Linux Tips

How to Monitor Network Interface Traffic in Linux with sar

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #78:

Question: Which network interface is being overloaded?

Try: sar -n DEV 1 5

Info: sar -n DEV displays real-time network interface statistics. The 1 5 arguments sample network activity every 1 second for 5 samples, showing throughput such as rxkB/s and txkB/s, along with packet rates.

Examples:

  • $ sar -n TCP 1 10  # Monitor TCP connection statistics
  • $ sar -n SOCK 1  # Track active socket usage
  • $ vnstat -l -i eth0  # Monitor live traffic on eth0

Note: Install sar with sudo apt install sysstat. Enable persistent statistics in /etc/default/sysstat. Use -u for CPU, -r for memory, and -d for disk statistics when performing broader system health checks.




LinuxTeck.com 
linuxteck@ubuntu:~$ sar -n DEV 1 5
Linux 6.8.0-generic (linuxteck-server)    10/02/2026    _x86_64_    (8 CPU)

10:23:45 AM    IFACE    rxpck/s    txpck/s    rxkB/s    txkB/s
10:23:46 AM    eth0     4567.00    2345.00    3456.78   1234.56
10:23:46 AM    wlan0    23.00      15.00      12.34     8.90

Average:        IFACE    rxpck/s    txpck/s    rxkB/s    txkB/s
Average:        eth0     4523.40    2334.80    3423.45   1223.67
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #77: Git Diff Between Main and Feature Branch NEXT ARTICLE Quick Linux Tip #79: How to Set 644 for Files and 755 for Directories in Linux
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.