# Network monitoring

## Monitoring a network from the command line

It is often convenient to monitor a network from the command line. For example, the use of command-line tools allows you to log into an OpenWrt router remotely in order to diagnose a network performance problem. Here I describe how to use some common open-source tools.

## Bmon

Bmon monitors the use of a network interface in aggregate; it provides real-time information about the utilization of the network interfaces in a computer. After running bmon, you will likely want to press d and g to provide a detailed and graphical display, respectively. The graphical display plots utilization over time.

## Iftop

Iftop helps determine the degree to which individual connections are using the network. For example, running iftop -i eth0 -P will show the connections making use of the interface eth0. Each measurement is displayed using two lines, which represent the two directions of communication. Behind each line, iftop displays, using a highlight, a bar which is proportional to the percentage the respective connection represents of the total network utilization (the unit for each bar is some degree of bits per second).

## Throughput tests

Services like Speedtest.net allow you to measure the throughput of your network connection, but are generally designed for use with a web browser. The command-line tool speedtest-cli allows you to interact with Speedtest.net’s measurement servers. For an even lighter-weight solution, first obtain the list of Speedtest.net servers at http://www.speedtest.net/speedtest-servers.php. Next, choose a nearby server from the list and run time wget http://sto-chic-01.sys.comcast.net/speedtest/random4000x4000.jpg -O /dev/null.

## NetFlow

Installing softflowd on a device that has visibility of your network allows that device to provide NetFlow data representing its observations (see beholder). Nfcapd can receive such a NetFlow stream and store it to disk (see golem). The nfdump utility will print stored NetFlow data in human-readable form. Here are some useful invocations of nfdump:

nfdump -R . -c 5 -t 2020/01

nfdump -R . -c 5 -t 2020/01/01-2020/01/07

nfdump -R . -c 5 -t 2020/01/01.12-2020/01/01.13

### Top users of upload bandwidth

nfdump -R . -s srcip/bytes -L +10M 'src net 192.168.1.0/24'

nfdump -R . -s dstip/bytes -L +10M 'dst net 192.168.1.0/24'

nfdump -R . -s srcip/bytes -L +10M 'not src net 192.168.1.0/24'
Running ethtool eth0 will describe the interface eth0, including the connection speed of the interface.