How to Monitor Linux Network Traffic in Real Time with iftop

Why iftop is essential for Linux administrators

When a server's network connectivity suddenly drops or sluggishness takes over your services, the first question is always the same: who is consuming all the bandwidth? In Linux operating systems, traditional tools like top show CPU and memory usage, but they leave administrators in the dark regarding detailed network traffic. This is precisely where iftop comes in. In practice, it works as a real-time traffic meter that lists active network connections directly in the terminal, organizing everything by source and destination IP addresses.

Unlike static utilities that only take a momentary snapshot of the system, iftop continuously updates transfer rates, allowing you to observe instantaneous traffic spikes. It monitors bandwidth flowing through a specific network interface, such as the server's primary network card. For those seeking a deeper historical overview of packets and routes, it is worth complementing this study by exploring how to inspect network routes with the mtr command on Linux, combining iftop's spot-check view with multi-hop network analysis.

How to install iftop across different Linux distributions

Before monitoring traffic, you must ensure the utility is installed on your operating system. Most Linux distributions include the package in their official repositories, simplifying the process. However, because it interacts directly with data link and transport layers, iftop requires administrative privileges to run successfully.

To install it on Debian or Ubuntu environments, open the terminal and run your default package manager. If you use Red Hat family systems, such as CentOS or Rocky Linux, the procedure follows the same simplicity with the corresponding manager. Follow the steps below to prepare your diagnostic environment:

1. Update the operating system's local package list using the update command for your distribution.

   sudo apt update && sudo apt install iftop

2. Verify that the installation completed successfully by checking the utility version in the terminal.

   iftop --version

3. Start monitoring the default network interface by running the basic command with elevated privileges.

   sudo iftop

Interpreting the visual interface and transfer rates

Running the command with administrator privileges transforms your terminal screen into a dynamic dashboard divided into intuitive sections. At the top, a numerical scale indicates overall transfer rates, functioning like a volume ruler. Just below, the main body displays the active connection table, where each line represents a conversation between your server and a remote IP address.

Each connection shows three columns of transfer rates on the right: the average over the last 2 seconds, 10 seconds, and 40 seconds. This helps differentiate an isolated traffic spike from continuous traffic, such as a heavy download or a denial-of-service attack. Additionally, arrows indicate the direction of data flow, clearly showing whether the server is sending data to the network or downloading external content intensely.

Mastering keyboard shortcuts and essential filters

While iftop runs, several interactive keyboard commands allow you to adjust data display without restarting the program. Pressing the n key, for example, toggles DNS name resolution, disabling domain lookups and displaying only direct IP addresses, which speeds up rendering on heavily loaded servers. Meanwhile, the p key toggles network port display, helping identify if traffic occurs on common services like SSH, HTTP, or databases.

Another powerful feature is the ability to filter traffic by specific networks using command-line arguments. If you want to investigate traffic targeted exclusively at a specific internal subnet, you can run the program filtering by that address range. For advanced analysis of encapsulated modern traffic, you can also explore how to monitor HTTP/3 and QUIC traffic in Linux terminal, expanding your toolkit for application-layer protocols.

Automating diagnostics with complementary tools

Although iftop excels at immediate visual analysis, complex production environments require automation and continuous network visibility. Often, excessive traffic stems from internal scripts, automated backups, or poorly optimized database connections silently consuming bandwidth. In these scenarios, combining iftop with modern eBPF-based utilities like how to monitor Linux network traffic in real time with bpfTOP ensures an extra layer of precision when identifying exact processes.

Maintaining the habit of checking network traffic regularly prevents unpleasant surprises with cloud server bandwidth costs and protects infrastructure against unexpected bottlenecks. By mastering real-time connection reading, you gain autonomy to diagnose incidents in seconds, turning raw network data into secure operational decisions.

Final considerations on network monitoring

Mastering command-line tools like iftop represents a major advantage in the routine of any professional managing Linux systems. Understanding network traffic behavior in real time allows you to act preventively before bandwidth saturation impacts end-user experience. By combining this guide's practical learning with a consistent audit routine, your infrastructure will remain stable, predictable, and ready to handle any traffic demand.