19 Commands to Monitor the Network Activity in Linux

19network commands 2

Objectives

To manage all network activities you should have detailed knowledge about how to check network load,  bandwidth usage, active connections, connections sockets,  and how much bandwidth is used by processes on your Linux system. 

In this article, we will discuss 19 useful commands that help monitor your network activity on Linux. The commands are executed on Ubuntu 20.04 LTS. We will also show how to install these command-line tools or utilities in Ubuntu / Debian systems. 

Nload – Monitors overall bandwidth, incoming and outgoing individual traffic

The nload is a command-line tool that monitors all incoming and outgoing individual network traffic. It shows the traffic output in the graphical format with an adjustable scale. Using the nload command-line tool, you can monitor the overall bandwidth usage without displaying the details of each process. 

This tool is sufficient where you want to display the general use of bandwidth. To install the nload utility on the Linux Ubuntu/ Debian system, use the following command:

 sudo apt-get install nload
 nload

nload-command

Bmon – Bandwidth monitor shows packet-level details

Bmon stands for ‘Bandwidth monitor’. This is also a command-line tool like the nload. It shows the traffic load within the network interface on your system. It can also show the output in the graph format that shows the packet-level traffic details. Using bmon, you can generate reports in HTML format.

To explore more options for bmon, visit the man pages. The bmon utility can be installed on almost all Linux distributions.

To install bmon on Ubuntu/ Debian distributions, use the following command:

 sudo apt-get install bmon
 bmon

bmon-command

Slurm – Monitors the network load by showing the device statistics and ASCII graph

Slurm is another command-line utility used to monitor the network load by showing the device statistics and ASCII graph. The slurm tool generates three types of graphs that you can manage using c (classic mode), s (split graph mode), and l (large) options.

This is a simple tool only used to monitor the network load without displaying any other details about the network.

Install slurm on Ubuntu / Debian distributions by using the following command:

 sudo apt-get install slurm
 slurm -s -i enp0s3

Slurm-command

Bwm-ng – Keeps track of the real-time network load

Bwm-ng stands for ‘Bandwidth Monitor Next Generation’ used to monitor the network bandwidth and keep track of the real-time network load. Using the bwm-ng tool, you can generate the report as an output that prints the complete summary of the speed at which data travels in and out from all the available system’s network interfaces.

Using the following commands, you can install this utility on your respective Linux distribution:

 sudo apt-get install bwm-ng
bwm-ng

bwm-ng-command

Color Bandwidth Meter (Cbm) – Displays the real-time updated traffic volume statistics

Cbm (Color Bandwidth Meter) is a command-line tool that displays information about the traffic volume by using a user-friendly system’s network interface. Cbm tool only displays the real-time updated traffic statistics. To install the cbm tool on Ubuntu / Debian distributions, run the below-mentioned command:

 sudo apt-get install cbm
cbm

cbm-command

Speedometer – Displays network traffic on all network interfaces

The speedometer is also a command-line utility that displays the network traffic flowing in and out via all network interfaces in a graph format.

To install speedometer in Ubuntu / Debian distributions, use the following command:

 sudo apt-get install speedometer
 speedometer -r enp0s3 -t enp0s3

speedometer-command

Netload – Displays current traffic load

The netload is a command-line utility that displays the information about the current traffic load and the number of total bytes transferred during the process.  To get the netload utility on Ubuntu / Debian distributions, run the following command:

 sudo apt-get install netdiag
 netload device-name

netload-command

Nethogs – Displays the network bandwidth usage per process

Nethogs is a small ‘net top’ command-line utility that displays the network bandwidth used per process. The intensive processes use the most bandwidth put at the top of the list. This nethogs tool displays the complete report of PID, user, and program path.  To install nethogs utility on Ubuntu / Debian distributions, run the command:

 sudo apt-get install nethogs
 nethogs

nethogs-command

Iftop – Monitors the data flows through the socket connections

Iftop is a command-line tool used to monitor the traffic through socket connections. The iftop tool uses a pcap library that captures the packet movement to display the total bandwidth usage. This utility only shows the bandwidth used by individual connections without displaying the process details within that connection. Using the iftop utility, you can filter traffic and bandwidth usage over the specified host connections.

Install iftop utility on Ubuntu / Debian distributions using the command:

 sudo apt-get install iftop
 sudo iftop -n

In the above command, the -n option is used to prevent creating additional network traffic.

iftop-command

Tcptrack –  Captures the packet’s movement using pcap library

The tcptrack command-line utility works similarly toiftop. It also uses the pcap library to capture the packet’s movement to calculate the total bandwidth usage within each connection. Tcptrack supports standard pcap filters through which you can monitor the specific connections.

