Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

iftop is great tool to view almost live bandwidth usage distinguished by source-ip source-port destination-ip destination port.

I'm using it to see which client's ip is using most bandwidth. Now I would like to store output somewhere.

iftop uses ncurses so

iftop > log.txt

does not work as expected, result file is not readable.

Is there any tool like this which can be used to pipe output to a text file?

share|improve this question
top tool has batch mode -b which enables you to save snapshot by redirecting output to a file, but iftop does not have such an option. – Khaled Apr 14 '12 at 14:47
thx Khaled for your reply, I know this already that's why I'm looking for iftop batch alternative. – mickula Apr 14 '12 at 14:49
up vote 7 down vote accepted

Since iftop-1.0pre3 (2014-01-01), a text output mode was added. This will be very useful to anyone trying to parse the output of iftop.

The command line option to activate text (batch) mode is:

-t          use text interface without ncurses

When using text mode, the following options are available:

-s num      print one single text output afer num seconds, then quit
-L num      number of lines to print

Use the -h option for help on iftop usage.

Example usage would be:

iftop -t > log.txt
iftop -t -s 180 > log.txt

If you want it to run in the background for 5 hours:

iftop -t -s 18000 > log.txt &

Check on background job with job command.

share|improve this answer
thank you! :) accepted – mickula May 27 '14 at 19:40

iptraf can log this level of detail. The output looks something like this:

Wed Apr 25 23:08:42 2012; UDP; eth0; 65 bytes; from to
Wed Apr 25 23:08:42 2012; UDP; eth0; 133 bytes; from to
Wed Apr 25 23:08:43 2012; UDP; eth0; 96 bytes; from to
Wed Apr 25 23:08:44 2012; UDP; eth0; 472 bytes; from to
Wed Apr 25 23:08:47 2012; ICMP; eth0; 159 bytes; from to; dest unrch (port)
share|improve this answer
What command line options do you use to get that output with iptraf? – Banjer Dec 2 '13 at 20:00
sudo iptraf -i eth0 -L /tmp/traffic_log – dwurf Dec 3 '13 at 3:39

Seems that iftop can't output to a text file(there is a feature request but it is not already implemented), in the meantime take a look at bwm-ng utility that is similar to iftop but allow to output on a CSV file.

Here's an example of usage :

bwm-ng -o csv -c 6 -T rate -I eth0 >> bandwidth.log
share|improve this answer
I already know this one, the problem is that output looks like: 1334421690;eth0;1909467.12;156131.73;2065598.88;78222;956643;2562.87;1956.09;45‌​18.96;980;1284;0.00;0.00;0;0 1334421690;total;1909467.12;156131.73;2065598.88;78222;956643;2562.87;1956.09;45‌​18.96;980;1284;0.00;0.00;0;0 1334421690;eth0;1934056.00;142336.00;2076392.00;71168;967028;2502.00;1874.00;437‌​6.00;937;1251;0.00;0.00;0;0 1334421690;total;1934056.00;142336.00;2076392.00;71168;967028;2502.00;1874.00;43‌​76.00;937;1251;0.00;0.00;0;0 so it's for whole interface not grouped by connected ip addresses – mickula Apr 14 '12 at 16:41
You can parse the CSV with a perl script for example and change the output format ... – aleroot Apr 14 '12 at 16:44
it's not about the format of file, it's that the stats is summary for interface not grouped by client IP – mickula Apr 15 '12 at 10:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.