Jul 112013

On server it’s useful to monitor, and collect, data about the use of your bandwidth, in the past I’ve wrote an article about “Monitor your bandwidth from the Linux shell” and I’ve also presented 4 useful tools that you can use to have a real time monitoring of the bandwidth:

IPTState : This software is a top-like interface to your netfilter connection-tracking table. Using iptstate you interactively watch where traffic crossing your netfilter/iptables firewall is going, sort by various criteria, limit the view by various criteria. But it doesn’t stop there: as of version 2.2.0 you can even delete states from the table!

pktstat displays a real-time list of active connections seen on a network interface, and how much bandwidth is being used. Partially decodes HTTP and FTP protocols to show what filename is being transferred. X11 application names are also shown.

NetHogs is a small ‘net top’ tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded. If there’s suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this. This makes it easy to indentify programs that have gone wild and are suddenly taking up your bandwidth.

IPTraf is a console-based network statistics utility for Linux. It gathers a variety of figures such as TCP connection packet and byte counts, interface statistics and activity indicators, TCP/UDP traffic breakdowns, and LAN station packet and byte counts.

They are all good I suggest to read my old articles to have a small introduction about them, today I want to show you vnstat, this small program has something more than the others, it can show real time statistics, but the feature that this small program shines it’s its ability to collect data over a long period of time.

vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won’t actually be sniffing any traffic and also ensures light use of system resources. In Linux at least a 2.2 series kernel is required, that should means that everyone should be able to use this small program.

The program is open source/GPL and can be used either as root or as a single user.


I’ve done my tests on a Debian server, for this distribution you can install the package available from the main repository simply with the command (as root):

apt-get install vnstat


A package for this software should be present in all the repository of the main distributions, so you can probably install it with your package manager (pacman, yaourt, emerge, yum).

First setup

During the first run you have to introduce every interface that needs to be logged to vnStat. For example for a wired interface you have to use the command:

# vnstat -u -i eth0

Or a wireless interface:

# vnstat -u -i wlan0

When introducing an interface for the first time there will be an error message saying ‘unable to read database’. If this message is followed by an info message saying ‘a new database has been created’ the interface is successfully introduced. If this is not the case check that the specified interface is valid.

To see all the interfaces of your Linux system you can use the command

 ip link show

Note: I’ve tested this also on Ubuntu and at the end of the installation of vnstat I’ve got the message:

 * Starting vnStat daemon vnstatd                                                                                                                                           
Zero database found, adding available interfaces...
"eth0" added, 100 Mbit bandwidth limit.
"wlan0" added, 100 Mbit bandwidth limit.
-> 2 interfaces added. Limits can be modified using the configuration file.

So if you see something like that you can skip the initialization of the interfaces and setting up an updating method.

Updating method

After introducing the interface(s) set one of the update methods.
Warning: Only use one of the methods, do not use them at the same time!

The first method is using Cron.Create /etc/cron.d/vnstat with the contents:

0-55/5 * * * * if [ -x /usr/bin/vnstat ] && [ `ls
 /var/lib/vnstat/ | wc -l` -ge 1 ]; then /usr/bin/vnstat -u; fi

This assumes vnStat is installed in /usr/ and also assumes that /etc/cron.d is a location for system-run cron jobs (which is the default for most Linux distributions).

The second way is using vnstatd a program that collect all the information and that is run as daemon, on debian you can start it with

#/etc/init.d/vnstat start

If you use systemd you have to run the command:

# systemctl start vnstat.service

Basic usage

The basic syntax it’s vnstat -i interfacename, on a system where you have just installed it, you should see something like this:

[email protected]:# vnstat -i venet0
Database updated: Sat Jul 6 08:48:26 2013
venet0 since 07/06/13
rx: 16 KiB tx: 26 KiB total: 42 KiB
rx | tx | total | avg. rate
Jul '13 16 KiB | 26 KiB | 42 KiB | 0.00 kbit/s
estimated -- | -- | -- |
rx | tx | total | avg. rate
today 16 KiB | 26 KiB | 42 KiB | 0.01 kbit/s
estimated -- | -- | -- |

Not so interesting perhaps ?
Well, when you have vnstat running for some time you get a LOT more information

