Network monitoring

Monitoring a network from the command line

It is often convenient to monitor a network from the command line. For example, the use of command-line tools allows you to log into an OpenWrt router remotely in order to diagnose a network performance problem. Here I describe how to use some common open-source tools.


Bmon monitors the use of a network interface in aggregate; it provides real-time information about the utilization of the network interfaces in a computer. After running bmon, you will likely want to press d and g to provide a detailed and graphical display, respectively. The graphical display plots utilization over time.


Iftop helps determine the degree to which individual connections are using the network. For example, running iftop -i eth0 -P will show the connections making use of the interface eth0. Each measurement is displayed using two lines, which represent the two directions of communication. Behind each line, iftop displays, using a highlight, a bar which is proportional to the percentage the respective connection represents of the total network utilization (the unit for each bar is some degree of bits per second).

Throughput tests

Services like allow you to measure the throughput of your network connection, but are generally designed for use with a web browser. The command-line tool speedtest-cli allows you to interact with’s measurement servers. For an even lighter-weight solution, first obtain the list of servers at Next, choose a nearby server from the list and run time wget -O /dev/null.


Installing softflowd on a device that has visibility of your network allows that device to provide NetFlow data representing its observations (see beholder). Nfcapd can receive such a NetFlow stream and store it to disk (see golem). The nfdump utility will print stored NetFlow data in human-readable form. Here are some useful invocations of nfdump:

nfdump -R . -c 5 -t 2020/01

nfdump -R . -c 5 -t 2020/01/01-2020/01/07

nfdump -R . -c 5 -t 2020/01/01.12-2020/01/01.13

Top users of upload bandwidth

nfdump -R . -s srcip/bytes -L +10M 'src net'

Top users of download bandwidth

nfdump -R . -s dstip/bytes -L +10M 'dst net'

Biggest download sources off local network

nfdump -R . -s srcip/bytes -L +10M 'not src net'


Running ethtool eth0 will describe the interface eth0, including the connection speed of the interface.

Assistant Professor

My research interests include free and open source software, system security, and network security.