Real-Time Network Connection Monitoring with iftop

Overview of iftop

iftop is a CLI tool for real-time monitoring of network connection activity.
→ It is used to identify network bottlenecks.

If you simply want to monitor the network, a monitoring tool will do the job, but

with iftop you can see specifically where (domain / IP / port) and how much (data transfer volume) traffic is going.

How to Install

• Ubuntu

$ sudo apt-get install -y iftop

• CentOS

$ sudo yum -y install epel-release
$ sudo yum -y install iftop

Usage

This is the form I use most often.

• If you do not have eth0, remove the -i eth0 part.

$ sudo iftop -i eth0 -B -P -n -N

• -i specify the interface
• -B display units in Bytes
• -P display the protocol or port
• -n display by IP instead of domain
• -N display the port number instead of the protocol service name

Display Items

=> is sending,
<= is receiving.

                           24.4kB                      48.8kB                      73.2kB                      97.7kB                 122kB
+--------------------------+---------------------------+---------------------------+---------------------------+---------------------------
ip-10-13-1-101.ap-northeast-1.compute.internal:http      => ip-10-13-100-41.ap-northeast-1.compute.internal:62635     559kB   121kB  67.1kB
                                                        <=                                                          3.60kB  1.90kB  1.05kB
ip-10-13-1-101.ap-northeast-1.compute.internal:35244     => ip-10-13-102-56.ap-northeast-1.compute.internal:mysql       0B   2.18kB  1.21kB
                                                        <=                                                             0B   23.1kB  12.8kB
ip-10-13-1-101.ap-northeast-1.compute.internal:35247     => ip-10-13-102-56.ap-northeast-1.compute.internal:mysql       0B   2.13kB  1.18kB
                                                        <=                                                             0B   23.0kB  12.8kB
ip-10-13-1-101.ap-northeast-1.compute.internal:http      => ip-10-13-0-231.ap-northeast-1.compute.internal:8239         0B   7.73kB  4.29kB
                                                        <=                                                             0B   1.16kB   658B
ip-10-13-1-101.ap-northeast-1.compute.internal:ssh       => ip-10-13-0-11.ap-northeast-1.compute.internal:56320       612B    576B    522B
                                                        <=                                                            26B     26B     32B
ip-10-13-1-101.ap-northeast-1.compute.internal:http      => ip-10-13-100-41.ap-northeast-1.compute.internal:62657       0B     49B     27B
                                                        <=                                                             0B     92B     51B
ip-10-13-1-101.ap-northeast-1.compute.internal:40069     => ip-10-13-103-247.ap-northeast-1.compute.internal:6379       0B     99B     55B
                                                        <=                                                             0B     34B     19B
ip-10-13-1-101.ap-northeast-1.compute.internal:40072     => ip-10-13-103-247.ap-northeast-1.compute.internal:6379       0B     99B     55B
                                                        <=                                                             0B     34B     19B
ip-10-13-1-101.ap-northeast-1.compute.internal:http      => ip-10-13-100-73.ap-northeast-1.compute.internal:27698       0B     44B     25B
                                                        <=                                                             0B     33B     18B
ip-10-13-1-101.ap-northeast-1.compute.internal:53696     => ip-10-13-0-2.ap-northeast-1.compute.internal:domain         0B     21B     12B
                                                        <=                                                             0B     31B     17B
ip-10-13-1-101.ap-northeast-1.compute.internal:41975     => ip-10-13-0-2.ap-northeast-1.compute.internal:domain         0B     21B     12B
                                                        <=                                                             0B     31B     17B
-------------------------------------------------------------------------------------------------------------------------------------------
TX:             cum:   1.31MB   peak:    560kB                                                             rates:    560kB   134kB  74.7kB
RX:                     505kB            117kB                                                                      3.69kB  49.8kB  28.1kB
TOTAL:                 1.81MB            564kB                                                                       564kB   184kB   103kB

Item	Value
TX (Transmitter)	Amount sent
RX (Receiver)	Amount received
TOTAL	Total since iftop started
cum	Cumulative total
peak	Maximum
Rightmost 3 columns (each traffic row, incl. rates)	Average transfer volume over 2s, 10s, and 40s

• The “X” in TX and RX is just an abbreviation that gets dropped.

While watching, when you notice some processing that catches your attention,
press Shift + P to pause it.

To resume, press Shift + P again.

The Actual CLI

If you look below, you can see white bar graphs extending from the left.
These horizontal bars correspond to the scale on the bar at the very top, which is handy for getting a quick sense of how much traffic there is at a glance.

Checking Connections to the DB

When you want to inspect the traffic sent to and received from the default DB (MySQL) port 3306

$ sudo iftop -B -P -n -N -f "port 3306"

As you would expect, the received side is larger.

Notes

I plan to add to this whenever there is an actual high-load situation or a specific incident. ♪

Reference

• ミドルウェア性能検証の手引き
• Linux上でネットワークの帯域制限と遅延を設定する
• Linux TC (帯域制御、帯域保証) 設定ガイドライン