I am managing a network with a Linux server (CentOS 5.4) and Windows XP Clients. Recently I have become concerned about network performance and would like to begin monitoring it. Is it possible to monitor network traffic in order to find ways to optimize traffic? For example, there are some users who stream internet radio to their machines. I would like to find out if it's eating up enough bandwidth to require that they stop. Another possibility would be for me to see if performance is slowed by large file transfers between a cleint and the server. It would also be helpful to have some sort of reporting that would allow me to see peak load times in order to better schedule network maintenance tasks. Are there any utilities available that would help me accomplish this?



  • Can you expand your question to include some details about your network equipment? i.e. do you have any managed switches? Is the CentOS server also your gateway router? If not, what are you using as your gateway router?
    – gravyface
    Aug 24, 2010 at 12:34
  • gravyface, I am not using any managed switches, and my gateway router is a Fortigate 60. Clients do not pass through the server to get to the internet.
    – mclark1129
    Aug 24, 2010 at 15:46

5 Answers 5


Look for iptraf and iftop, two tools that will help you a lot. You can run then in the gateway machine (if you have one) or specific hosts.

If you want to graph something you can use a SNMP tool like Cacti, Zabbix or even MRTG to have statistics of how much each host is eating from your bandwidth.

  • -1: iptraf and iotop are useful while you can afford the time to site and watch them - not for long term stats gathering. You can only use an SNMP tool if the traffic is passing through an SNMP capable router.
    – symcbean
    Aug 24, 2010 at 12:06
  • 2
    It's iftop. And SNMP is just a matter of adding a SNMP server to the hosts, there's no need to be only "routers". Also, you can log data with iptraf and analyze it later.
    – coredump
    Aug 24, 2010 at 12:33

ntop sounds like a program for you.


you can use netstat , its very helpful command


You can use a variety of approaches. Cacti gives you an easy way of finding bandwidth used on a per-switchport basis. This translates directly into "how much traffic to/from a given workstation", but doesn't necessarily translate into "uses a lot of WAN traffic".

If you have a router that can export netflow data, you can use that to specifically tie traffic to workstations (may need to cross-correlate with DHCP logs).


Have a look at MRTG, PasTMON and Scrutinizer.

Not the answer you're looking for? Browse other questions tagged or ask your own question.