VNSTAT – Console-based network traffic monitor

Sponsored Link
vnStat is a console-based network traffic monitor for Linux and BSD that keeps a log of network traffic for the selected interface(s). It uses the network interface statistics provided by the kernel as information source. This means that vnStat won't actually be sniffing any traffic and also ensures light use of system resources.

Vnstat Features

quick and simple to install and get running
gathered statistics persists through system reboots
can monitor multiple interfaces at the same time
several output options
summary, hourly, daily, monthly, weekly, top 10 days
optional png image output (using libgd)
months can be configured to follow billing period
light, minimal resource usage
same low cpu usage regardless of traffic
can be used without root permissions
online color configuration editor

Install vnstat on Ubuntu

Open the terminal and run the following command

sudo apt-get install vnstat

Vnstat syntax

vnstat [options]

Vnstat Examples


Display traffic summary for the default interface or multiple interfaces when more than one is monitored.

vnstat -i eth0+eth1+eth3

Display traffic summary for a merge of interfaces eth0, eth1 and eth3.

vnstat -i eth2 --xml

Output all information about interface eth2 in xml format.

vnstat --json

Output all information of all monitored interfaces in json format.

vnstat -u -i eth0

Force a database update for interface eth0 or create the database if it doesn't exist. This is usually the first command used after a fresh install if the daemon isn't used.

vnstat -u -i eth0 --nick local

Give interface eth0 the nickname "local". That information will be later later visible as a label when eth0 is queried. The database will also be updated when this command is executed or created if the database doesn't exist.

vnstat -i eth2 --delete

Delete database of interface eth2 and stop monitoring it.


Updates needs to be executed at least as often as it is possible for the interface to generate enough traffic to overflow the kernel interface traffic counter. Otherwise, it is possible that some traffic won't be seen. This isn't an issue for 64-bit kernels but at least one update every hour is always required in order to provide proper input. With 32-bit kernels, the maximum time between two updates depends on how fast the interface can transfer 4 GiB. Calculated theoretical times are:

10 Mbit: 54 minutes
100 Mbit: 5 minutes
1000 Mbit: 30 seconds
However, for 1000 Mbit interfaces updating once every minute is usually a usable solution if faster updates can't be used.

Estimated traffic values are likely to be somewhat inaccurate if daily traffic is low because only the MiB counter is used to calculate the estimate.

Virtual and aliased interfaces cannot be monitored because the kernel doesn't provide traffic information for that type of interfaces. Such interfaces are usually named eth0:0, eth0:1, eth0:2 etc. where eth0 is the actual interface being aliased.

Using long date output formats may cause misalignment in shown columns if the length of the date exceeds the fixed size allocation.

Check man Page for more options.

Sponsored Link

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *