Monitor VPS Bandwidth with vnStat & iftop

June 2026 · 6 min read

Running a VPS without monitoring bandwidth and traffic can lead to unexpected overage charges or prevent you from knowing which processes consume the most bandwidth. This article will guide you through installing and using 3 essential tools: vnStat, iftop, and nethogs to view bandwidth usage by day, month, and real-time traffic per process.

Why Monitor Bandwidth on Your VPS?

Most VPS providers charge for traffic based on actual bandwidth consumed per month (e.g., 1TB/month). If you exceed your quota, you may be charged additional fees or have your speed throttled. Monitoring bandwidth is essential for three reasons:

Cost Control — Know in advance if you'll exceed your package limits
Detect Anomalies — Sudden traffic spikes may indicate DDoS attacks or malware infections
Performance Analysis — Identify which services consume the most network resources for targeted optimization

Tools We'll Install

vnStat — Records bandwidth statistics hourly, daily, monthly, and yearly (lightweight daemon operation)
iftop — Displays real-time network traffic in a top-like interface sorted by connection
nethogs — Shows real-time bandwidth usage broken down by process/application

This article focuses on Ubuntu 22.04 / Debian 12. Most commands work on CentOS/AlmaLinux as well; simply replace apt with dnf

Step 1: Install vnStat

vnStat is a passive bandwidth recording tool that reads data directly from kernel network counters. It consumes minimal system resources and runs continuously 24/7.

Install on Ubuntu/Debian

sudo apt update
sudo apt install vnstat -y

Install on CentOS/AlmaLinux

sudo dnf install epel-release -y
sudo dnf install vnstat -y

Get Started with vnStat

After installation, first check your network interface name:

ip link show

You'll see interfaces named like eth0, ens3, enp1s0, etc. Then enable the vnStat daemon:

sudo systemctl enable vnstat
sudo systemctl start vnstat
sudo systemctl status vnstat

vnStat will begin collecting data. You may need to wait 5–10 minutes before statistics appear. Try querying with these commands:

# View statistics for all interfaces
vnstat

# View hourly statistics (last 24 hours)
vnstat -h

# View daily statistics
vnstat -d

# View monthly statistics
vnstat -m

# View yearly statistics
vnstat -y

# Specify an interface (e.g., eth0)
vnstat -i eth0 -m

Sample vnStat Monthly Output

 eth0  /  monthly

       month        rx      |     tx      |    total    |   avg. rate
    ------------------------+-------------+-------------+---------------
      2026-04     12.45 GiB |   38.21 GiB |   50.66 GiB |  159.36 kbit/s
      2026-05     18.73 GiB |   51.04 GiB |   69.77 GiB |  219.52 kbit/s
      2026-06      4.12 GiB |   11.87 GiB |   15.99 GiB |  204.71 kbit/s
    ------------------------+-------------+-------------+---------------
    estimated      20.6 GiB |    59.4 GiB |       80 GiB |

The estimated row projects your total monthly usage based on current consumption rates — excellent for capacity planning.

View Live Traffic with vnStat

# Live traffic monitor, updates every 2 seconds
vnstat -l -i eth0

# Live traffic in short format
vnstat -l

Step 2: Install and Use iftop

iftop displays real-time network traffic sorted by source/destination IP and port, showing you exactly which hosts connect to your VPS and how much bandwidth they consume.

Install iftop

# Ubuntu/Debian
sudo apt install iftop -y

# CentOS/AlmaLinux
sudo dnf install iftop -y

Using iftop

# Run on primary interface (requires sudo)
sudo iftop -i eth0

# Display port numbers instead of service names
sudo iftop -i eth0 -P

# Show IP addresses instead of hostnames (faster, no DNS lookup)
sudo iftop -i eth0 -n

# Filter traffic only from/to ports 80 and 443
sudo iftop -i eth0 -f "port 80 or port 443"

Keyboard Shortcuts in iftop

p — Toggle port numbers display
n — Toggle DNS lookup (disable for speed)
s — Toggle source host display
d — Toggle destination host display
t — Change display format (2-line / 1-line / bar)
q — Exit the program

iftop requires root or sudo because it needs to open the network interface in promiscuous mode to capture packets

Step 3: Install and Use nethogs

Unlike iftop, nethogs displays bandwidth usage broken down by process, allowing you to instantly see which program (nginx, mysql, sshd, etc.) consumes the most bandwidth.

