IPTraf – An In-Depth Guide to the Linux IP Network Monitor

Table of Contents#

Key Features of IPTraf
Installation Guide
Getting Started with IPTraf
Core Modules in Detail
Example Use Cases
Common Practices & Best Practices
Troubleshooting Common Issues
Alternatives to IPTraf
Frequently Asked Questions (FAQ)
Conclusion
References

1. Key Features of IPTraf#

IPTraf stands out for its modularity and depth of data. Key features include:

Real-time monitoring: Track IP traffic, interface stats, and LAN device activity in real time.
Modular design: Choose from specialized modules to focus on specific metrics (e.g., IP traffic, LAN stations).
Granular statistics: View packet counts, byte volumes, TCP/UDP flags, errors, and more.
Filtering support: Define custom filters to monitor specific ports, protocols, or source/dest IPs.
Logging capabilities: Save monitoring data to log files for post-mortem analysis.
LAN station tracking: Identify bandwidth-hungry devices on your local network using MAC addresses.
Lightweight: Consumes minimal system resources, making it suitable for low-power servers.

Note: iptraf-ng is widely available in the official repositories of most major Linux distributions, including Debian, Ubuntu, Fedora, RHEL 8/9, CentOS Stream, Rocky Linux, AlmaLinux, Arch Linux, and Alpine Linux. Some older distribution releases may still package the original, unmaintained iptraf instead; on those systems, you can build iptraf-ng from source. This guide uses iptraf-ng for all examples.

2. Installation Guide#

Install IPTraf (iptraf-ng) using your distribution’s package manager, or compile from source:

2.1 Debian/Ubuntu-Based Systems#

sudo apt update
sudo apt install iptraf-ng

2.2 RHEL/CentOS/Fedora#

# RHEL 8/9, CentOS Stream, Rocky Linux, AlmaLinux
sudo dnf install iptraf-ng
 
# Fedora
sudo dnf install iptraf-ng
 
# Older RHEL/CentOS 7 (with EPEL enabled)
sudo yum install iptraf-ng

2.3 Compile from Source#

If your distribution does not package iptraf-ng, compile it from the official GitHub repository:

# Install dependencies
sudo apt install build-essential libncurses-dev  # Debian/Ubuntu
sudo yum install gcc ncurses-devel  # RHEL/CentOS
 
# Clone the repo
git clone https://github.com/iptraf-ng/iptraf-ng.git
cd iptraf-ng
 
# Compile and install
make
sudo make install

3. Getting Started with IPTraf#

IPTraf requires root privileges to access network interfaces. Launch it with:

sudo iptraf-ng

This opens the main menu, where you can select modules to start monitoring. For quick access to specific modules, use command-line arguments (e.g., sudo iptraf-ng -i eth0 to monitor traffic on interface eth0).

The main menu includes the following core options:

IP Traffic Monitor: Real-time IP traffic with source/dest details.
General Interface Statistics: Summary of traffic and errors per interface.
Detailed Interface Statistics: Granular protocol-specific stats (TCP, UDP, ICMP, etc.).
Statistical Breakdowns: Port or byte size distributions.
LAN Station Monitor: Track active devices on your local network.
Filters: Define custom filters to narrow down monitoring.
Configure: Adjust logging, color schemes, and other settings.

4. Core Modules in Detail#

IPTraf’s modular design lets you focus on the exact data you need. Below is a deep dive into its most useful modules:

4.1 IP Traffic Monitor#

This module displays real-time IP traffic for all interfaces (or a specific one) with:

Source/destination IP addresses.
Protocol type (TCP, UDP, ICMP, etc.).
Packet count and byte volume.
TCP flags (SYN, ACK, FIN, RST) for connection analysis.

Access: Main Menu → IP Traffic Monitor → Select an interface.

4.2 General Interface Statistics#

A high-level summary of all network interfaces, including:

Total packets/bytes transmitted/received.
Aggregate interface error counts.
Non-IP traffic (ARP, etc.).

Access: Main Menu → General Interface Statistics.

4.3 Detailed Interface Statistics#

For in-depth per-interface analysis, this module breaks down traffic by:

IP protocols (TCP, UDP, ICMP, IGMP).
Non-IP protocols (ARP, RARP).

Access: Main Menu → Detailed Interface Statistics → Select an interface.

4.4 LAN Station Monitor#

Critical for local network troubleshooting, this module tracks all active devices on your LAN by:

MAC address.
Total packets/bytes sent/received.

This is ideal for identifying bandwidth-hungry devices (e.g., a streaming server or compromised host).

Access: Main Menu → LAN Station Monitor → Select a LAN interface.

4.5 Filtering Options (iptraf-ng)#

iptraf-ng adds powerful filtering capabilities to monitor specific traffic:

Port ranges (e.g., 80, 443 for HTTP/HTTPS).
Protocols (TCP, UDP, ICMP).
Source/dest IP addresses or wildcard masks.

Define filters via the main menu’s "Filters" option. Filters are configured and activated interactively within the TUI menu; iptraf-ng also allows saving filter files and loading them with the -F <file> option.

5. Example Use Cases#

Let’s put IPTraf into action with practical scenarios:

5.1 Monitor Real-Time IP Traffic on a Specific Interface#

To track IP traffic on interface ens33:

sudo iptraf-ng -i ens33

This will display a live feed of source/dest IPs, protocols, packet counts, and byte volumes. Press q to exit.

5.2 Identify Bandwidth-Hungry Devices on LAN#

Launch the LAN Station Monitor to see which devices are using the most bandwidth:

sudo iptraf-ng -l eth0

The output will sort devices by total bytes. Look for entries with high total packet/byte counts to spot problematic hosts.

