How to Use bmon to Monitor Network Bandwidth on Linux

A stylized terminal prompt on a Linux system.Fatmawati Achmad Zaenuri / Shutterstock

With the Linux bmon application, you can see the bandwidth usage on your network connections. However, understanding the smallest details requires detective work, so we did it for you!

How bmon works

Dynamic graphs and real-time statistics that show activity on your various network interfaces can give you a good idea of ​​the performance and bandwidth consumption of your network. This is exactly what bmon offers you, directly in a terminal window.

You can watch the graphs from time to time, just like you would with the speedometer in your car. Likewise, if something on your vehicle needs to be examined, a mechanic can hook it up to a diagnostic system and check the readings. bmon has similar detailed readings.

It must be said, the statistics of the bmon command can be confusing at first. For example, there are three called “Ip6 Reasm / Frag”. What’s going on with this?

However, once you’ve cracked the code, the command readings are invaluable if you want a more detailed understanding of your network traffic.

We did the work for you and even checked the source code to get to the bottom of some of them. Fortunately, everything else in bmon is pretty simple.

Install bmon

To install bmon on Ubuntu, use this command:

sudo apt-get install bmon

To install on Fedora, type the following:

sudo dnf install bmon

For Manjaro, the command is as follows:

sudo pacman -Sy bmon

Bmon display

Type bmon and press Enter to start the program. The bmon display is divided into several panes. The first three are labeled “Interfaces”, “RX” and “TX”. The center pane displays detailed statistics and graphs.

The “Interfaces” pane shows you the network interfaces with which your computer is equipped. It also shows the queuing discipline (qdisc) that each network interface uses (more on this later).

The “RX” pane displays the bits received per second and the packets per second for each interface and its queue. The “TX” pane displays the bits transmitted per second and the packets per second for each interface and its queue.

On our computer, we only installed two interfaces: the loopback interface (also called loopback adapter) and the wired Ethernet adapter. The loopback interface is called “lo” and the Ethernet interface is called “enp0s3”.

Your machine’s Ethernet adapter may have a different name. If you’re using a laptop, you’ll also see a wireless adapter, and its name will likely start with “wl”.

The bmon interface in a terminal window.

bmon displays information about the currently selected network interface. The interface selected is the one with a sign above () highlighted next to it. You can press the up and down arrows to move the upper sign to and select the interface you want to monitor. We chose the Ethernet adapter.

The Ethernet network adapter selected in the bmon interface in a terminal window.

Now that we are on an active network interface, we see some activity in the graphics and readings. If you don’t see any graphics, drag the terminal window down.

Press the left and right arrow keys to change the statistic shown on the graph. For some graphics, you will need to press H before filling them out; those who need it will tell you.

To view network interface statistics, stretch the terminal window until it is high enough to display it, and then press D to display it. If you press I (for Info), you see a small amount of additional information.

If you maximize the terminal window, it displays several graphics. Press less than () to add or remove pairs of graphics. If you press G, this turns the graphics display on or off.

When you press the question mark (?), You see the “Quick Reference” help screen with the common keys.

Press the question mark (?) Again to close the “Quick Reference” screen.

Detailed statistics

If your terminal window is sufficiently high and wide (stretch it, if it is not), you can press “D” to activate or deactivate the detailed view.

The detailed view of bmon statistics in a terminal window.

The number of columns you see depends on the width of the terminal window. In a standard terminal window with 80 columns, you will see two. The wider the window, the more columns you see. However, you don’t get more statistics with a larger window; you will always see the same set of numbers. But the columns will be shorter.

The top entry in each column may make you think that the left entry displays information in bytes, while the right entry displays information in packets. But this is not the case.

Each column contains a set of statistics. The name of the value and the values ​​received (RX) and transmitted (TX) are displayed for each statistic. If values ​​appear as a dash (-), it means that statistics are not saved for that direction.

