary
vnstat -d

# Monthly summary
vnstat -m

# Live monitoring
vnstat -l

# Top 10 days
vnstat -t

# Hourly statistics for today
vnstat -h

# Specific interface
vnstat -i eth0

# Export as JSON
vnstat --json d

iftop: Real-Time Bandwidth Per Connection

# Install iftop
sudo apt install iftop

# Monitor eth0
sudo iftop -i eth0

# Show port numbers
sudo iftop -i eth0 -P

# Do not resolve hostnames (faster)
sudo iftop -i eth0 -n

# Filter traffic
sudo iftop -i eth0 -f "port 80 or port 443"

iftop Key Commands

# While iftop is running:
# t — Toggle display mode (2-line, 1-line, single)
# n — Toggle hostname resolution
# s — Toggle source display
# d — Toggle destination display
# p — Toggle port display
# P — Pause
# q — Quit
# 1/2/3 — Sort by 2s/10s/40s average

nload: Simple Bandwidth Graph

sudo apt install nload
nload eth0
# Shows incoming/outgoing bandwidth as a text graph

Bandwidth Alerting

#!/bin/bash
# Alert when bandwidth exceeds threshold
THRESHOLD_MB=1000  # Alert if daily usage exceeds 1GB
TODAY_RX=$(vnstat -d --oneline | cut -d";" -f4 | tr -d " " | sed "s/MiB//;s/GiB/*1024/;s/KiB/\/1024/" | bc 2>/dev/null)

if [ -n "$TODAY_RX" ] && [ "$TODAY_RX" -gt "$THRESHOLD_MB" ]; then
  echo "Bandwidth alert: ${TODAY_RX}MB received today" | \
    mail -s "Bandwidth Alert" admin@example.com
fi

Understanding Traffic Patterns

# Check which services use the most bandwidth
sudo iftop -i eth0 -P -n

# Common bandwidth consumers:
# Port 80/443  — Web traffic
# Port 22      — SSH/SCP/SFTP
# Port 3306    — Database replication
# High UDP     — DNS amplification attack or VPN