Linux下检测网卡流量的两款软件:nload iftop

缺乏、安全感 2022-08-13 11:41 206阅读 0赞

原贴:http://doc.linuxpk.com/80529.html

Linux下检测网卡流量的两款软件，  
其一是：[nload][]，  
另外一个就是：[iftop][]

这两个软件的安装方法都很简单，从以上网址下载下来后，  
安装nload：

1.  ./configure --prefix=/usr/local/nload && make && make install

安装iftop：

1.  ./configure --prefix=/usr/local/iftop && make && make install

这样就好了，然后你就可以执行如下命令来监测网卡流量了：  
nload是：

1.  \#/usr/local/nload/bin/nload

iftop是：

1.  \#/usr/local/iftop/sbin/iftop

一般的服务器都会有内网和外网两块网卡，nload默认的是eth0网卡，如果你想监测eth1网卡的流量：  
那么

1.  \#/usr/local/nload/bin/nload eth1

这样即可。  
nload默认分为上下两块：上半部分是：Incoming也就是进入网卡的流量，下半部分是：Outgoing，也就是从这块网卡出去的流量，每部分都 有当前流量（Curr），平均流量（Avg），最小流量（Min），最大流量（Max），总和流量（Ttl）这几个部分，看起来还是蛮直观的。  
另外，你也可以自己定义流量数值显示的单位 \#/usr/local/nload/bin/nload –help  
就可以看到具体的相关参数了。

下面再来说下iftop  
iftop默认也是监测eth0网卡的流量，如果你想要监测eth1这块网卡，则需要加-i+eth1来指定网卡，也就是这样：

1.  \#/usr/local/iftop/sbin/iftop -i eth1

iftop显示的也很直观，样子和操作有些像top命令。  
在iftop的图表中最后有三列流量的数值显示，  
其中第一列的意思是：在之前两秒钟的平均流量  
第二列的意思是：在之前10秒钟一共的流量  
最后一列的意思是：在之前的40秒钟五分之一的流量数值  
大约是这个意思，具体的限于本人英文不好，下面贴出man page的英文：  
**Display：**  
When running, iftop uses the whole screen to display network usage. At the top of the display is a logarithmic scale for the bar graph which gives a visual indication of traffic.

The main part of the display lists, for each pair of hosts, the rate at which data has been sent and received over the preceding 2, 10 and 40 second intervals. The direction of data flow is indicated by arrows, <= and =>. For instance,

1.  foo.example.com  =>  bar.example.com      1Kb  500b   100b
2.                   <=                       2Mb   2Mb   2Mb

shows, on the first line, traffic from [foo.example.com][] to [bar.example.com][]; in the preceding 2 seconds, this averaged 1Kbit/s, around half that amount over the preceding 10s, and a fifth of that over the whole of the last 40s. During each of those intervals, the data sent in the other direction was about 2Mbit/s. On the actual display, part of each line is inverted to give a visual indication of the 10s average of traffic. You might expect to see something like this where host foo is making repeated HTTP requests to bar, which is sending data back which saturates a 2Mbit/s link.  
By default, the pairs of hosts responsible for the most traffic (10 second average) are displayed at the top of the list.

At the bottom of the display, various totals are shown, including peak traffic over the last 40s, total traffic transferred (after filtering), and total transfer rates averaged over 2s, 10s and 40s.

要监测网卡流量，基本以上的dd就够用了吧？

[nload]: http://www.roland-riegel.de/nload/index.html
[iftop]: http://www.ex-parrot.com/%7Epdw/iftop/
[foo.example.com]: http://foo.example.com/
[bar.example.com]: http://bar.example.com/