How to Use bmon to Monitor Network Bandwidth on Linux

With the bmon Linux application, you can see the bandwidth usage on your network connections. However, understanding the finer details requires some detective work, so we’ve done it for you!

How bmon Works

Dynamic graphs and real-time statistics that show the activity on your various network interfaces can give you a great heads-up on your network’s performance and bandwidth consumption. This is exactly what bmon provides for you, right in a terminal window.

You can glance at the graphs now and then, just as you would the speedometer in your car. Likewise, if something on your vehicle needs to be investigated, a mechanic might hook it up to a diagnostic system and check the readouts. bmon has a similar of detailed readouts.

It has to be said, though—bmon command’s statistics can be baffling at first. For example, there are three called “Ip6 Reasm/Frag.” What’s up with that?

Nevertheless, once you’ve cracked the code, the command’s readouts are invaluable if you want a more detailed understanding of your network traffic.

We’ve put in the work for you, and even checked the source code to get to the bottom of some of these. Thankfully, everything else about bmon is reasonably simple.

Installing bmon

To install bmon on Ubuntu, use this command:

sudo apt-get install bmon

To install on Fedora, type the following:

sudo dnf install bmon

For Manjaro, the command is the following:

sudo pacman -Sy bmon

The bmon Display

Type bmon and hit Enter to start the program. The bmon display is split into several panes. The top three are labeled “Interfaces,” “RX,” and “TX.” The central pane displays the detailed statistics and graphs.

The “Interfaces” pane shows you the network interfaces with which your computer is equipped. It also shows the queueing discipline (qdisc) each network interface is using (more about these later).

The “RX” pane displays the received bits per second and packets per second for each interface and its queue. The “TX” pane shows the transmitted bits per second and packets per second for each interface and its queue.

On our computer, we only have two interfaces installed: the loopback interface (also called loopback adapter), and the wired ethernet adapter. The loopback interface is called “lo,” and the ethernet interface is called “enp0s3.”

The ethernet adapter on your machine might have a different name. If you’re using a laptop, you’ll see a wireless adapter, too, and its name will probably begin with “wl.”

bmon displays information about the network interface that’s currently selected. The selected interface is the one with a highlighted greater-than sign (>) next to it. You can press the Up and Down Arrows to move the greater-than sign and select the interface you want to monitor. We chose the ethernet adapter.

Now that we’re on an active network interface, we see some activity in the graphs and readouts. If you’re not seeing any graphs, stretch the terminal window downward.

Press the Left and Right Arrow keys to change the statistic being graphed. For some graphs, you’ll have to press H before they’ll populate; those that require this will tell you so.

To see the statistics for the network interface, stretch the terminal window until it’s tall enough to show them, and then press D to display them. If you press I (for Info), you see a small amount of additional information.

If you maximize the terminal window, it displays multiple graphs. Press Less Than (<) and Greater Than (>) to add or remove pairs of graphs. If you press G, it toggles the display of graphs on and off, altogether.

When you press the question mark (?), you see the “Quick Reference” help screen with common keystrokes.

Press the question mark (?) again to close the “Quick Reference” screen.

The Detailed Statistics

If your terminal window is tall and wide enough (stretch it out, if it isn’t), you can press “D” to toggle the detailed view on and off.

The number of columns you see depends on the width of the terminal window. In a standard 80-column terminal window, you’ll see two. The wider the window, the more columns you see. You don’t get more statistics with a wider window, though; you’ll still see the same set of figures. But the columns will be shorter.

The top entry in each column might lead you to think the one on the left shows information in bytes, while the one on the right shows information in packets. However, that’s not the case.

Each column holds a set of statistics. The name of the value, and the received (RX) and transmitted (TX) values are shown for each statistic. If any values appear as a hyphen (-), it means that statistic isn’t recorded for that direction.

Some of the stats are inward (received) or outward (transmitted) only. For example, a hyphen (-) in the transmitted column indicates that statistic is invalid for outgoing packets, and will only apply to incoming packets. The top line shows the received and transmitted traffic in bytes (on the left) and packets (on the right).

