How to Track Real-Time Network Usage on Linux with nload

The nload utility displays current incoming and outgoing traffic for network interfaces. It can help investigate a busy connection, but it does not identify which process or website generated the traffic.

Install a supported package

On Debian or Ubuntu servers you administer:

sudo apt update
sudo apt install nload

On Fedora or another supported RPM-based system where the package is available:

sudo dnf install nload

Some RHEL-family systems require an approved extra repository. Check its support and prerequisites rather than copying an old CentOS repository command.

Select an interface

List interface names:

ip -brief link

Run nload to browse available interfaces, or name the actual interface:

nload eth0

Replace eth0 if your server uses another name. Use arrow keys or Tab to move between displays, and q or Ctrl+C to quit.

Adjust the display

To show multiple interfaces without graphs:

nload -m

To use a 400-second averaging window and a 600-millisecond refresh interval:

nload -a 400 -t 600

Interpret the readings

Check the displayed units when comparing a transfer rate with connection capacity. Incoming and outgoing totals refer to interface counters, not necessarily your provider’s billing period.

Use other monitoring tools for process attribution or retained history. This display alone does not prove that traffic is malicious.