Install nethogs

# Ubuntu/Debian
sudo apt install nethogs -y

# CentOS/AlmaLinux
sudo dnf install nethogs -y

Using nethogs

# Run nethogs on primary interface
sudo nethogs eth0

# Run on all interfaces
sudo nethogs

# Update every 1 second (default)
sudo nethogs -d 1 eth0

# Display units as KB/s instead of normal KB/s
sudo nethogs -v 3 eth0

Sample nethogs Output

NetHogs version 0.8.7

    PID USER     PROGRAM                      DEV        SENT      RECEIVED
   1823 www-data /usr/sbin/nginx              eth0       45.234     182.109 KB/sec
   2041 mysql    /usr/sbin/mysqld             eth0        2.341       8.023 KB/sec
    892 root     sshd: admin@pts/0            eth0        0.123       0.456 KB/sec
      ? root     unknown TCP                             0.000       0.000 KB/sec
  TOTAL                                                 47.698     190.588 KB/sec

Keyboard Shortcuts in nethogs

m — Change units (KB/s → KB → B → MB)
r — Sort by received traffic
s — Sort by sent traffic
q — Exit the program

Step 4: Set Up Alerts When Bandwidth Approaches Quota

Create a script to send alerts when bandwidth usage exceeds your threshold, for example when you use more than 80% of your 1TB/month quota.

#!/bin/bash
# /usr/local/bin/bw-check.sh

LIMIT_GB=800          # Alert when usage exceeds 800 GB (80% of 1TB)
INTERFACE="eth0"
EMAIL="[email protected]"

# Get current monthly traffic from vnStat (in MiB)
CURRENT_MIB=$(vnstat -i $INTERFACE --oneline | awk -F';' '{print $11}' | sed 's/ MiB//')
CURRENT_GB=$(echo "scale=2; $CURRENT_MIB / 1024" | bc)

if (( $(echo "$CURRENT_GB > $LIMIT_GB" | bc -l) )); then
  echo "WARNING: Bandwidth used ${CURRENT_GB} GB, limit ${LIMIT_GB} GB" | \
    mail -s "[VPS Alert] Bandwidth Warning" $EMAIL
fi

# Make script executable
sudo chmod +x /usr/local/bin/bw-check.sh

# Add to crontab to run daily at 8:00 AM
(crontab -l 2>/dev/null; echo "0 8 * * * /usr/local/bin/bw-check.sh") | crontab -

You'll need mailutils installed first (sudo apt install mailutils -y) and an MTA or SMTP relay configured to send outbound emails

Step 5: Export Traffic Statistics with vnStat

vnStat supports exporting data as JSON for use in other monitoring systems.

# Export all data as JSON
vnstat --json

# Export specific interface
vnstat -i eth0 --json

# Export monthly data
vnstat -i eth0 --json m

# View top 10 days with highest traffic
vnstat --top10

Summary and Usage Checklist

These three tools cover bandwidth monitoring from all angles, from long-term statistics to real-time per-process analysis.

