- nload draws live incoming and outgoing bandwidth per network interface as a scrolling graph in the terminal.
- Install it with
sudo apt install nloadorsudo dnf install nloadafter enabling EPEL. - Press the left and right arrow keys to switch interface. Press q to quit.
- nload shows how much traffic there is, never which process caused it. For that you need nethogs or iftop.
- It keeps no history. If you need last month's usage, that is vnstat, which you have to install before you need it.
What is nload and what does it show?
nload is a small terminal tool that draws live network throughput for one interface at a time: incoming traffic on the top half of the screen, outgoing on the bottom, updating roughly twice a second. It gives you current, average, minimum, maximum and a running total since it started.
Device eth0 [203.0.113.10] (1/2):
=========================================================
Incoming:
Curr: 2.14 MBit/s
.:||:. Avg: 1.87 MBit/s
.:||||||:. Min: 0.31 MBit/s
.::||||||::. Max: 8.92 MBit/s
:::||||||||::: Ttl: 4.21 GByte
---------------------------------------------------------
Outgoing:
Curr: 18.60 MBit/s
.:|||:. Avg: 14.22 MBit/s
.:|||||||:. Min: 1.05 MBit/s
.::|||||||||::. Max: 62.10 MBit/s
::::|||||||||:::: Ttl: 31.80 GByte| Field | Meaning | What to watch for |
|---|---|---|
| Curr | Throughput right now | A sustained figure near your port speed means saturation |
| Avg | Average since nload started | The number to quote, not Curr |
| Min | Lowest reading seen | A floor well above zero means constant background traffic |
| Max | Highest reading seen | Brief peaks are normal and rarely a problem |
| Ttl | Total transferred since nload started | Resets to zero every time you restart nload |
Ttl counts only from the moment nload started, so it is not a usage total for the day.
nload answers how much, never who
It reads counters from the kernel per interface, so it can tell you the link is busy but nothing at all about which process, connection or visitor is responsible. When the question is who, skip to the comparison further down.
How do I install nload?
# Debian / Ubuntu
sudo apt update && sudo apt install -y nload
# AlmaLinux / Rocky / CentOS Stream (nload lives in EPEL)
sudo dnf install -y epel-release
sudo dnf install -y nload
# Alpine
sudo apk add nload
# Confirm
nload --versionIt reads counters, so it needs no special privileges
nload reads /proc/net/dev, which any user can read, so it does not need sudo. iftop and nethogs do need root, because they capture packets rather than reading summary counters.
How do I use nload?
Run nload with no arguments and it picks the first active interface. On a server with several interfaces you almost always want to name the one you care about, or the numbers will describe traffic you are not interested in.
# Default interface
nload
# A specific interface
nload eth0
# Find out what your interfaces are called first
ip -brief link show
# Show in megabits rather than the default
nload -u m eth0
# Refresh every 100ms for a finer graph
nload -t 100 eth0
# Watch several interfaces, arrow keys to switch
nload eth0 eth1 wg0ip -brief link show is the quickest way to check.| Key or flag | Does |
|---|---|
| Left / right arrow | Switch to the previous or next interface |
| q or Ctrl+C | Quit |
| F2 | Options screen |
| -u m | Report in MBit/s (h for human-readable, K, M, G also accepted) |
| -t 200 | Refresh interval in milliseconds |
| -m | Multiple interfaces on one screen, no graphs |
-m is the one to use when you want a quick overview of every interface at once.
Run nload inside tmux before starting a large transfer, then detach. You can reconnect later and see the peak and average the transfer actually achieved, rather than guessing from how long it took.
When should I use iftop, nethogs or vnstat instead?
nload tells you the link is busy. The follow-up question is always which connection or which process, and nload cannot answer either. Three other tools split that job between them.
| Tool | Answers | Needs root | Keeps history |
|---|---|---|---|
| nload | How much traffic on this interface, right now | No | No |
| iftop | Which remote addresses the traffic is going to | Yes | No |
| nethogs | Which process is using the bandwidth | Yes | No |
| vnstat | How much was used yesterday, last week, last month | No | Yes |
nethogs is the one people wish they had known about sooner.
