How to View Network Connections in Linux with IFTOP

0

There are a myriad of network utilities in both the Windows and Linux world.  If you are working with a Linux distribution and you are needing to view network connections being made to and from your Linux server, there is perhaps not a better command line tool available for viewing current network connections than IFTOP.  Iftop is an extremely lightweight application that provides a powerful set of functionality for truly seeing network activity and finding specific connections being made to any interface on your Linux server.  Let’s take a quick look at how to view network connections in Linux with IFTOP including installing IFTOP and the various switches that provide powerful functionality to the utility.

Installing IFTOP Network Utility

As a reference architecture, I am using an Ubuntu 16.04 LTS server with a simple installation.  This server is actually a VM that I have built utilizing as a Chef Server in my home lab and was easily accessible for me to use as a reference for using IFTOP and the various ins and outs.  To install IFTOP, it is as simple as the following command in Ubuntu:

Installing-IFTOP-in-Ubuntu-Server-16.04-LTS How to View Network Connections in Linux with IFTOP

Installing IFTOP in Ubuntu Server 16.04 LTS

After a couple of seconds of install time, the IFTOP utility is installed in Ubuntu Server.  You can easily see the various command line switches by issuing the command:

This will yield the following by way of the command line, giving us a good idea of some of the neat things we can do with IFTOP and gathering information about network connecting in and out of Linux.

How to View Network Connections in Linux with IFTOP

Let’s start out with a few interesting queries we can do with IFTOP to view traffic in and out of Linux.

  • To view only traffic going from your local machine to 8.8.8.8 over eth0, you could run:
    iftop -i eth0  -f  “dst 8.8.8.8”
  • to see only ssh traffic over eth0:
    iftop  -i  eth0   -f    “dst port 22”
  • To filter for source port traffic
    iftop  -i  eth0   -f    “src port 22”
Viewing-SSH-connections-to-a-Linux-server-with-IFTOP How to View Network Connections in Linux with IFTOP

Viewing SSH connections to a Linux server with IFTOP

  • To view a particular IP address in question
    iftop -i eth0 -n -P -f ‘ip src 10.1.149.17’
Viewing-connections-coming-from-a-specific-IP-Address-with-IFTOP How to View Network Connections in Linux with IFTOP

Viewing connections coming from a specific IP Address with IFTOP

Thoughts

If you are troubleshooting network connections to or from a specific host or want to see what ports are currently active, or which direction certain traffic is flowing, this can be difficult by regular network utilities in Linux trying to find this information.  However, with IFTOP utility it makes seeing and visualizing from the command line “GUI” how network traffic is flowing, very easy and straightforward.  There have been numerous times when I have been troubleshooting a NAT issue in particular with a Linux router where using IFTOP was invaluable in figuring out the issue.  If you haven’t heard about IFTOP before, pull out the Linux commandline, install the utility, and play around with the various features and functions that IFTOP provides.