$ vnstat -i eth1
Database updated: Sat Aug  1 22:50:01 2009
   eth1 since 11/20/08
          rx:  3.32 TiB      tx:  2.81 TiB     total:  6.13 TiB
                     rx      |     tx      |    total    |   avg. rate
       Jul '09    609.40 GiB |  282.21 GiB |  891.61 GiB |    2.79 Mbit/s
       Aug '09     16.95 GiB |   10.46 GiB |   27.40 GiB |    2.80 Mbit/s
     estimated    552.14 GiB |  340.70 GiB |  892.83 GiB |
                     rx      |     tx      |    total    |   avg. rate
     yesterday     19.19 GiB |    8.63 GiB |   27.82 GiB |    2.70 Mbit/s
         today     16.95 GiB |   10.46 GiB |   27.40 GiB |    2.80 Mbit/s
     estimated     17.81 GiB |   10.99 GiB |   28.80 GiB |

As you can see you have a small report that shows the total usage of bandwidth in real time (the first block) of this month and the previous, and the total bandwidth usage of today and yesterday, this is much more interesting for sure.

With the -h option you can get an hourly report of the last 24H.

[email protected]:# vnstat -h -i eth1
eth1                                                                     21:25
  ^           r
  |           r
  |           r                                            r
  |        r  r                                            r
  |      t r  r                                            r            t
  |     rt r  r                                            r  r      t  t
  |     rt r  r                                            r  r      t  t
  |     rt r  r         t                      r           r  r      t  t
  |     rt r  rt        t                   r  r        r  rt rt  t rt rt  t
  |  rt rt rt rt rt r  rt r              r  r  r  r  rt rt rt rt rt rt rt  t
  |  22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21

 h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)      h  rx (KiB)   tx (KiB)
22    250,801    205,825    06    100,529     49,054    14    205,356    157,877
23    705,144    885,844    07     52,806     44,130    15    258,228    226,265
00    928,792    224,789    08     52,298     45,230    16  1,028,043    343,843
01  1,271,180    292,260    09     70,396     61,719    17    755,804    293,309
02    212,296    186,481    10    155,502     72,451    18    235,691    284,886
03    165,931     91,943    11    266,673     92,497    19    275,554    658,386
04    150,997    437,071    12    392,244    122,185    20    307,819    850,813
05    180,170     56,391    13    133,829    120,555    21    117,474    292,787

Or if you just want to see the live stats you can use the -l option, statistics will be shown after interruption if the runtime was more than 10 seconds.

[email protected]:# vnstat -l -i eth0
Monitoring eth0...    (press CTRL-C to stop)

   rx:        0 kbit/s     1 p/s          tx:        4 kbit/s     2 p/s

 eth0  /  traffic statistics

                           rx         |       tx
  bytes                       21 KiB  |          36 KiB
          max              60 kbit/s  |       72 kbit/s
      average            3.36 kbit/s  |     5.76 kbit/s
          min               0 kbit/s  |        0 kbit/s
  packets                        262  |             272
          max                 94 p/s  |          94 p/s
      average                  5 p/s  |           5 p/s
          min                  0 p/s  |           0 p/s
  time                    50 seconds

Graphical output

In the latest releases it’s present a new option to generate images.

You make the images with the command vnstati. From the link:


The purpose of vnstati is to provide image output support for statistics collected using vnstat. The image file format is limited to png. All basic outputs of vnStat are supported excluding live traffic features. The image can be outputted either to a file or to standard output.


vnstati -s -i eth0 -o /tmp/vnstat.png

Output traffic summary for interface eth0 to file /tmp/vnstat.png.

vnstati -vs -i eth0+eth1+eth2 -o /tmp/vnstat.png

Output traffic summary with hourly data under the normal summary for a merge of interfaces eth0, eth1 and eth2 to file /tmp/vnstat.png.

This is an example of the images this command will produce:


Or as alternative you can use a php frontend: vnstat PHP frontend, the script requires a working PHP setup with GD image libraries. Also vnStat must be properly installed and collecting data.


Popular Posts:

Flattr this!

  3 Responses to “Monitor your Bandwidth on Linux with vnstat”

  1. Thank you Riccardo Capecchi for writing articles on CLI applications. Modern GUIs really have made me appreciate the visual simplicity of CLI apps while being direct and to the point.

    I am using your articles to collect a list of CLI apps. I am writing/supporting a CLI app menu project because there is nothing to help newbies to know what CLI apps are out there. My project is currently at https://raw.github.com/rdchin/CLI-app-menu/stable/cli-app-menu.sh.

    Keep writing and thanks!

  2. I modified vnstat program to allow for adding initial value to the counter so that you can add the month’s usage prior to starting vnstatd in order to match with your ISP data counter. If anyone is interested let me know.

  3. Is there anyway to differentiate traffic based on destination IP address?
    For example, running vnstat on a server in your LAN. How would you differentiate WAN traffic when using eth0 for both purposes.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>