iftop

Oct 2019
Iftop measures the data flowing through individual socket connections, and it works in a manner that is different from Nload. Iftop uses the pcap library to capture the packets moving in and out of the network adapter, and then sums up the size and count to find the total bandwidth under use.
Although iftop reports the bandwidth used by individual connections, it cannot report the process name/id involved in the particular socket connection. But being based on the pcap library, iftop is able to filter the traffic and report bandwidth usage over selected host connections as specified by the filter.

Install iftop on CentOS/RHEL/Red Hat/Fedora Linux

yum install iftop -y

Using iftop

From the command line, simply enter:

iftop -n

The -n option prevents iftop from resolving ip addresses to hostname, which causes additional network traffic of its own.
By default, iftop runs on the first listed interface, you can specify the interface you wish to monitor by using the following:

iftop -i eth3 -n

The above command will run iftop and monitor traffic on interface eth3. See below for an example iftop output.

12.5Kb 25.0Kb 37.5Kb 50.0Kb 62.5Kb
└───────────────────┴───────────────────┴───────────────────┴───────────────────┴────────────────────
eri-4e-962953 => 10.14.2.54 4.99Kb 17.5Kb 17.5Kb
<= 2.97Kb 3.15Kb 3.15Kb
eri-4e-962953 => 10.43.30.13 2.46Kb 3.65Kb 3.65Kb
<= 4.12Kb 5.52Kb 5.52Kb
eri-4e-962953 => 10.43.30.12 1.89Kb 2.08Kb 2.08Kb
<= 3.18Kb 1.87Kb 1.87Kb
eri-4e-962953 => 10.43.30.1 0b 1.73Kb 1.73Kb
<= 0b 1.37Kb 1.37Kb
eri-4e-962953 => ttvadc02.tandbergtv.com 0b 0.99Kb 0.99Kb
<= 0b 1.29Kb 1.29Kb
255.255.255.255 => 0.0.0.0 0b 0b 0b
<= 0b 922b 922b
─────────────────────────────────────────────────────────────────────────────────────────────────────
TX: cum: 32.4KB peak: 57.6Kb rates: 9.34Kb 26.0Kb 26.0Kb
RX: 17.6KB 23.5Kb 10.3Kb 14.1Kb 14.1Kb
TOTAL: 50.1KB 81.1Kb 19.6Kb 40.0Kb 40.0Kb