How to Monitor Network Traffic on Ubuntu: vnstat, iftop, nethogs and nload

Applies to: Ubuntu 26.04 and 24.04 (also Debian); tested on Ubuntu 26.04.1 with vnstat 2.13, iftop 1.0pre4, nethogs 0.8.8, nload 0.7.4 and sysstat 12.7.7

To see network traffic on an Ubuntu server from the command line, pick the tool that answers your question:

• How much right now, per interface? nload or vnstat -l
• Which remote hosts are using the bandwidth? iftop
• Which program or process is using it? nethogs
• How much per day or month? vnstat

Install them all at once (they are in Ubuntu’s universe repository):

sudo apt update
sudo apt install vnstat iftop nethogs nload

First, find the interface name

ip -br link

On servers it is usually something like eth0, ens3 or enp1s0. The examples use eth0.

Quick counters without installing anything

The kernel already counts every byte. ip -s -h link show eth0 prints totals since boot, including errors and drops:

    RX:  bytes packets errors dropped  missed   mcast
         45.2M   2.57k      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
          115k   1.49k      0       0       0       0

Growing errors or dropped numbers point to a network problem rather than a busy server. The same counters are in /proc/net/dev.

nload: live graph per interface

nload eth0

It shows incoming and outgoing traffic as two graphs with current, average, minimum, maximum and total values. Use the left and right arrow keys to switch interfaces, F2 for options and q to quit. nload -m shows all interfaces at once without graphs.

iftop: traffic per connection

sudo iftop -i eth0 -n -N

-n skips DNS lookups and -N shows port numbers instead of service names, which keeps it fast. For a one-off report you can paste into a ticket, use text mode:

$ sudo iftop -t -s 5 -n -N -i eth0
   # Host name (port/service if enabled)            last 2s   last 10s   last 40s cumulative
   1 172.17.0.2                               =>     41.4Kb     31.6Kb     31.6Kb     23.7KB
     167.82.62.132                            <=     30.9Mb     18.8Mb     18.8Mb     14.1MB
...
Total send rate:                                     41.4Kb     31.6Kb     31.6Kb
Total receive rate:                                  30.9Mb     18.8Mb     18.8Mb

Rates are in bits per second (Mb = megabits). => is traffic sent, <= is traffic received. iftop needs root because it captures packets.

nethogs: traffic per process

sudo nethogs eth0

This is the quickest way to find out which program is downloading or uploading. Press s or r to sort by sent or received, and m to switch between rates and totals. Trace mode prints plain lines (program/PID/user, sent, received in KB/s):

$ sudo nethogs -t -c 4 eth0
Refreshing:
curl/3331/0	3.42285	1835.78

vnstat: daily and monthly totals

vnstat runs as a small background service (vnstat.service) and keeps a history, so it answers “how much traffic did this server use this month?”. It starts collecting only after installation, so there is no data for earlier days. Check that the service is running:

systemctl status vnstat

Then:

vnstat              # summary per interface
vnstat -i eth0 -d   # per day
vnstat -i eth0 -m   # per month
vnstat -i eth0 -h   # per hour
vnstat -l -i eth0   # live rate, Ctrl+C to stop
vnstat -tr 5        # average over 5 seconds

Output from our test after a download:

   daily
                     rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
         today     28.04 MiB |   77.65 KiB |   28.12 MiB |   26.21 Mbit/s
     ------------------------+-------------+-------------+---------------
     estimated    107.68 MiB |     298 KiB |  107.97 MiB |

Right after installation, vnstat says No data. Timestamp of last update is same ... as of database creation. That is normal: the service saves to its database every few minutes. On a fresh install it adds every interface it finds, including virtual tunnel interfaces; remove ones you don’t need with sudo vnstat --remove -i tunl0 --force. For scripts and dashboards, vnstat --json d prints the data as JSON.

sar: history with the rest of your system stats

If you already use sysstat, sar -n DEV 1 5 prints received and sent packets and kB per second for each interface, five times at one-second intervals:

IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s ... %ifutil
 eth0    174.00     83.00   3176.50      5.35 ...    0.26

Which tool to leave running

iftop, nethogs and nload are for looking at a problem while it happens; close them afterwards. vnstat is the one to keep running on a server: according to its manual it isn’t a packet sniffer and only reads the kernel’s interface counters, so it uses few resources, and it gives you the traffic history when you need it, for example to compare with your plan’s bandwidth. To find which connections are open (rather than how much they send), use ss or netstat to list listening ports. To measure the speed between two servers, see iperf3.

Related: test your internet speed with speedtest-cli.

Official documentation: vnstat(1), iftop(8) and nethogs(8).