Teadmistebaas

Understanding your VPS's network traffic patterns — historical usage trends and real-time connection activity — helps with bandwidth planning, troubleshooting, and spotting unusual activity. This guide covers two complementary tools.

vnStat: Historical Bandwidth Tracking

vnStat runs continuously in the background, recording bandwidth usage over time — useful for understanding trends, monthly usage against a data cap, or identifying when a spike occurred.

Step 1 — Install vnStat

sudo apt install vnstat -y

Step 2 — Enable and Start It

sudo systemctl enable --now vnstat

Step 3 — View Traffic Statistics

vnstat

Shows daily, monthly, and all-time totals for the primary network interface.

Viewing Hourly Breakdown

vnstat -h

Viewing a Live Traffic Rate

vnstat -l

Monitoring a Specific Interface

vnstat -i eth0

iftop: Real-Time Connection-Level Monitoring

While vnStat shows historical totals, iftop shows exactly which connections are consuming bandwidth right now — essential for diagnosing an active traffic spike.

Step 1 — Install iftop

sudo apt install iftop -y

Step 2 — Run iftop

sudo iftop

Displays a live, updating list of active connections sorted by bandwidth usage, showing source, destination, and current transfer rate for each.

Running iftop on a Specific Interface

sudo iftop -i eth0

Displaying Port Numbers (Useful for Identifying the Service)

sudo iftop -P

Using iftop to Diagnose an Unexpected Traffic Spike

1. Run iftop during the spike
2. Identify the connection(s) consuming the most bandwidth
3. Cross-reference the source/destination IP and port with your running services to identify the cause
4. If the traffic is unexpected/unauthorized, investigate further as a potential security incident

Setting Up Alerts Based on vnStat Data

sudo nano /usr/local/bin/check-bandwidth.sh

#!/bin/bash
USAGE=$(vnstat --oneline | cut -d';' -f11)
LIMIT_GB=900

# Parse and compare USAGE against LIMIT_GB, alert if approaching a data cap
# (exact parsing depends on vnstat output format/units)

Useful if your VPS plan has a bandwidth allowance and you want proactive warning before approaching it.

Combining Both Tools Effectively

Common Errors

vnStat shows no data — verify the service has been running for some time; vnStat needs to actively observe traffic to build up historical data, it doesn't retroactively calculate past usage.

iftop shows nothing — verify you're monitoring the correct interface (check with ip a first) and that there's actually active traffic during your observation window.

Continue Reading

• How to Diagnose and Fix High Network Latency
• How to Secure a VPS Against DDoS Attacks
• How to Set Up Prometheus and Grafana for VPS Monitoring

Browse more articles in Advanced Networking & VPN.