All of the other statistics are listed in alphabetical order, hopping from column to column. Several of them share the same name. We’ll explain what they all mean below. We’ve also spelled out abbreviated names. If IPv6 isn’t mentioned, that statistic refers to IPv4.

The statistics in the left column are as follows:

• Bytes: Traffic in bytes.
• Abort Error: A count of abort errors. Somewhere in the connection path between the source and the destination, a piece of software caused a connection to abort.
• Collisions: A count of collision errors. Two or more devices have tried to send a packet simultaneously. This shouldn’t be a problem in a full-duplex network.
• CRC Errors: A count of cyclic redundancy check errors.
• Errors: The total count of errors.
• Frame Error: A count of frame errors. A frame is a network container for a packet. An error means malformed frames were detected.
• ICMPv6: The number of Internet Control Message Protocol v6 traffic packets.
• ICMPv6 Errors: A count of ICMP v6 errors.
• Ip6 Broadcast: A count of IPv6 Broadcasts, which are sent to all devices on the network.
• Ip6 CE Packets: CE stands for “customer edge.” This usually applies to routers. They connect with the provider edge (PE) of the connectivity service to which the customer subscribes.
• Ip6 Delivers: The count of incoming IPv6 packets.
• Ip6 ECT(1) Packets: An Explicit Congestion Notification (ECN) allows either end of a network connection to alert the other of impending congestion. Packets are marked with a flag that serves as the warning. The receiving end can reduce transmission rates to try to avoid congestion and possible packet loss. ECN-Capable Transport (ECT) packets are marked with a flag to indicate they’re being delivered via an ECN Capable Transport. This allows intermediate routers to react accordingly. Type 1 ECN packets tell the receiving end to enable ECN and add it to outgoing transmissions.
• Ip6 Header Errors: The count of packets with errors in the IPv6 Header.
• Ip6 Multicast packets: The count of IPv6 Multicast (a form of broadcast) packets.
• Ip6 Non-ECT Packets: The count of IPv6 packets not flagged as ECT(1).
• Ip6 Reassembly/Fragment OK: The count of IPv6 packets that were fragmented due to size and successfully reassembled upon receipt.
• Ip6 Reassembly Timeouts: The count of IPv6 packets that were fragmented due to size, but failed to be reassembled upon receipt because of timeouts.
• Ip6 Truncated Packets: The count of truncated packets. When an IPv6 packet is transmitted, it can be flagged as a candidate for truncation. If any intermediate routers can’t handle the packet because it exceeds the maximum transmission unit (MTU), the router truncates the packet, marks it as such, and forwards it on to the destination. When it’s received, the far end can send an ICMP packet back to the source, telling it to update its MTU estimate to shorten its packets.
• Ip6 Discards: The count of discarded IPv6 packets. If any devices between the source and destination weren’t set up correctly, and their IPv6 settings don’t work, they won’t handle IPv6 traffic; it will be discarded.
• Ip6 Packets: The total count of all types of IPv6 packets.
• Missed Error: The count of packets missing from a transmission. Packets are numbered so the original message can be recreated. If any are missing, they’re absence is conspicuous.
• No Handler: The count of packets for which no protocol handler was found.
• Window Error: The count of window errors. The window of a packet is the number of octets in the header. If this holds an abnormal number, the header can’t be interpreted.

The statistics in the right column are as follows:

