iftop — Network analysis and diagnostics

It is a bandwidth monitor that shows real-time traffic per connection on the interface.

Basic Information

What is this program?

iftop is a TUI program that displays in real-time which remote host and how much data is being sent and received per connection on the server's network interface.

In situations like 'the disk is empty but network usage has exploded,' you can visually see which remote IP connection is consuming most of the bandwidth within seconds. Just as top shows processes in real-time, iftop shows network connections in real-time.

What problem does it solve?

• When server bandwidth suddenly fills up and you need to quickly identify what is sending the data.
• When you need to distinguish whether a traffic spike is inbound or outbound.
• When you need to check if firewall, backup, or CDN transfers are flowing as expected.
• When you need to quickly scan for DDoS or abnormal connection influxes visually.

Key Features

Bandwidth Display per Connection

Displays recent transfer volumes in real-time like a graph for each source-destination pair.

• Usage Scenario: View connections coming into and going out of the server on a single screen.
• Results Obtained: You can immediately know which remote IP connection is consuming most of the bandwidth.
• Limitations: If you only want to see the total for the entire interface, tools like vnstat that provide totals are more suitable than iftop.

Host Aggregation

Groups individual connections by remote host for display.

• Usage Scenario: When thousands of short connections are disconnecting, view by host.
• Results Obtained: Hosts that repeatedly send and receive data are highlighted.
• Limitations: The display is within a time window for aggregation (default 40 seconds), so very short spikes might be missed.

Display Filter

Provides a filter (p) to narrow down what is shown on the screen.

• Usage Scenario: View only a specific range (e.g., 10.0.0.0/8).
• Results Obtained: Hide unwanted connections and observe only core traffic.
• Limitations: The display filter does not prevent capture itself, so it affects post-aggregation.

Unit and Sort Switching

Switches output units (bits/bytes) and sort criteria using keys.

• Usage Scenario: Switch to bits per second.
• Results Obtained: Makes it easier to grasp the current actual transfer speed.
• Limitations: Key operations are easy if you know the defaults, but filter syntax requires checking the man page.

Installation and Execution

Ubuntu / Debian

Install from the distribution repository. Execution requires root privileges (packet capture permissions).

sudo apt update
sudo apt install iftop

RHEL / CentOS / Fedora

Add the EPEL repository and then install.

sudo dnf install epel-release
sudo dnf install iftop

Source Build

Download the source tarball from the official site and build. The libpcap development package is a prerequisite.

# After extracting iftop-0.17.tar.gz, ./configure && make

Actual Usage Examples

Basic Execution

View real-time traffic on the first network interface.

sudo iftop

Specify a Specific Interface

Specify the interface with the -i option. (e.g., second NIC)

sudo iftop -i eth1

Port Filter Example

View only port 443 traffic with the port number filter (-f). The display result is an example.

sudo iftop -f 'port 443'

Advantages and Limitations

Advantages

• Lightweight installation with few dependencies (based on libpcap).
• Simple screen makes it easy to identify the causing host within seconds.
• Real-time display allows checking directly from the server console without agent setup.
• Easily available in distribution repositories with GPL license.

Points to Consider Before Use

• Root privileges are required for packet capture.
• No GUI, so separate tools like vnstat are needed for long-term trend recording.
• Cannot view the contents of encrypted connections, only the transfer volume.
• Updates are rare after stable version 0.17, so integration with latest kernel features is limited.

Comparison with Similar Programs

Official Resources and Further Learning

• Official Homepage — https://pdw.ex-parrot.com/iftop/
• Official Documentation / Knowledge Base — https://pdw.ex-parrot.com/iftop/
• Official Download — https://pdw.ex-parrot.com/iftop/iftop-0.17.tar.gz
• Release Notes — https://pdw.ex-parrot.com/iftop/
• Source / Development Resources — https://github.com/e2/iftop

Version and support environment information is based on values verified on the official site as of 2026-10-18. Installation commands may vary depending on the distribution and version used, so please also check the official installation documentation.

Actual Execution Screen

This is a synthetic example reconstructed in a server style of iftop's connection-by-connection bandwidth display screen. The screen is a synthetic example and is not an actual execution result.

!iftop real-time bandwidth screen: terminal showing TX/RX speed and cumulative traffic per remote host

Actually operating server

Source (HTML): https://games.aidebatehub.com/programs/apps/network/iftop.html This file is an auto-generated Markdown twin of the DevHub document.