Iftop can handle the third. You may need to press p in iftop to show the port number. NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does …

Apr 14, 2012 · iftop is great tool to view almost live bandwidth usage distinguished by source-ip source-port destination-ip destination port. I'm using it to see which client's ip is using most bandwidth. Now I would like to store output somewhere. iftop uses ncurses so . iftop > log.txt does not work as expected, result file is not readable.

Nov 2, 2019 · I dont' think it is possible currently, iftop listens to network traffic on a named interface, or on the first interface it can find which looks like an external interface if none is specified, and displays a table of current bandwidth usage by pairs of hosts. iftop must be run with sufficient permissions to monitor all network traffic on the interface.

As iftop's description says, it will "display bandwidth usage on an interface by host". So if you don't want the traffic to show up on iftop, you have to stop it before it consumes that interface's bandwidth. That would require stopping it at the source …

Jul 20, 2009 · On my workstation I noticed that my network utilization is high and constant even though I don't have any downloads currently going. I fire up iftop and see the following entry at the top: 255.255.255.255:bootps => * :bootpc 0b 0b 0b <= 133Kb 162Kb 163Kb

This is what makes the output of iftop look more like a graphical interface and not just scrolling lines of text. Almost all interactive console programs use these terminal codes. iftop is designed to produce an interactive, "graphical" display, and it doesn't seem possible to turn that off.

Jul 16, 2020 · I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine or into port 12345 on the local machine. The simplest filter that gives plausible results is just port 12345. However, I suspect this is incorrect ...

Jun 20, 2014 · At the moment I use iftop which is an easy to see the peak usage. But iftop can only run interactively. I use screen to get it running and can look into it on a regular basis. How can I use iftop or a similar tool to just write out the peak network usage in the last 5 minutes every 5 minutes. I just need a file with lines like this:

iftop looks at all packets going through the interface using pcap (packet capture). netstat shows sockets on the machines. Any packet that’s forwarded to another host will appear in the former, not the latter. Looks like all of the packets found to port 21095 were almost alone. It could be failing connection attempts.

Dec 2, 2009 · Just to summarize from Kyle Brandt and Flow's answers. I just compared bmon and iftop (both installable using apt-get on Debian). Both are ncurses applications, and are really quite neat! bmon gives only a general usage, but has a pretty graph :) iftop shows detailed usage between each connection (and shows source/dest ips) Thanks for your answers!