How to monitor network traffic with Linux and vnStat

Monitoring traffic on a Linux server network interface is easy with vnStat and vnStat-PHP.

Image: Jack Wallen

If you're a network or a Linux admin, sometimes you need to monitor network traffic coming and going to/from your Linux servers. As there are a number of tools with which to handle this task, where do you turn? One very handy tool is vnStat. With vnStat you get a console-based network traffic monitor that is capable of monitoring and logging traffic on selected interfaces for specific dates, times, and intervals. Along with vnStat, comes a PHP script that allows you to view network traffic of your configured interface via a web-based interface.

I want to show you how to install and use both vnStat and vnStat-PHP on Linux. I'll demonstrate on Ubuntu Server 18.04, but the tool is available for most distributions.

What you'll need

The only things you'll need is a working instance of Linux and a user account with sudo privileges. With those things at the ready, let's install. For the web-based interface, you will need both Apache and PHP installed and running. I will assume you have all of this at the ready.

SEE: Quick glossary: Software-defined networking (Tech Pro Research)


As vnStat is available in the standard repositories, the installation is quick and easy. Open a terminal window and issue the following command:

sudo apt-get install vnstat

Once the installation completes, you're ready to start.


The first thing to do is find the name of the network interface you want to monitor. Issue the command ifconfig. You should see a listing of your network interfaces and their names (Figure A).

Figure A

Figure A

A listing of network interfaces.

The interface I will use is enp0s3.

The next step is to configure vnStat so it knows which interface to monitor. To do this, run the command:

sudo nano /etc/vnstat.conf

Within this file, you'll want to change the monitored interface in the line:

Interface "eth0"

Change eth0 to the interface you want to be monitored. Save and close that file.

Starting vnStat

Next we have to make sure vnstat is running. From the terminal window, issue the command:

sudo systemctl status vnstat

You should see that vnStat is running and listening to our configured interface (Figure B).

Figure B

Figure B

The service is running and listening to the correct interface.

If vnStat doesn't show up as running, start and enable it with the commands:

sudo systemctl start vnstat
sudo systemctl enable vnstat


At this point, you can issue the command:

vnstat -i enp0s3

The output should show you the incoming/outgoing traffic totals for the interface (Figure C). If you see none, wait a few minutes and try again.

Figure C

Figure C

Traffic is being monitored.

Web Interface

Let's make this even easier, and install the web interface. Back at the terminal window, download the necessary file with the command:


Unpack and move the file with the commands:

tar xvzf vnstat_php_frontend-1.5.1.tar.gz
sudo mv vnstat_php_frontend-1.5.1 /var/www/html/vnstat

Change into the newly moved directory with the command cd /var/www/html/vnstat. Open the configuration file for editing with the command sudo nano config.php. Within that file, you'll want to make the following changes:

language = 'en';
iface_list = array('eth1', 'sixxs');
iface_title['eth1'] = 'Public Interface';

Change the language to suit your needs and both instances of eth1 to the interface you want to monitor. Save and close that file.

You should now be able to point your web browser to http://SERVER_IP/vnstat, and see the current status of the interface vnstat is monitoring (Figure D).

Figure D

Figure D

The vnStat-PHP web interface reporting traffic.

Easy network traffic monitoring

If you need to monitor incoming and outgoing traffic on a network interface connect to a Linux server, using vnStat and vnStat-PHP is a one-two punch that makes the process incredibly easy. Give it a try, and see if it doesn't become your go-to for network traffic monitoring on your Linux servers.

Also See

By Jack Wallen

Jack Wallen is an award-winning writer for TechRepublic, The New Stack, and Linux New Media. He's covered a variety of topics for over twenty years and is an avid promoter of open source. For more news about Jack Wallen, visit his website jackwallen....