Some statistics are only inward (received) or outward (transmitted). For example, a dash (-) in the transmitted column indicates that the statistic is not valid for outgoing packets and will only apply to incoming packets. The top line displays the traffic received and transmitted in bytes (left) and in packets (right).

All other statistics are listed in alphabetical order, jumping from column to column. Several of them share the same name. We will explain what they all mean below. We have also specified the abbreviated names. If IPv6 is not mentioned, this statistic refers to IPv4.

The statistics in the left column are as follows:

Bytes: Traffic in bytes.
Abort error: Number of abandonment errors. Somewhere in the connection path between the source and the destination, software caused the connection to be dropped.
Collisions: Number of collision errors. Two or more devices attempted to send a packet simultaneously. This shouldn’t be a problem in a full duplex network.
CRC errors: An account of cyclic redundancy check mistakes.
Mistakes: Total number of errors.
Frame error: Number of frame errors. A frame is a network container for a packet. An error means that malformed frames have been detected.
ICMPv6: Number of Internet control message protocol v6 traffic packets.
ICMPv6 errors: Number of ICMP v6 errors.
IP6 broadcast: An IPv6 account Broadcasts, which are sent to all devices on the network.
CE Ip6 packages: CE means “customer benefit. “This generally applies to routers. They connect with the supplier board (PE) of the connectivity service to which the customer is subscribed.
IP6 offers: Number of incoming IPv6 packets.
Ip6 ECT (1) packages: A Explicit congestion notification (ECN) allows either end of a network connection to alert the other end of an impending congestion. Packages are marked with a flag which serves as a warning. The receiving end can reduce transmission rates to try to avoid congestion and possible packet loss. ECN-Capable Transport (ECT) packages are marked with a flag to indicate that they are delivered via an ECN Capable Transport. This allows intermediate routers to react accordingly. Type 1 ECN packets tell the receiving end to activate ECN and add it to outgoing transmissions.
Ip6 header errors: Number of packets containing errors in the IPv6 header.
IP6 multicast packets: The number of IPv6 Multicast (a form of distribution) of packets.
Ip6 non-ECT packages: Number of IPv6 packets not marked as ECT (1).
Reassembly Ip6 / Fragment OK: Number of IPv6 packets that were fragmented due to size and correctly reassembled on reception.
Ip6 reassembly times: Number of IPv6 packets fragmented due to size, but could not be reassembled on reception due to timeouts.
IP6 truncated packets: Number of truncated packets. When an IPv6 packet is transmitted, it can be flagged as a candidate for truncation. If intermediate routers cannot handle the packet because it exceeds the maximum transmission unit (MTU), the router truncates the packet, marks it as such, and forwards it to the destination. When received, the far end can send an ICMP packet back to the source, telling it to update its MTU estimate to shorten its packets.
Ip6 releases: Number of IPv6 packets dropped. If devices between source and destination were not configured correctly and their IPv6 settings do not work, they will not handle IPv6 traffic; it will be thrown away.
IP6 packages: Total number of all types of IPv6 packets.
Missed error: Number of missing packets in a transmission. The packets are numbered so that the original message can be recreated. If they are missing, their absence is obvious.
No manager: Number of packets for which no protocol handler was found.
Window error: Number of window errors. The window of a packet is the number of bytes in the header. If this contains an abnormal number, the header cannot be interpreted.

The statistics in the right column are as follows:

