We have a Linux router which firewalls incoming traffic, while allowing the 300+ hosts on our local network to make outgoing connections to the Internet.

I suspect that a few "bandwidth hogs" may be consuming far more than their share, and degrading the experience for the other users. I would like to make some measurements on the Linux router to determine if that is true.

I've Googled for bandwidth usage monitoring tools, and found a bunch of tools which can measure bandwidth usage "by IP". But I suspect this means the destination IP, not the source IP. I don't care about the remote IPs -- I just want to know which IPs (or better yet, MAC addresses) on the local network are consuming the most bandwidth.

Is there a freely available program for Linux which can help?

  • 1
    What OS on the router? Some router-specific OS or server OS? Also please mention the tools that don't suit your needs. Jul 4, 2014 at 3:20

3 Answers 3


ntop may give you what you're looking for.

  • Indeed, ntop was able to identify the "bandwidth hogs". Thanks for pointing out a great tool.
    – Alex D
    Jul 4, 2014 at 9:18

If you want to have a visual, real-time display, you might want to use EtherApe. Big nodes = big consumers:

enter image description here


NetHogs might work here - I'd start it up in screen, and switch over to total mode

enter image description here

Iptraf would work here - its interactive mode shows TCP traffic only

enter image description here

but its logs seem to include this sort of information in detail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.