Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i want to monitor the bandwidth usage per application or per IP, currently im using wireshark to do the work, but are there any software dedicated just for this type of job?


share|improve this question
What is your OS? Do you want to perform real-time monitoring or drawing graphs? – Khaled Apr 22 '13 at 8:31
im currently using windows, but it really doesnt matter what OS i should use tho. :) – user1933824 Apr 26 '13 at 2:12

iftop (iftop homepage) gives you a realtime view over bandwidth usage of an network interface. It's very helpful when you want to discover connections which are using lots of bandwidth. After installing, just start "iftop -i eth0", where eth0 is your network interface.

EDIT: For Linux/Unix OS.

share|improve this answer
iptraf is also cool. – melsayed Apr 22 '13 at 10:05
i normally just create a port mirror from my router (connecting to WAN) with my laptop with wireshark running on it. im kinda new at this, so whats normally the standard way of monitoring a network traffic? – user1933824 Apr 26 '13 at 2:15

NetFlow monitoring is a good step up from Wireshark for this. Like with Wireshark, you're inferring application by server port. NetFlow reports on individual sessions, keeping track of bytes used, packets sent, etc. Because it's a much smaller format than packet capture, it's easier to read at a glance, and you can store a much longer history.

You'll need some means of getting NetFlow -- many routers and switches can be configured to export it, or you can get free flow exporter software from several sources. They send, or export, flow data to a collector. There are FOSS collectors and commercial ones at pretty much all price levels. (full disclosure, the company I work for produces a commercial NetFlow collector.)

Now, if you need to know the exact process generating the traffic, you do need to take the extra step of identifying the open client port, and using lsof to find the process that has it open. It's easier to do with incoming services, since they tend to keep their sessions open longer. But I suspect you're already doing something similar if you're currently using Wireshark for the task.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.