iftop: 20+ Years of Answering "Who's Eating My Bandwidth?"

Your server feels slow. The website lags. The VPN is crawling. You suspect the network, but you have no idea which connection is responsible.

That question has sent me to iftop more times than I can count over the years. Open a terminal, type sudo iftop, and within seconds the top talkers are on screen — no dashboards, no agents, no waiting for metrics to aggregate.

iftop is not new. It has been around since 2002, and its last stable release shipped in February 2006. Two decades later it is still in every distro's package repository and still the fastest way to see live bandwidth per host pair. This post covers what iftop does, its use cases, and how it has survived for over 20 years.

What iftop Is (and Isn't)

iftop does for network usage what top does for CPU usage. It captures packets on an interface through libpcap and shows a live table of bandwidth between pairs of hosts, sorted by traffic. The busiest pairs float to the top.

What it does well:

• Real-time bandwidth per host pair, in 2s / 10s / 40s averages
• Sent and received traffic with direction arrows (=>, <=)
• Optional port display, so you see which service moves the data
• BPF filter expressions (same syntax as tcpdump)
• Works on any interface: Ethernet, Wi-Fi, VPN, bridge, tunnel

What it doesn't do:

• Per-process breakdown (use nethogs)
• Long-term history or logging (use vnstat)
• Packet payloads or deep inspection (use tcpdump / Wireshark)
• Traffic generated by the host itself in some setups — iftop sees packets crossing the interface, so run it in promiscuous mode (-p) on a gateway or SPAN port to catch third-party traffic

iftop answers one question: Which hosts are moving the most traffic on this interface, right now?

Use Cases

1. Bandwidth triage on a saturated link

The classic use case, straight from the man page: "why is our ADSL link so slow?" Run iftop on the gateway and the host pair hogging the link is visible in seconds.

2. Server egress debugging

A VPS is burning through its transfer quota. iftop on eth0 shows which remote IP pulls the data — a backup job, a compromised service, or a chatty integration.

3. Finding the noisy neighbor

On a shared host or a machine running many containers, aggregate totals look fine but one connection saturates the pipe. iftop surfaces the pair; ss -tnp then maps it to a process.

4. Verifying traffic goes where you expect

After a firewall change or a DNS migration, watch the pairs to confirm new flows appear and old ones stop. No packet capture needed.

5. Security incident first look

An unfamiliar remote address with sustained traffic is worth a tcpdump capture. iftop is the fastest way to spot it before you start recording packets.

Installation

One command per distribution:

# Debian/Ubuntu
sudo apt install iftop

# Fedora/RHEL
sudo dnf install iftop

# Arch/Manjaro
sudo pacman -S iftop

# openSUSE
sudo zypper install iftop

iftop needs root (or CAP_NET_RAW + CAP_NET_ADMIN) because it captures packets through libpcap.

First Run

sudo iftop -n -i eth0

Flags worth knowing from day one:

• -n — skip DNS lookups. Reverse DNS can flood your own display and skew results; turn it off first, enable it later with r if you need names.
• -N — skip port-name resolution (shows 443 instead of https).
• -i eth0 — pick the interface. Without it, iftop guesses the first external-looking interface.
• -P — show ports from the start.
• -B — display bits/sec instead of bytes/sec (bytes are the default).
• -p — promiscuous mode; count traffic that does not address this host directly.

The Interface, Demystified

                                        10Mb            25Mb            50Mb
  ────────────────────────────────────────────────────────────────────────────
  web01.example.com  => db02.example.com   8.5Mb   7.9Mb   6.1Mb
                     <=                    1.2Mb   1.1Mb   980Kb
  ────────────────────────────────────────────────────────────────────────────
  TX:                      10.2Mb  (peak 12.4Mb)
  RX:                       1.9Mb  (peak 2.3Mb)
  TOTAL:                   12.1Mb  (peak 14.7Mb)   1.2Gb in   340Mb out

Top: a logarithmic bar-graph scale. Middle: host pairs, each with rates for the last 2, 10, and 40 seconds. Bottom: peak and total transfer figures. The 10-second average column sorts the list by default.

Essential Keybindings

• 1 / 2 / 3 — sort by 2s, 10s, or 40s average
• < / > — sort by source or destination hostname
• p — toggle port display; S / D — show source or destination ports only
• s / d — aggregate all traffic by source or destination host (essential on a gateway)
• n — toggle DNS resolution; r — resolve names now
• t — cycle line display modes (two-line, or one-line sent/received/total)
• P — pause display; o — freeze sort order; j / k — scroll
• f — edit the capture filter live; l — enter a display filter (regex on hostnames)
• h — help; q — quit

Filters

iftop uses BPF filter code, the same language as tcpdump. The filter is combined with and ip, so only IP packets count.

# Ignore broadcast noise
sudo iftop -f 'not ether host ff:ff:ff:ff:ff:ff'

# Web traffic only, excluding a local proxy
sudo iftop -f 'port http and not host 10.0.0.50'

# One subnet in or out, direction judged against the network boundary
sudo iftop -F 10.0.0.0/24

Press f while iftop runs to change the filter on the fly. Note the display keeps up to 40 seconds of old entries after a change — that is the capture window, not a bug.

iftop vs The Competition

iftop owns the host-pair view. Use it with ss or nethogs when you need the process behind the connection.

A Brief History: Since 2002

iftop was written by Paul Warren (with Chris Lightfoot) and first released in March 2002 — over 24 years ago. The stable version, 0.17, dates from February 2006. Pre-releases up to 1.0pre4 exist, and some distributions (openSUSE) package the 0.99.x pre-release series, but 0.17 remains the standard stable release nearly everywhere.

Why has it survived so long?

1. One job, done perfectly. iftop does not try to be a full monitoring platform. It shows live per-host bandwidth, and it does that in a single C binary under 100 KB.
2. Dependencies that never rot. It needs only libpcap and ncurses — two libraries that every Unix-like system already ships.
3. Everywhere by default. iftop is in the main repositories of Debian, Ubuntu, Fedora, Arch, openSUSE, Alpine, and OpenWrt. On many systems it is already installed.
4. Stable interface. The keybindings and flags have barely changed in 20 years. Muscle memory from 2005 still works.

The man page still carries the original tagline: "Handy for answering the question 'why is our ADSL link so slow?'" — a problem that outlived ADSL itself.

Pro Tips from Years of Use

• Run it inside tmux. Kill your SSH session and you lose the view; detach instead.
• Start with -n. DNS lookups generate their own traffic and slow the display. Add names later.
• Combine with ss. Once iftop shows the remote IP, ss -tnp finds the local process in one command.
• Use -F on gateways. Direction relative to the network boundary is what makes the totals honest on a router.
• Watch the 40-second column. The 2s column jitters; the 40s average tells you if a flow is sustained or a burst.
• ~/.iftoprc remembers. Set interface: eth0, dns-resolution: no, and port-display: on once instead of typing flags every time.

Conclusion

iftop has been answering the same question since 2002: which hosts are moving the most traffic right now? No successor has displaced it because none needs to. It is tiny, instant, and available on every box you SSH into.

Next time a link saturates or a server crawls, skip the dashboard. Type sudo iftop -n, watch the top of the list, and you will have your culprit in seconds.

References

• iftop home page — https://www.ex-parrot.com/pdw/iftop/
• Source repository — https://code.blinkace.com/pdw/iftop
• Wikipedia: Iftop — https://en.wikipedia.org/wiki/Iftop