iftop - Live Network Connection Bandwidth Cheatsheet
iftop is a top-like tool for network bandwidth by connection. It listens on an interface and shows a live, sorted list of traffic between pairs of hosts — your machine and each remote endpoint — with running averages over 2, 10, and 40 seconds. Where nethogs groups by process, iftop groups by connection, which is what you want when the question is “which remote host / connection is eating the link?” It needs root to capture packets.
Installation
| Platform | Command |
|---|
| Debian/Ubuntu | sudo apt install iftop |
| Fedora/RHEL | sudo dnf install iftop |
| Arch Linux | sudo pacman -S iftop |
| macOS (Homebrew) | brew install iftop |
| Verify | iftop -h |
Running
| Command | Description |
|---|
sudo iftop | Monitor the default interface |
sudo iftop -i eth0 | Monitor a specific interface |
sudo iftop -n | Don’t resolve hostnames (show IPs, faster) |
sudo iftop -P | Show ports as well as hosts |
sudo iftop -B | Show bandwidth in bytes (not bits) |
sudo iftop -F 10.0.0.0/24 | Only traffic for a network/host |
Reading the Display
| Element | Meaning |
|---|
| Left column | Local host |
| Right column | Remote host |
=> / <= | Send / receive direction |
| Three numbers | Avg over last 2s / 10s / 40s |
| Bars | Relative bandwidth of each pair |
| Bottom summary | TX / RX / TOTAL cumulative + peak + rates |
Interactive Keys
| Key | Action |
|---|
n | Toggle DNS resolution |
p | Toggle port display |
P | Pause the display |
b | Toggle the bandwidth bars |
t | Cycle line-display modes (one/two line, per-direction) |
S / D | Toggle showing source / destination ports |
1 / 2 / 3 | Sort by the 2s / 10s / 40s column |
j / k | Scroll |
q | Quit |
Useful Options
| Option | Description |
|---|
-i IFACE | Interface to monitor |
-n | No DNS resolution |
-N | No port-to-service resolution |
-P | Display ports |
-B | Bytes instead of bits |
-f "filter" | pcap filter (e.g. -f "port 443") |
-m RATE | Set the graph scale maximum |
Common Workflows
# Which remote hosts are busiest on eth0, fast (no DNS)
sudo iftop -i eth0 -n
# Include ports to see which service is talking
sudo iftop -i eth0 -nP
# Focus on HTTPS traffic only
sudo iftop -i eth0 -f "port 443"
# Watch traffic to a specific subnet
sudo iftop -i eth0 -F 192.168.1.0/24
| Tool | Groups by | Best question |
|---|
| iftop | Connection (host pairs) | “Which connection/remote is busy?“ |
| nethogs | Process | ”Which program is using bandwidth?“ |
| bandwhich | Process + connection + remote | Both, richer TUI |
| nload / bmon | Interface totals | ”What’s the total throughput?” |
Pair iftop (which connection) with nethogs (which process) to fully diagnose a bandwidth problem.
Resources