# Which remote hosts, with a running bandwidth bar per connection
sudo apt install -y iftop
sudo iftop -i eth0 -nNP
# Which process. This is usually the answer you want.
sudo apt install -y nethogs
sudo nethogs eth0
# Historical usage. Install it BEFORE you need it: it only
# records from the moment the daemon starts.
sudo apt install -y vnstat
sudo systemctl enable --now vnstat
vnstat -d # by day
vnstat -m # by month
vnstat -l # livevnstat is worth installing today
It only records traffic from the moment its daemon starts. Installing it in the middle of an incident tells you nothing about what happened before. It costs almost nothing to run, so put it on every server now and it will have the answer when you eventually need it.
What causes unexpected bandwidth on a web server?
When outbound traffic is higher than the site's visitor numbers justify, the cause is usually one of five things. Work down the list, because they are ordered by how often we see them.
- 1Crawlers and scrapers. Aggressive bots, AI training crawlers and content scrapers can outnumber human visitors several times over on a small site. They pull full pages and images, and they do not appear in analytics that rely on JavaScript.
- 2Backups leaving the server. A nightly offsite copy of a 40 GB site is 40 GB of outbound traffic on a schedule. Check the timing against your backup window before assuming an attack.
- 3Large uncompressed media. One 8 MB hero image served ten thousand times is 80 GB. Check whether images are being resized and compressed at all.
- 4A hotlinked file. Another site embedding your image or PDF directly makes you pay for their traffic. The referrer in the access log will name them.
- 5Compromise. A server sending large volumes to unfamiliar destinations, especially at night, may be relaying spam or serving files that are not yours.
sudo iftop -nNPwill show the destinations immediately.
# Top 20 user agents by request count: bots surface fast here
awk -F'"' '{print $6}' /var/log/nginx/access.log \
| sort | uniq -c | sort -rn | head -20
# Top 20 client IPs
awk '{print $1}' /var/log/nginx/access.log \
| sort | uniq -c | sort -rn | head -20
# Biggest responses by bytes sent (field 10 in the combined format)
awk '{bytes[$7] += $10} END {for (u in bytes) print bytes[u], u}' \
/var/log/nginx/access.log | sort -rn | head -20Filtering bots at the edge is cheaper than serving them
Once you can see which crawlers are responsible, the fix is to stop them reaching the application at all. On G7Cloud, ScaleShield classifies and challenges automated traffic before it costs you a PHP worker or a byte of transfer, and the dashboard shows the split between human and automated requests. See how ScaleShield works.
If the traffic turns out to be genuine and the link is simply saturated, measure the ceiling properly with a terminal speed test before you buy more bandwidth. Sustained load near the port speed is a capacity problem; brief peaks are not.
Frequently asked questions
What is nload used for?
Watching live inbound and outbound bandwidth on a Linux server's network interfaces. It draws a scrolling graph in the terminal with current, average, minimum and maximum throughput, which makes it useful for confirming whether a link is saturated during a transfer or a traffic spike.
How do I install nload on Ubuntu?
sudo apt update && sudo apt install -y nload. It is in the standard repositories on Debian and Ubuntu. On AlmaLinux, Rocky or CentOS Stream you need EPEL first: sudo dnf install -y epel-release then sudo dnf install -y nload.
Can nload show which process is using my bandwidth?
No. nload reads per-interface counters from the kernel, so it knows the total but nothing about its origin. Use nethogs for a per-process breakdown or iftop for a per-connection one. Both need root because they capture packets rather than reading counters.
How do I switch between interfaces in nload?
Press the left and right arrow keys. The header shows which interface you are on and its position, such as (1/2). To start on a specific one, name it: nload eth0. Run ip -brief link show first if you are not sure what your interfaces are called.
Does nload keep a history of bandwidth usage?
No. Its totals reset every time it starts, so it cannot tell you what happened yesterday. vnstat is the tool for that: it runs as a daemon and reports by hour, day and month, but it only records from the moment you install and enable it.
About G7Cloud Engineering
Articles written by the engineers who build and run G7Cloud: UK managed hosting and the AI Website Builder. We write about what we operate every day: containers, backups, databases, and the small-business websites that run on them.
More about G7Cloud →
