iftop displays bandwidth usage on an interface by host connection.
Basic Usage
- sudo iftop - Start on default interface
- sudo iftop -i <interface> - Monitor specific interface
- sudo iftop -i eth0 - Monitor eth0 interface
- sudo iftop -i wlan0 - Monitor wlan0 interface
Command Line Options
- -i <interface> - Specify interface
- -n - Disable hostname lookup (show IPs)
- -N - Don't convert port numbers to service names
- -b - Display in bytes/sec (default is bits/sec)
- -B - Display in bytes/sec (alternative)
- -t - Text-only mode (no bar graph)
- -L <num> - Print length of screen
- -p - Promiscuous mode
- -P - Show ports
- -f <filter> - Apply BPF filter
- -F <net/mask> - Show traffic flows to/from network
Interactive Commands
Navigation
- j or ↓ - Scroll down
- k or ↑ - Scroll up
- h or ? - Show help
- q - Quit
Display Toggles
- n - Toggle DNS name resolution
- N - Toggle service name vs port number
- p - Toggle port display
- s - Toggle source host display
- d - Toggle destination host display
- t - Cycle display modes (2s, 10s, 40s averages)
- b - Toggle bar graph mode
Sorting
- < - Sort by source
- > - Sort by destination
- o - Order by current sort method
Filtering
- l - Set screen filter
- L - Set and lock screen filter
- ! - Run shell command in filter line
- 1-9 - Filter by protocol type
Configuration
Config File Location
- No main config file (runs interactively)
- Options passed via command line or aliases
Example Aliases
Add to your shell config:
# Quick interface monitoring
alias iftop-eth0='sudo iftop -i eth0 -n -N'
alias iftop-wlan0='sudo iftop -i wlan0 -n -N'
# Bytes per second display
alias iftop-b='sudo iftop -b -n -N'Tips
- Run with root privileges (sudo) to capture on interfaces
- Use -n and -N flags for less distraction in noisy networks
- Exit with q, use filters in combination with command options to reduce data
- Useful for spotting sudden spikes or bandwidth hogs in real time
- Turn off DNS and service name lookups (-n -N) for quicker, clearer output
- Press h while running to see a key reference screen
- Use filters (-f) to focus on specific traffic
- Watch the averages (2s, 10s, 40s) to see both momentary and sustained usage patterns
- Use -b flag to display in bytes/sec if that's more intuitive
- Text-only mode (-t) useful for logging or screenshots