Sample output:

LAN Station Monitor for eth0
----------------------------------------------------------------------
Station              Incoming Pkts/Bytes    Outgoing Pkts/Bytes
----------------------------------------------------------------------
00:1A:2B:3C:4D:5E   8200/5840000           4300/3080000
00:AA:BB:CC:DD:EE   5500/3960000           3200/2280000

5.3 Analyze TCP/UDP Traffic Patterns#

To view detailed protocol stats on interface wlan0:

sudo iptraf-ng -d wlan0

This module shows packet/byte counts per protocol—perfect for analyzing overall traffic patterns by protocol. For port-specific TCP/UDP analysis, use the TCP/UDP Service Monitor with the -s flag (e.g., sudo iptraf-ng -s wlan0). For packet size distributions, use the Packet Size Breakdown module with the -z flag (e.g., sudo iptraf-ng -z wlan0).

5.4 Monitor Specific Ports/Protocols#

To monitor only HTTP and HTTPS traffic on eth0, first define and save filters via the main menu's "Filters" option. Apply the filter configuration before starting a monitoring module, then start the "IP Traffic Monitor" directly from the TUI menu.

6. Common Practices & Best Practices#

6.1 Common Usage Scenarios#

Troubleshooting: Identify sudden traffic spikes or error rates indicating cable/hardware issues.
Capacity Planning: Track long-term traffic trends to justify bandwidth upgrades.
Security: Detect unauthorized devices or unusual traffic patterns (e.g., unexpected UDP traffic from unknown IPs).
Performance Optimization: Find bottlenecks in networked applications.

6.2 Best Practices for Effective Monitoring#

Run as Root: IPTraf requires root privileges to access raw network data—always use sudo or launch as root.
Narrow Down Interfaces: Avoid monitoring all interfaces on high-traffic servers; specify a single interface (e.g., -i eth0) to reduce noise.
Use Filters: On busy networks, define and apply filters via the TUI "Filters" menu to focus on specific protocols/ports (e.g., monitor only SSH traffic) before starting a monitoring module.
Log Data: Save monitoring results to files for post-mortem analysis:
```
sudo iptraf-ng -i eth0 -B -L /var/log/iptraf_eth0.log
```
Monitor During Peak Hours: Schedule monitoring during high-traffic periods to capture realistic usage patterns.
Combine with Other Tools: Pair IPTraf with vmstat or top to correlate network traffic with system CPU/memory usage.

7. Troubleshooting Common Issues#

7.1 No Traffic Displayed#

Ensure you specified the correct interface (check with ip link show).
Verify the interface is active (run sudo ip link set eth0 up if needed).
Make sure you are running IPTraf as root.

7.2 High CPU Usage#

Reduce the scope of monitoring (use filters or limit to one interface).
Disable unnecessary modules (e.g., LAN Station Monitor if not needed).

7.3 Log Files Not Generated#

Ensure the log directory has write permissions (default: /var/log/iptraf-ng).
Specify a custom log path with the -L flag (e.g., -L ~/iptraf.log for user-owned logs).

7.4 Deprecated IPTraf Errors#

If you see errors about deprecated features, switch to iptraf-ng (the maintained fork) as the original IPTraf is no longer updated.

8. Alternatives to IPTraf#

While IPTraf is powerful, consider these tools for specific use cases:

iftop: Real-time bandwidth monitoring per network connection.
vnstat: Historical traffic tracking and bandwidth usage reports.
nload: Simple, intuitive interface for basic traffic monitoring.
tcpdump: Low-level packet capture and analysis (for deep packet inspection).
Wireshark: Graphical tool for advanced packet analysis (not ideal for headless servers).
bmon: Bandwidth monitor with a clean terminal UI and per-interface graphs.
bandwhich: Terminal utility that shows bandwidth usage by process, connection, and remote IP.
nethogs: Displays per-process network bandwidth usage, useful for identifying which application is consuming bandwidth.

9. Frequently Asked Questions (FAQ)#

Is IPTraf still maintained?#

The original IPTraf is no longer actively maintained. However, iptraf-ng is the actively maintained fork and is included in most major Linux distributions. The latest release (v1.2.2) was published in November 2024, with security updates issued in 2025.

What is the difference between IPTraf and iptraf-ng?#

iptraf-ng is a fork of the original iptraf that continues to receive updates, bug fixes, and security patches. It is functionally similar but is the recommended version for modern Linux systems. Most distributions now ship iptraf-ng instead of the original.

Does iptraf-ng require root access?#

Yes. iptraf-ng needs root privileges (or sudo) to capture raw packets from network interfaces. Running it without root access will result in permission errors.

Can I run iptraf-ng in the background?#

Yes. Use the -B flag to fork iptraf-ng into the background. Combine it with -L to specify a log file. Send SIGUSR2 to terminate the backgrounded process.

Does iptraf-ng support modern network interfaces?#

Yes. iptraf-ng supports Ethernet, FDDI, PLIP, loopback, SLIP/PPP, GRE-over-IP tunnels, 802.1ad and QinQ VLANs, and SIT tunnels. Modern interface naming (e.g., ens33, enp0s3) is fully supported.

10. Conclusion#

IPTraf (iptraf-ng) is a versatile, lightweight network monitor that fills a critical niche for Linux administrators. Its modular design, granular data, and customizable filters make it perfect for everything from quick traffic checks to deep-dive network troubleshooting.

Whether you're identifying bandwidth hogs, analyzing protocol patterns, or troubleshooting hardware errors, IPTraf provides the insights you need—without the overhead of a graphical tool. By following the best practices outlined in this guide, you can leverage IPTraf to keep your network running smoothly.