• Packets: Traffic in packets.
• Carrier Errors: A count of carrier errors. These occur if a problem arises with the modulation of a signal. This could indicate either a duplex mismatch between networking equipment or physical damage to a cable, socket, or connector.
• Compressed: The number of compressed packets.
• Dropped: The number of packets dropped, which, as a result, failed to reach their destination (possibly due to congestion).
• FIFO Errors: The count of first in, first out (FIFO) buffer errors. The network interface transmission buffer is overrunning because it isn’t being emptied fast enough.
• Heartbeat Errors: Hardware or software might utilize a regular signal to show they’re operating correctly or to allow synchronization. The number here is how many “heartbeats” have been lost.
• ICMPv6 Checksum Errors: The count of Internet Control Message Protocol v6 message checksum errors.
• Ip6 Address Errors: The count of errors due to bad IPv6 addresses
• Ip6 Broadcast Packets: The count of IPv6 Broadcast packets.
• Ip6 Checksum Errors: The count of IPv6 checksum errors. ICMP and User Datagram Protocol (UDP) packets in IPv6 use checksums, but regular IPv6 IP packets do not.
• Ip6 ECT(0) Packets: These are treated the same as ECT(1) packets.
• Ip6 Forwarded: The count of IPv6 packets unicast forwarding delivered. Unicast hops the packets from source to destination through a chain of intermediary routers and forwarders.
• Ip6 Multicasts: The number of IPv6 packets multicast forwarding delivered. Multicast sends the packets to a group of destinations simultaneously (which is how Wi-Fi works).
• Ip6 No Route: The count of no route errors. This means the destination is unreachable because a route to the far end can’t be calculated
• Ip6 Reassembly/Fragment Failures: The count of IPv6 packets that were fragmented due to size, and failed to be reassembled upon receipt.
• Ip6 Reassembly/Fragment Requests: The count of IPv6 packets that were fragmented due to size, and had to be reassembled upon receipt.
• Ip6 Too Big Errors: The number of ICMP “too big” messages received, indicating that IPv6 packets were sent that were larger than the maximum transmission unit.
• Ip6 Unknown Protocol Errors: The count of packets received using an unknown protocol.
• Ip6 Octets: The volume of octets received and transmitted. IPv6 has a header of 40 octets (320 bits, 8 bits per octet), and a minimum packet size of 1,280 octets (10,240 bits).
• Length Error: The number of packets arriving with a length value in the header that’s shorter than the minimum possible packet length.
• Multicast: A count of multicast broadcasts.
• Over Errors: A count of over errors. Either the receive buffer has overflowed, or packets have arrived with a frame value larger than what is supported, so they can’t be accepted.

The Additional Information

If you press I (as in “Info”), it toggles the additional information panes. If additional information doesn’t appear, the window isn’t big enough. You can press D to turn off the detailed statistics, G to turn off the graphs, or you can stretch the window.

The additional information is as follows:

• MTU: The maximum transmission unit.
• Operstate: The operational state of the network interface.
• Address: The media access control (MAC) address of the network interface.
• Mode: This is usually set to default, but you could see tunnel, beet, or ro.  The first three relate to IP security (IPSec). The default setting is usually transport mode, in which the payload is encrypted. Client-to-site virtual private networks (VPNs) typically use this. Site-to-site VPNs typically use tunnel mode, in which the entire packet is encrypted. In a Bound End-to-End Tunnel (beet) mode, a tunnel is created between two devices with fixed, hidden, IP addresses, and other, visible IP addresses. The ro mode is a routing optimization method for mobile IPv6.
• Family: The network protocol family that is in use.
• Qdisc: Queuing discipline. This can be set to red (Random Early Detection), codel (Controlled Delay), or fq_codel (Fair Queueing with Controlled Delay).
• Flags: These indicators show the capabilities of a network connection. Our connection can use  broadcast and  multicast transmissions, and the interface is Up (operational and connected).
• IfIndex: The Interface Index is a unique, identifying number associated with a network interface.
• Broadcast: The broadcast MAC address. Sending to this address broadcasts received packets to all devices.
• TXQlen: The transmission queue size (capacity).
• Alias: An IP alias gives a physical network connection multiple IP addresses. It can then give access to different subnets via one network interface card. There are no aliases in use on our test computer.

bmon is a bit of a funny creature—neither fish, nor fowl, in some ways. The graphs have a primitive charm and give you a good indication of what’s going on.

However, given the limitations of being rendered in ASCII, they can’t really be expected to be super-accurate. An occasional glance, though, can tell you if the connection is maxed out, mysteriously devoid of traffic, or somewhere in-between.

The detailed statistics, on the other hand, are just that: detailed and granular. Coupled with the somewhat casual approach in their labeling, it makes them even more difficult to decipher.

Hopefully, the descriptions above will make bmon a little more approachable. It really is a useful, lightweight tool with which you can monitor the health of network traffic and the consumption of bandwidth.