ifstat - Report Network Interfaces Bandwidth

Table of Contents#

1. Installation
2. Basic Usage
3. Advanced Features
4. Common Practices
5. Best Practices
6. Troubleshooting
7. Conclusion
8. References

Installation#

On Debian and Ubuntu#

On Debian-based systems, you can use the apt package manager to install ifstat. Open your terminal and run the following command:

sudo apt update
sudo apt install ifstat

On Fedora#

On Fedora, use dnf to install ifstat:

sudo dnf install ifstat

On CentOS and RHEL#

For CentOS and RHEL systems, you need to first enable the EPEL (Extra Packages for Enterprise Linux) repository, then use yum or dnf to install ifstat.

For CentOS:#

sudo yum install epel-release
sudo yum install ifstat

For RHEL:#

You must install the EPEL repository manually by downloading the release RPM from the Fedora Project website. For RHEL 9, run:

sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
sudo dnf install ifstat

For other RHEL versions, adjust the version number in the URL accordingly (e.g., use latest-8 for RHEL 8).

On Arch Linux#

On Arch Linux, install ifstat from the official repositories:

sudo pacman -S ifstat

Basic Usage#

Once ifstat is installed, you can start using it to monitor network interface bandwidth. By default, ifstat keeps a history file (at /tmp/.ifstat.u$UID) and shows only the difference between the last and current call, so repeated invocations display incremental traffic rather than absolute counters.

Monitor All Interfaces#

To monitor all available network interfaces, simply run the ifstat command without any arguments:

ifstat

This will display a table showing the input and output bandwidth usage (in kilobytes per second by default) for all available, non-loopback network interfaces. The table is updated every second.

Monitor Specific Interfaces#

If you want to monitor only specific interfaces, you can use the -i option followed by comma-separated interface names. For example, to monitor the eth0 and wlan0 interfaces:

ifstat -i eth0,wlan0

Changing the Update Interval#

You can change the update interval by specifying a delay (in seconds) as a positional argument. For example, to update the display every 5 seconds:

ifstat 5

You can also limit the number of samples by adding a count after the delay. For example, to sample every 2 seconds, 10 times:

ifstat 2 10

Show Total Bandwidth#

Use the -T option to display a cumulative total line across all monitored interfaces:

ifstat -T

Advanced Features#

Output Formatting#

ifstat allows you to customize the output format. Use the -b option to display the bandwidth in kilobits per second instead of the default kilobytes per second:

ifstat -b

The -n option turns off the periodic re-display of column headers, which is useful when logging output to a file:

ifstat -n

Use -t to prepend a timestamp to each output line:

ifstat -t

Note: In the iproute2 version of ifstat, -t sets an averaging interval instead. See the Troubleshooting section if this flag behaves differently than expected.

The -w option uses fixed-width columns for cleaner alignment in scripts or logs:

ifstat -w

Display Options#

The -S option keeps statistics on the same line, updating in place rather than printing new lines (no scrolling or wrapping):

ifstat -S

Use -z to hide interfaces with zero activity, focusing only on active connections:

ifstat -z

The -l option enables monitoring of loopback interfaces, which are excluded by default:

ifstat -l

Error Reporting#

Add the -e option to display packet error and drop counts alongside bandwidth statistics:

ifstat -e

History Management#

By default, ifstat stores previous measurements in a history file at /tmp/.ifstat.u$UID. You can change this location by setting the IFSTAT_HISTORY environment variable:

export IFSTAT_HISTORY=/path/to/custom/history

Use -a to ignore the history file and show absolute counters since boot:

ifstat -a

Use -r to reset the stored history:

ifstat -r

The -s option prevents ifstat from updating the history file, useful for one-off checks without affecting future readings:

ifstat -s

Common Practices#

Monitoring during High-Traffic Periods#

During peak usage hours or when you suspect a network issue, start ifstat to monitor the bandwidth usage. This can help you identify if a particular interface is experiencing unusually high traffic, which could be a sign of a misbehaving application or a network attack.

Comparing Bandwidth Usage#

Regularly compare the bandwidth usage of different network interfaces. If one interface is consistently using a significantly higher amount of bandwidth than others, it might indicate a problem or an imbalance in network traffic distribution.

Quick One-Off Checks#

If you only need a single snapshot without affecting the history file, combine -s (no history update) and -a (ignore history, show absolute counters):

ifstat -s -a

Monitoring with Timestamps#

When investigating intermittent issues, add timestamps to each reading so you can correlate bandwidth spikes with application logs or other events:

ifstat -t 5

Best Practices#

Logging the Output#

To keep a record of the network interface bandwidth usage over time, redirect the ifstat output to a file. Use -n to suppress headers for cleaner log data:

ifstat -n 30 > ifstat_log.txt

This command will log the bandwidth usage every 30 seconds to the ifstat_log.txt file. For timestamped logs that are easier to analyze later, add -t:

ifstat -n -t 30 > ifstat_log.txt

Using in Combination with Other Tools#

Combine ifstat with other network monitoring tools like htop, netstat, or nethogs. For example, if ifstat shows high bandwidth usage on a particular interface, you can use nethogs to find out which processes are consuming the most network resources.

Filtering Zero-Activity Interfaces#

When monitoring systems with many interfaces, use -z to hide idle ones and focus on active traffic:

ifstat -z -T

Troubleshooting#

Interface Not Appearing#

If you run ifstat and an expected network interface is not listed, make sure the interface is up and running. You can use the ip link command to check the status of network interfaces. For example:

ip link show

If the interface is down, you can bring it up using the following command:

sudo ip link set eth0 up

Loopback interfaces are excluded by default. Add the -l flag if you need to monitor lo.

Permission Issues#

ifstat typically does not require root or sudo privileges for standard monitoring, as it reads from world-readable system files like /proc/net/dev. If you encounter permission issues, ensure you have read access to these system files.

Options Not Working as Expected#

Because two different tools share the name ifstat, options may differ depending on which version is installed. The standalone version (section 1) uses positional arguments for the delay, while the iproute2 version (section 8) uses flags like -d or -t. Run man ifstat to check which version is on your system and consult the appropriate documentation.

Conclusion#

ifstat is a simple yet powerful tool for monitoring network interface bandwidth. It provides real-time information on bandwidth usage, which is essential for network troubleshooting and resource management. By following the installation steps, basic and advanced usage patterns, common and best practices, and troubleshooting tips outlined in this blog post, you can effectively use ifstat to maintain a healthy and efficient network environment.

References#

• ifstat man page: Run man ifstat in your terminal for the full reference.
• ifstat(8) Linux manual page (iproute2 version): https://man7.org/linux/man-pages/man8/ifstat.8.html
• Using ifstat for Linux network statistics (Red Hat): https://www.redhat.com/en/blog/ifstat-network-statistics
• Debian and Ubuntu official documentation: https://wiki.debian.org/ and https://help.ubuntu.com/
• CentOS and RHEL official documentation: https://docs.centos.org/ and https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/