---

iftop displays bandwidth usage on an interface by host connection.

---

Basic Usage

• sudo iftop - Start on default interface

• sudo iftop -i <interface> - Monitor specific interface

• sudo iftop -i eth0 - Monitor eth0 interface

• sudo iftop -i wlan0 - Monitor wlan0 interface

---

Command Line Options

• -i <interface> - Specify interface

• -n - Disable hostname lookup (show IPs)

• -N - Don't convert port numbers to service names

• -b - Display in bytes/sec (default is bits/sec)

• -B - Display in bytes/sec (alternative)

• -t - Text-only mode (no bar graph)

• -L <num> - Print length of screen

• -p - Promiscuous mode

• -P - Show ports

• -f <filter> - Apply BPF filter

• -F <net/mask> - Show traffic flows to/from network

---

Interactive Commands

Navigation

• j or ↓ - Scroll down

• k or ↑ - Scroll up

• h or ? - Show help

• q - Quit

Display Toggles

• n - Toggle DNS name resolution

• N - Toggle service name vs port number

• p - Toggle port display

• s - Toggle source host display

• d - Toggle destination host display

• t - Cycle display modes (2s, 10s, 40s averages)

• b - Toggle bar graph mode

Sorting

• < - Sort by source

• > - Sort by destination

• o - Order by current sort method

Filtering

• l - Set screen filter

• L - Set and lock screen filter

• ! - Run shell command in filter line

• 1-9 - Filter by protocol type

---

Configuration

Config File Location

• No main config file (runs interactively)

• Options passed via command line or aliases

Example Aliases

Add to your shell config:

# Quick interface monitoring
alias iftop-eth0='sudo iftop -i eth0 -n -N'
alias iftop-wlan0='sudo iftop -i wlan0 -n -N'

# Bytes per second display
alias iftop-b='sudo iftop -b -n -N'

---

Tips

• Run with root privileges (sudo) to capture on interfaces

• Use -n and -N flags for less distraction in noisy networks

• Exit with q, use filters in combination with command options to reduce data

• Useful for spotting sudden spikes or bandwidth hogs in real time

• Turn off DNS and service name lookups (-n -N) for quicker, clearer output

• Press h while running to see a key reference screen

• Use filters (-f) to focus on specific traffic

• Watch the averages (2s, 10s, 40s) to see both momentary and sustained usage patterns

• Use -b flag to display in bytes/sec if that's more intuitive

• Text-only mode (-t) useful for logging or screenshots

---