The device approach is in this case not a solution, since the kernel does not treat a "virtual network device" as a separate device. Technically the "virtual network device" is just a label on a specific ip address. Having a look at the output of
ip addr it gets clear that there is no real "device" even if it is listed as separate device block when checking the
ifconfig output. The man page of
ip-address also shows that it is considered a "label". Using
ip addr to setup such configuration requires to use the
Nearly all command-line tools to visualize the realtime traffic depend on either the
netlink protocol (e.g. see
ip net link) or read the interface data from
/proc/net/dev. As in both cases virtual devices are not listed, it will not be possible to get such utilities to display the information the way you require it.
Therefore it is (within the current network setup) only feasible to use
socket based information with according
ip based filters/groupings to visualize the data as requested.
ntopng for example would be a way to visualize the connection data on socket basis in realtime. It should as well provide the flexibility to do it for multiple ip's in a single screen. Still it is a web-based user interface, and not to be used within the command line. For RHEL/CentOS it is available within a separate ntopng (http://packages.ntop.org/centos/) repository and needs
Another solution could be to re-design the virtual network devices to a device type that is treated as a real network device. E.g. using
veth device pairs and a bridge to connect to the physical device. Eventually the
macvlan device type could work as well, and might be easier to setup.