Packages: Packet traffic.
Carrier errors: A number of carrier errors. These occur if there is a problem with the modulation of a signal. This could indicate either a duplex asymmetry between network equipment or physical damage to a cable, plug or connector.
Compressed: The number of packets compressed.
Fall: The number of packets dropped, which, therefore, did not reach their destination (possibly due to congestion).
FIFO errors: Number of first in, first out (FIFO) buffer errors. The network interface transmission buffer is full because it is not emptied quickly enough.
Heart rate errors: Hardware or software may use a regular signal to indicate that they are working properly or to allow synchronization. The number here is the number of “heartbeats” lost.
ICMPv6 checksum errors: Number of Internet Control Message Protocol v6 checksum errors.
IP6 address errors: Number of errors due to wrong IPv6 addresses
IP6 broadcast packets: Number of IPv6 broadcast packets.
Ip6 checksum errors: Number of IPv6 checksum errors. ICMP and User datagram protocol Packets (UDP) in IPv6 use checksums, but not normal IPv6 IP packets.
Ip6 ECT (0) packages: These are treated in the same way as ECT (1) packets.
Ip6 transmitted: The number of IPv6 packets unicast transfer delivered. Unicast skips packets from source to destination through a chain of intermediate routers and forwarders.
Ip6 multicasts: The number of IPv6 packets multicast transfer delivered. Multicasting sends packets to a group of destinations simultaneously (this is how Wi-Fi works).
Ip6 without route: Number of roadless errors. This means that the destination is unreachable because a route to the far end cannot be calculated
Reassembly / Ip6 fragment failures: Number of IPv6 packets fragmented due to size that could not be reassembled on reception.
Ip6 reassembly / fragment requests: Number of IPv6 packets fragmented due to size and which need to be reassembled on reception.
Ip6 errors too large: The number of “too large” ICMP messages received, indicating that IPv6 packets were sent that were greater than the maximum transmission unit.
Unknown IP6 protocol errors: Number of packets received using an unknown protocol.
Ip6 bytes: The volume of bytes received and transmitted. IPv6 has a 40 byte header (320 bits, 8 bits per byte) and a minimum packet size of 1280 bytes (10 240 bits).
Length error: Number of packets arriving with a length value in the header less than the minimum possible packet length.
Multicast: Number of multicast broadcasts.
About errors: Number of excessive errors. Either the receive buffer has overflowed, or packets have arrived with a frame value greater than what is supported, so they cannot be accepted.

Additional information

Pressing I (as in “Info”) toggles the additional information panes. If additional information does not appear, the window is not large enough. You can press D to deactivate detailed statistics, G to deactivate graphics or stretch the window.

The bmon additional information panes in a terminal window.

The additional information is as follows:

MTU: The maximum transmission unit.
Operstate: The operational state of the network interface.
Address: the support access control (MAC) address of the network interface.
Fashion: This is usually set by default, but you can see tunnel, beetroot or ro. The first three relate IP security (IPSec). The default setting is usually mode of transport, in which the payload is encrypted. Client to site virtual private networks (VPN) generally use it. Site-to-site VPNs typically use tunnel mode, in which the entire package is encrypted. In a linked end-to-end (beet) tunnel mode, a tunnel is created between two devices with fixed and masked IP addresses and other visible IP addresses. Ro mode is a routing optimization method for mobile IPv6.
Family: Family of network protocols used.
Qdisc: Discipline in queue. This can be set to red (Random early detection), codel (Controlled delay) or fq_codel (Fair queue with controlled delay).
Flags: These indicators show the capabilities of a network connection. Our connection can use broadcast and multicast transmissions, and the interface is operational (operational and connected).
IfIndex: The interface index is a unique identification number associated with a network interface.
Broadcast: The broadcast MAC address. Sending to this address broadcasts received packets to all devices.
TXQlen: The size of the transmission queue (capacity).
A.k.a: IP alias gives physical network connection multiple IP addresses. He can then give access to different subnets via a network interface card. No alias is used on our test computer.

bmon is a bit of a funny creature – no fish or poultry in some ways. The graphics have primitive charm and give you a good indication of what’s going on.

However, given the limitations of rendered in ASCII, you can’t really expect them to be super accurate. An occasional glance, however, can tell you if the connection is maximum, mysteriously devoid of traffic, or somewhere in between.

Detailed statistics, on the other hand, are just that: detailed and granular. Coupled with the somewhat casual approach to labeling them, it makes them even more difficult to decipher.

Hopefully the descriptions above will make bmon a little more accessible. It is truly a useful and lightweight tool with which you can monitor the health of network traffic and bandwidth consumption.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.