Summary of each tool's purpose

vnStat — View daily/monthly/yearly statistics and plan quotas; runs as a background daemon
iftop — View real-time traffic by IP/port; useful for detecting unusual connections
nethogs — View real-time bandwidth by process; useful for finding which application consumes bandwidth

Checklist of post-installation tasks

Install vnStat and enable the daemon with systemctl enable --now vnstat
Verify correct interface name using ip link show
Wait 24 hours then view statistics with vnstat -d and vnstat -m
Test iftop with sudo iftop -i eth0 -n to view live connections
Test nethogs with sudo nethogs eth0 to view per-process bandwidth
Set up a cron job for bandwidth alert emails
Record your VPS package bandwidth quota and compare it against vnStat's estimated total

Regular bandwidth monitoring helps you manage your VPS efficiently, reduce costs, and detect security issues promptly. Try installing these tools on your VPS today.

Verify Tools are Working Correctly

# Check vnStat daemon status
systemctl status vnstat

# View this month's statistics
vnstat -m

# View real-time traffic
vnstat -l -i eth0

# Check which processes consume most bandwidth
sudo nethogs eth0

# View current connections in real-time
sudo iftop -i eth0 -n

Tip: vnStat begins collecting data from installation — it takes 24 hours to accumulate daily stats and until month-end for complete monthly stats. Use vnstat -h to view hourly statistics in the meantime.

Common Issues & Troubleshooting

Error: "vnstat: No data available" or empty database

The vnStat daemon isn't running or wasn't enabled after installation:

# Check and start the daemon
systemctl status vnstat
systemctl enable --now vnstat

# Check which interfaces are monitored
vnstat --iflist
# Use the interface name shown here

# Wait 5-10 minutes then try again
vnstat -h

Error: iftop shows incorrect data or wrong interface

You must specify the correct interface. Check with ip link show first:

# List all interfaces
ip link show

# On some VPS providers the interface isn't eth0
sudo iftop -i ens3     # or enp1s0, ens18, etc.
sudo nethogs ens3

Error: nethogs shows "unknown TCP" for large amounts of traffic

"unknown TCP" is traffic nethogs cannot map to any process, often from TIME_WAIT connections or kernel-level traffic:

# View established connections instead
ss -tnp | head -20

# Use iftop to see which IPs have high traffic
sudo iftop -i eth0 -n -P

Error: bandwidth alert script doesn't send email

You need an MTA or SMTP relay configured, or use curl to send webhooks instead:

# Test mailutils
echo "test" | mail -s "test" [email protected]

# If that fails, use curl to send Telegram notification instead
# Edit the script to use:
curl -s -X POST "https://api.telegram.org/botTOKEN/sendMessage" \
  -d "chat_id=CHAT_ID&text=Bandwidth used ${CURRENT_GB}GB"

Error: vnStat shows different numbers than your provider

vnStat measures traffic at the OS network interface level, which may differ from provider measurements due to different network layer overhead. Treat vnStat as an approximation and keep a 10-15% buffer below your actual quota:

# View cumulative statistics
vnstat --json | python3 -c "import sys,json; d=json.load(sys.stdin); [print(m['date']['month'],m['rx']['bytes']//1073741824,'GB RX') for m in d['interfaces'][0]['traffic']['months']]"

Frequently Asked Questions

vnStat vs netdata vs Prometheus — which should I choose?

vnStat is the lightest option, perfect for simple daily/monthly bandwidth statistics without a web UI and using almost no resources. netdata has a real-time web dashboard but consumes ~100-200MB RAM — better if you need visual monitoring. Prometheus+Grafana is best for production environments requiring alerting and long-term metrics, but it's more complex.

How can I tell if high traffic comes from a DDoS or normal usage?

Use iftop to check which IPs send traffic. If one IP or subnet sends large amounts, it's likely a DDoS or scan. Normal traffic comes from diverse sources. Use grep "BLOCK" /var/log/ufw.log | awk '{print $12}' | sort | uniq -c | sort -rn | head -20 to see the top blocked IPs.

Can I set up real-time bandwidth alerts?

vnStat doesn't support real-time alerts directly, but you can create a script that polls every 5 minutes via cron: read from vnstat -l --oneline and send an alert if it exceeds your threshold. For true real-time alerts, use netdata which has built-in alerting.