To install the tcptrack utility on Ubuntu / Debian distributions, run the command:

 sudo apt-get install tcptrack
 tcptrack -i eth0

tcptrack ouput

Iptraf – Displays complete traffic summary based on the traffic protocol

Iptraf gives much more details about the network traffic compared to iftop. The itraf command shows a complete traffic summary based on the traffic protocol. When you execute the iptraf, it displays the details of all TCP, UDP, ICMP, IP traffic in its output. It also helps you to find checksum errors in sending and receiving packets.

 sudo apt-get install iptraf iptraf-ng
 iptraf-ng -i eth0

iptraf terminal output

Trafshow – Display information about active connections, transfer speed, and protocol of each connection

Trafshow common line tool behaves like the pkstat and netwatch commands. It shows the output in form of a report about all currently active connections, data transfer speed, and protocol of each connection. Using the trafshow utility, you can only monitor the TCP connection within the whole network. Trafshow can filter out connections using a pcap type library. This tool is a part of netdiag.

Install trafshow on Ubuntu / Debian distributions using the command:

 sudo apt-get install netdiag
 sudo trafshow -i eth0 tcp

trafshow output

 

Pktstat – Prints a real-time report of all active connections

Pktstat command-line utility is used to print the real-time report of all active connections and shows the speed at which data is flowing through each connection. Pkstat utility also shows you the connection type such as TCP or UDP and also lists HTTP requests if involved.

To install the pkstat tool on Ubuntu / Debian system, use the below-mentioned command:

 sudo apt-get install pktstat
 pktstat -i enp0s3 -nt

pktstat-command

Netwatch – Displays the network connections between the local host and other remote hosts

Netwatch command is also included in netdiag tools that display the network connections between the local host and other remote hosts. It shows the speed at which the data flows between those connections. To get this tool on Ubuntu / Debian system, run the below-mentioned command:

 sudo apt-get install netdiag
 sudo netwatch -e enp0s3 -nt

netwatch-command

Vnstat – Background service/daemon

Vnstat is quite different from other network monitoring tools. It runs as a background service/daemon on your system. It keeps a record of data transferred all the time through the network. Further, using the vnstat utility, you can generate the history of network usage in the report format.

To install vnstat on Ubuntu / Debian system, execute the following command:

 sudo apt-get install vnstat
 vnstat

vnstat-command

To check the running status of the vnstat service, use the below-mentioned command:

 sudo service vnstat status

vnstat-command

You can use different options  vnstat. But, if you don’t use any parameter then, it displays the total amount of data transfer since the vnstat daemon’s start. If you want to view the real-time bandwidth usage then, use the option -I (live mode). In this case, it will show the precise summary of the total bandwidth used by all incoming and outgoing data.

 vnstat -l -i enp0s3

It will not show additional details about the processes and host connections. To explore more vnstat options, visit the man page of the vnstat command.

vnstat-command

Ifstat – Displays network bandwidth report in batch-style mode

 The ifstat command output shows a format that is easy to log and parse by using the other tools. To install the ifstat utility on Ubuntu / Debian distribution, type the following command:

 sudo apt-get install ifstat
 ifstat -t -i enp0s3 0.7

ifstat-command

dstat – Monitors the system statistics and displays output in the form of a report in batch-style mode

The dstat command-line tool is written in Python. It monitors the system statistics and displays output in the form of a report in batch-style mode. It can also log the data in CSV or similar file format.

Install the dstat utility on Debian / Ubuntu distribution using the below-given command:

 sudo apt-get install dstat

To report network bandwidth using the dstat command, use the following command:

 dstat -nt

dstat-command

Netstat command – Prints all network connections, routing tables, network interface statistics, multicast membership details

Netstat stands for network statistics. It is a powerful command-line utility that prints all network connections, routing tables, network interface statistics, multicast membership, and details about the masquerade connections. To use this utility on Ubuntu/ Debian Linux system, install the necessary net-tools by running the following command:

 sudo apt install net-tools

Using the netstat command, you can display all listening processes by using the following command:

 sudo netstat -tulpen

netstat-command

In the above command -tulpen provides the following information:

t   displays TCP connections

u  shows UDP connections

l   display only the listening sockets

p  prints the program to which network connection belongs

e  prints extended details

n  shows addresses, ports, and users’ information numerically.

By executing the below-mentioned command, you can view all current network connections:

 sudo netstat -atupen

The above command performs the same function here, -a option lists all network sockets.

collectl-command

Collectl – Collects statistics from different system resources

Collectl works similar to the dstat command. It gathers statistics from different system resources such as Memory, Network, and CPU.
You can install collectl utility on Ubuntu / Debian distribution as follows:

 sudo apt-get install collectl

Here we an example of how to use collectl to report the network usage or bandwidth.

 collectl -sn -oT -i0.5

collectl-command

Conclusion

We learned 19 useful commands that can help you to monitor network activities Linux.

The above commands nload, slurm, bmon, bwm-ng, cbm, speedometer, and netload provide the overall bandwidth statistics of your network.

The commands vnstat, dstat, ifstat, and collectl display the overall bandwidth statistics in batch-style mode.

The commands iftop, iptraf, pktstat, tcptrack, netwatch, and trafshow display results based on the bandwidth usage per socket connection.

To view the bandwidth usage per process nethogs command helps you in this case. 

 

 

0 Shares:
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments
You May Also Like
Linux Runlevels Explained
Read More

Linux Runlevels Explained

There are times when Linux system boots either into a Graphical User Interface (GUI) or a command line.…