By keeping an eye on your network usage, you can make sure that your system is running smoothly and efficiently.
If you’re using Linux, there are a few different ways that you can check your network usage.
In this blog post, we’ll go over four methods that you can use to monitor your network traffic.
we can use ip, sar, iftop and nethogs commands to check network usage in Linux. These Linux commands can provide you with in-depth information about what is happening.
- ip – Display network related information, including address, routes and more.
- sar – System Activity Reporter to gather advanced system-level data over time intervals.
- iftop – Monitor network bandwidth usage by connection.
- nethogs – Displays real-time network traffic by the process in granular detail.
The ip and sar commands are installed by default. The iftop and nethogs are not installed by default. You might need to install them before you use them.
Let’s get started!
Table of Contents
check total network usage for each interface in Linux
The ip -s link command is useful for monitoring network usage and performance on a Linux system.
This command is similar to ifconfig, but it is more modern and can display more detailed information about network interfaces.
It provides detailed statistics about the activity of each network interface, including the number of packets transmitted and received, the number of errors and collisions, and the number of bytes transmitted and received.
To start monitoring your system’s network usage, open up a terminal window and run the command “ip -s link ”.
In a few seconds, you will get an overview of all active interfaces along with various details such as the errors they have encountered and the receive/transmit bytes.
# ip -s link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped overrun mcast
35356300 707126 0 0 0 0
TX: bytes packets errors dropped carrier collsns
35356300 707126 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether fa:16:3e:18:3a:76 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped overrun cast
1018050908 16664926 0 0 0 0
TX: bytes packets errors dropped carrier collsns
85034186 1837119 0 0 0 0
The numbers here are historical data since the server starts. If you need real-time data, check other options below.
You can also specify a specific interface by adding its name after the link subcommand. For example, to display statistics for the eth0 interface, you would use the following command:
ip -s link show dev eth0
By analyzing the output of the ip command, you can identify which interfaces are the busiest and might benefit from additional resources (e.g., a faster network connection or a more powerful network card).
the ip command can help you diagnose the issue by showing you whether there are any errors or collisions occurring on the interface.
check real-time network usage for each interface in Linux
The sar command is a utility for collecting, reporting, and analyzing system performance statistics on Linux systems.
The -n DEV option tells sar to report network statistics for the network device (e.g., eth0, wlan0). The 1 at the end of the command tells sar to collect data every 1 second.
To use the sar command with the -n DEV option, open a terminal and type the following command:
sar -n DEV 1
The sar command will then collect and display network statistics for all the network device every 1 second.
# sar -n DEV 1
Linux 3.10.0-957.12.2.el7.x86_64 (new_hostname) 12/25/2022 _x86_64_ (8 CPU)
03:54:22 AM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
03:54:23 AM eth0 5.00 1.00 0.30 0.10 0.00 0.00 0.00
03:54:23 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
03:54:23 AM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
03:54:24 AM eth0 6.00 1.00 0.35 0.18 0.00 0.00 0.00
03:54:24 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
03:54:24 AM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s
03:54:25 AM eth0 5.00 1.00 0.28 0.37 0.00 0.00 0.00
03:54:25 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
By default, sar will continue collecting and displaying data indefinitely. To stop sar, press CTRL+C.
Here are a few examples of using the sar command with the -n DEV option:
- sar -n DEV 1 # collect and display network statistics for DEV every 1 second
- sar -n DEV 1 10 # collect and display network statistics for DEV every 1 second for 10 iterations
- sar -n DEV -f /var/log/sa/saXX # collect and display network statistics from the specified log file
If you are checking a network packet loss issue, you can use keyword EDEV in sar command.
sar -n EDEV 1
For more information on using the sar command, you can consult the man page by typing man sar at the command prompt.
The sar command is very useful in detecting bottlenecks on your network or identifying which interface that is consuming too much bandwidth in real time.
check realtime network usage by process in Linux
To check real-time network usage by process in Linux, you can use the nethogs command. nethogs is a command-line tool that displays a list of processes that are currently using the network, along with the amount of data each process has transmitted and received.
To use nethogs, open a terminal and type the following command:
nethogs
nethogs will then begin monitoring network usage and display a list of processes and their network activity in real-time. To stop nethogs, press CTRL+C.
NetHogs version 0.8.5
PID USER PROGRAM DEV SENT RECEIVED
6260 ocp sshd: ocp@pts/0 eth0 0.137 0.064 KB/secBy default, nethogs displays the total amount of data transmitted and received by each process, but you can use the -b flag to display the data rate in bytes per second. For example:
nethogs -b
You can also use the -d flag to specify a delay between updates, in seconds. For example:
nethogs -d 2
This will display updates every 2 seconds.
You can also specify a specific network interface to monitor by using the -d flag followed by the name of the interface. For example:
nethogs -d 2 eth0
This will monitor network usage on the eth0 interface and display updates every 2 seconds.
For more information on using nethogs, you can consult the man page by typing man nethogs at the command prompt.
check realtime network usage by connection with iftop in Linux
To check real-time network usage by connection in Linux, you can use the iftop command. iftop is a command-line tool that displays a list of active network connections and the amount of data being transmitted and received over each connection.
To use iftop, open a terminal and type the following command:
iftop
iftop will then begin monitoring network usage and display a list of active connections and their data rates in real-time. To stop iftop, press q.
10.254.222.37 => 10.79.101.199 704b 723b 763b
By default, iftop displays the data rate in bits per second, but you can use the -B flag to display the data rate in bytes per second. For example:
iftop -B
You can also specify a specific network interface to monitor by using the -i flag followed by the name of the interface. For example:
iftop -i eth0
This will monitor network usage on the eth0 interface.
You can use the -f flag to specify a filter for the connections that iftop displays. For example, to only display connections involving a particular IP address or port number, you can use a filter in the form of ip:port. For example:
iftop -f 192.168.0.1:80
This will only display connections involving the IP address 192.168.0.1 and port 80.
For more information on using iftop, you can consult the man page by typing man iftop at the command prompt.
You may also use the “iftop” command which will collect data and generate detailed reports featuring send/receive bits per second, packets per second, total throughput, or even estimated bandwidth costs for each active connection on your machine.