I have a dedicated server with a few virtual network interfaces, each mapped to a public IP address. How can I monitor the realtime traffic (in packets/s or Mb/s) of each of them, ideally on a single screen?

What I'm looking for is something like:

eth0:0 123 packets/s
eth0:1 234 packets/s
eth0:2 345 packets/s

I tried iptraf, iftop, jnettop, but I could not get any of them to group the display by virtual interface: they all show the whole eth0.

Note that I'm open to other tools, as long as they're available on CentOS (+ EPEL / remi).

  • 2
    So in other words you want to see the traffic to/from a specific ip-address? In iptraf simply set an ip-address filter iptraf.seul.org/2.7/filters.html – HBruijn Feb 12 '19 at 12:15
  • @HBruijn I was hoping to see them all on a single screen, rather than having to fiddle with a screen and a filter for each IP! – Benjamin Feb 12 '19 at 14:11
  • Did you try -F switch in iftop command? for example: iftop -F IPAdresses – Tom Feb 17 '19 at 12:47
  • I don't have any server to test this on, but do you have any information for the virtual network interfaces in /sys/class/net/eth0:0/statistics/ or eth0:1? – Mugurel Feb 17 '19 at 22:24
  • @Mugurel While there is /sys/class/net/eth0, there is no such thing as /sys/class/net/eth0:0 I'm afraid. – Benjamin Feb 18 '19 at 9:31

The device approach is in this case not a solution, since the kernel does not treat a "virtual network device" as a separate device. Technically the "virtual network device" is just a label on a specific ip address. Having a look at the output of ip addr it gets clear that there is no real "device" even if it is listed as separate device block when checking the ifconfig output. The man page of ip-address also shows that it is considered a "label". Using ip addr to setup such configuration requires to use the label option.

Nearly all command-line tools to visualize the realtime traffic depend on either the netlink protocol (e.g. see ip net link) or read the interface data from /proc/net/dev. As in both cases virtual devices are not listed, it will not be possible to get such utilities to display the information the way you require it.

Therefore it is (within the current network setup) only feasible to use socket based information with according ip based filters/groupings to visualize the data as requested.

ntopng for example would be a way to visualize the connection data on socket basis in realtime. It should as well provide the flexibility to do it for multiple ip's in a single screen. Still it is a web-based user interface, and not to be used within the command line. For RHEL/CentOS it is available within a separate ntopng (http://packages.ntop.org/centos/) repository and needs epel.

Another solution could be to re-design the virtual network devices to a device type that is treated as a real network device. E.g. using veth device pairs and a bridge to connect to the physical device. Eventually the macvlan device type could work as well, and might be easier to setup.

| improve this answer | |
  • 3
    It's also worth mentioning that ifconfig on Linux is long obsolete, and no longer correctly displays reality on the system anyway (as demonstrated here). Interface aliases have not worked the way the OP supposes for a decade or more. – Michael Hampton Feb 17 '19 at 20:52
  • I don't mind if network traffic is grouped by virtual device or IP address. I'm surprised that there isn't a command line utility to view this, though! – Benjamin Feb 18 '19 at 9:39
  • Another solution, if there is any control how the IP's are routed to the box : route the IP's to eth0 main address, then add the IP's via dummy interfaces. Though i can't test the theory right now – Sandor Marton Feb 18 '19 at 22:55

Observium is a brilliant open source tool that I shall recommend time and time again. It’s not just for big installations it can be for small like this one too. It will give semi-real-time and historical once you give it time to collect.


| improve this answer | |
  • Since i guess observium uses uses SNMP, i'm really curious how could show data per device aliases, which is the OP asked ? – Sandor Marton Feb 18 '19 at 22:50

For a quick overview, you can use dstat -f -n. You call also specify the individual network interface to monitor (with the -N flag). You can read dstat manpage here.

| improve this answer | |
  • This gives me stats by interface, but does not separate them by IP address, which is what the OP is looking for. – Michael Hampton Feb 17 '19 at 20:54
  • Plus, -N does not allow eth0:0 AFAICS. – Benjamin Feb 18 '19 at 9:35
  • @MichaelHampton very true, I misread the question. Thanks for noticing. – shodanshok Feb 18 '19 at 14:12

iptables statistics (iptables -vL) implements packet counting in each rule. You can stablish different ip based rules in the input and output chains to allow all the traffic with source or destination to each of the IPs of your virtual IPs
/sbin/iptables -A INPUT -d XXX.XXX.XXX.XXX -j ACCEPT /sbin/iptables -A INPUT -d YYY.YYY.YYY.YYY -j ACCEPT /sbin/iptables -A OUTPUT -s XXX.XXX.XXX.XXX -j ACCEPT /sbin/iptables -A OUTPUT -s YYY.YYY.YYY.YYY -j ACCEPT

Anyway I would suggest using different VLANs (eth0.tag1, eth0.tag2, ...,instead of eth0:1, eth0:2) as with the correct network configuration, statistics would be available, in addition to the Linux server, in network devices.

| improve this answer | |

Bridge Virtual interfaces and monitor bridges

| improve this answer | |
  • 1
    Some more specifics would probably be helpful. – Jenny D Feb 22 '19 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.