hethogs,iptraf,vnstat

三个网络工具：
nethogs 可以定位进程占用的网络带宽。
nethogs 我尝试安装在rhel 7上，但是发现epel的repo没有这个软件。只能装在ubuntu 上了。
安装很简单：

apt-get install nethogs

nethogs 这个工具很小巧好用，manual 也很短。

Options
       -d     delay for refresh rate.

       -h     display available commands usage.

       -p     sniff in promiscious mode (not recommended).

       -t     tracemode.

       -V     prints Version info.

       device(s) to monitor. By default eth0 is being used.

INTERACTIVE CONTROL
       m      cycle between display modes (kb/s, kb, b, mb)

       r      sort by 'received'

       s      sort by 'sent'

       q      quit

然后是iptraf ，iptraf 的强项在于可以看到所有端口的发包，如果是把Linux当路由器用的时候，会很好用。可以看到每个IP占用的带宽。

yum install iptraf

manual 也很简单

OPTIONS
       These options can also be supplied to the command:

       -i iface
              immediately start the IP traffic monitor on the specified interface, or all  interfaces if "-i
              all" is specified

       -g     immediately start the general interface statistics

       -d iface
              allows you to immediately start the detailed on the indicated interface (iface)

       -s iface
              allows you to immediately monitor TCP and UDP traffic on the specified interface (iface)

       -z iface
              shows packet counts by size on the specified interface

       -l iface
              start  the  LAN station monitor on the specified interface, or all LAN interfaces if "-l all" is
              specified

       -t timeout
              tells IPTraf to run the specified facility for only timeout minutes. This option is  used  only
              with one of the above parameters.

       -B     redirect  standard  output  to  /dev/null, closes standard input, and forks the program into the
              background. Can be used only with one of the facility invocation parameters  above. Send  the
              backgrounded process a USR2 signal to terminate.

       -L logfile
              allows  you to specify an alternate log file name. The default log file name is based on either
              the interface selected (detailed interface statistics, TCP/UDP service statistics, packet size
              breakdown), or the  instance of the facility (IP traffic monitor, LAN station monitor). If a
              path is not specified, the log file is placed in /var/log/iptraf

       -L logfile
              allows  you to specify an alternate log file name. The default log file name is based on either
              the interface selected (detailed interface statistics, TCP/UDP service statistics, packet size
              breakdown), or the  instance of the facility (IP traffic monitor, LAN station monitor). If a
              path is not specified, the log file is placed in /var/log/iptraf

       -f     clears all locks and counters, causing this instance of IPTraf to think it

最后一个工具是vnstat:
vnstat 的选项很多，所以这里不列出它的manual,感觉要比上两个工具要复杂一些，参数也更多。

yum install vnstat

# Show live trafic
vnstat -l
# Start monitoring the trafic
vnstat -u -i eth0
# Check your daily trafic (but you need to start
# the monitoring and gather the data before you can use it)
vnstat -d
# Monthly
vnstat -m

注意:如果有如下报错:

eth0: Not enough data available yet.

建议加一个crontab.每5分钟更新下vnstat 的数据库

*/5 * * * * /usr/bin/vnstat -u >/dev/null 2>&1