See which connections use your bandwidth in real time with a compact, command-line viewer. 16.11.2025 | reading time: 3 min Want to know which IP or port steals your throughput? iftop is a small, terminal-based tool that reads packets and shows the top network conversations on an interface in real time, making it ideal for quick bandwidth triage and on-the-spot troubleshooting. Quick live example Run the command and watch traffic appear: ```bash sudo iftop -i eth0 -n -P ``` A short sample output looks like this: ```text Interface: eth0 2s 10s 40s 192.0.2.5:56023 => 203.0.113.10:443 120Kb 90Kb 70Kb ################################################## 192.0.2.5:56050 => 198.51.100.22:80 10Kb 8Kb 5Kb ##### Total send rate: 130Kb 98Kb 75Kb ``` In practice he will watch the left column for hosts and the three moving averages to see short and medium-term bandwidth usage. Options that matter Common flags make iftop practical: use `-i` to pick an interface, `-n` to skip DNS lookups, `-P` to show port numbers, `-B` to display bytes rather than bits, `-t` to run without the curses UI for logging, and `-s` to run for a set number of seconds; remember that capturing packets typically requires root privileges or appropriate capabilities. How to use it effectively Use iftop for fast, live inspection: start it on the affected host or a mirror/span port, apply a BPF filter with `-f` to focus on specific traffic, and combine it with `tcpdump` when you need packet-level detail; be aware that iftop does not record historical aggregates long-term and under very high loads packet capture can drop samples, so it is best for interactive, immediate diagnostics. Complementary tools iftop excels at showing top talkers, but pair it with tools that solve other needs: `vnstat` or `collectd` for persistent counters, `nethogs` to map bandwidth to processes, and `tcpdump` or `wireshark` for deep packet analysis when a capture is required. Final note and next step If he wants to master Linux diagnostics, practicing with tools like iftop builds intuition about traffic patterns; for a structured path to certification and deeper skills consider CompTIA Linux+ or LPIC-1, and explore intensive exam preparation at bitsandbytes.academy. Join Bits & Bytes Academy First class LINUX exam preparation. network utilities troubleshooting
