List

16 Free and Open-source Internet and Network Traffic Monitor for Linux, Windows and macOS

What is an internet and network traffic monitor app?

An internet and network traffic monitor app is a tool used for analyzing and monitoring the data traffic over a network.

These apps are essential for network troubleshooting, performance evaluation, and bandwidth monitoring.

They provide information about who is using the network, what they are doing, and when they are doing it.

They can help identify abnormalities in the network traffic, detect intrusions, prevent bandwidth hogging, and ensure a smooth and efficient network operation.

In the following list, you will find a collection of the best open-source free network and internet traffic monitors that you can download and use freely in your machine.

1. Sniffnet

Sniffnet is a free and open-source cross-platform internet traffic monitor that provide clear insights in real-time about your internet traffic and connections.

Features

💻 choose a network adapter of your PC to inspect
🏷️ select a set of filters to apply to the observed traffic
📖 view overall statistics about your Internet traffic
📈 view real-time charts about traffic intensity (bytes and packets per second, incoming and outgoing)
🌐 get details about domain names and network providers of the hosts you are exchanging traffic with
🏠 identify connections in your local network
🌍 get information about the country of the remote hosts (IP geolocation)
⭐ save your favorite network hosts
🔉 set custom notifications to inform you when defined network events occur
🎨 choose the style that fits you the most from 12 different available themes, plus custom theme support
🕵️ inspect each of your network connections in real time
📁 save complete textual reports with detailed information for each network connection:
- source and destination IP addresses
- source and destination ports
- carried protocols
- amount of exchanged packets and bytes
- initial and final timestamp of information exchange
Supports IP Geolocation
Supports themes and keyword shortcuts

Platforms

Linux: Ubuntu, Debian, Arch Linux, Linux Mint, Tiny Core Linux
FreeBSD
NetBSD
macOS
Windows

TrafficMonitor is a network monitoring software with floating window feature for Windows. It displays the current internet speed and CPU and RAM usage. There are also other capabilities like an embedded display in the taskbar, changeable display skins, and historical traffic statistics.

Features

Displays current network transmission speed and CPU and RAM usage
If multiple network adapters are available, users can automatically or manually select networks to connect
Display network connection details
Support embedded display in taskbar
Support skin change and customizable skins
Historical traffic statistics
Hardware information monitoring
Plug-in system

3. ntopng

ntopng® is a web-based network traffic monitoring application released under GPLv3. It is the new incarnation of the original ntop written in 1998, and now revamped in terms of performance, usability, and features.

Supported Platforms

Debian/Ubuntu LTS x64
CentOS/RedHat/RockyLinux/AlmaLinux Linux x64
Windows x64
RaspberryPI/Debian ARM
FreeBSD/OPNsense/pfSense

4. Skydive

Skydive is an open source real-time network topology and protocols analyzer. It aims to provide a comprehensive way of understanding what is happening in the network infrastructure.

Skydive agents collect topology information and flows and forward them to a central agent for further analysis. All the information is stored in an Elasticsearch database.

Skydive is SDN-agnostic but provides SDN drivers in order to enhance the topology and flows information.

Features

Captures network topology and flows
Full history of network topology and flows
Distributed
Ability to follow a flow along a path in the topology
Supports VMs and Containers infrastructure
Unified query language for topology and flows (Gremlin)
Web and command line interfaces
REST API
Easy to deploy (standalone executable)
Connectors to OpenStack, Docker, OpenContrail, Kubernetes
Easy to install using Docker and Docker Compose

5. nload

nload is a console application which monitors network traffic and bandwidth usage in real time. It visualizes the in- and outgoing traffic using two graphs and provides additional info like total amount of transfered data and min/max network usage.

6. Picosnitch

Picosnitch is a tool that monitors network traffic per executable, providing notifications for new program connections and modifications.

It breaks down traffic by various parameters, offers web and terminal interfaces with GeoIP lookups for each connection, and can check hashes or executables using VirusTotal. It also caches executable hashes for improved performance.

Features

Receives notifications whenever a new program connects to the network, or when it's modified
Monitors bandwidth, breaks down traffic by executable, hash, parent, domain, port, or user over time
Provides web and terminal interfaces with GeoIP lookups for each connection
Optionally checks hashes or executables using VirusTotal
Caches executable hashes based on device + inode for improved performance
Detects applications running inside containers, differentiating multiple versions of the same app based on their hash
Uses BPF for accurate, low overhead bandwidth monitoring and fanotify to watch executables for modification
Logs the parent executable and hash for each connection, as applications can call others to send/receive data for them
Pragmatic and minimalist design focusing on accurate detection with clear and reliable error reporting when detection isn't possible

Platforms

The app is available for the following platforms

Arch Linux
Ubuntu
Debian
Fedora
Nix

7. PHPNetMap

PHPNetMap is a self-hosted open-source web app for network device monitoring using SNMP protocol, compatible with various devices including 3Com/HP, ProCurve, Dell, and Extreme. It displays connected hosts based on FIB, CAM switches, and ARP table devices.

Users can search within these tables and view connections between hosts. It also allows users to view port status and Spanning Tree Protocol status on switches. With read/write permission, users can alter the ifAdminStatus or set ifAlias.

8. ICMPWatch

ICMPWatch is a Python program that captures and analyzes ICMP packets on a network interface, providing detailed information like source and destination IP addresses, MAC addresses, ICMP type, and payload data.

It can also store these packets in a SQLite database and save them in pcap format.

Features

Capture and analyze ICMP Echo Request and Echo Reply packets.
Display detailed information about each ICMP packet, including source and destination IP addresses, MAC addresses, packet size, ICMP type, and payload content.
Save captured packet information to a text file.
Store captured packet information in an SQLite database.
Save captured packets to a PCAP file for further analysis.
Support for custom packet filtering based on source and destination IP addresses.
Colorful console output using ANSI escape codes.
User-friendly command-line interface.

9. PCAPdroid

PCAPdroid is an open-source app that enables tracking, analysis, and blocking of connections made by other apps on a device. It allows for the export of a PCAP dump of traffic, HTTP inspection, and TLS traffic decryption.

It simulates a VPN to capture network traffic without root, processing data locally on the device instead of using a remote VPN server.

Features

Log and examine the connections made by user and system apps
Extract the SNI, DNS query, HTTP URL and the remote IP address
Inspect HTTP requests and replies thanks to the built-in decoders
Inspect the full connections payload as hexdump/text
Decrypt the HTTPS/TLS traffic and export the SSLKEYLOGFILE
Dump the traffic to a PCAP file, download it from a browser, or stream it to a remote receiver for real-time analysis (e.g. Wireshark)
Create rules to filter out the good traffic and easily spot anomalies
Identify the country and ASN of remote server via offline DB lookups
On rooted devices, capture the traffic while other VPN apps are running

Download

PCAPdroid

User Guide

PCAPdroid

10. Netproc

Netproc is a free and open-source simple tool to monitor network traffic based on processes

11. Bandwidth Monitor NG

Bandwidth Monitor NG is a compact and straightforward console-based tool for live monitoring of network and disk IO bandwidth. It's compatible with Linux, BSD, Solaris, Mac OS X, and other operating systems.

Features

Supports /proc/net/dev, netstat, getifaddr, sysctl, kstat, /proc/diskstats /proc/partitions, IOKit, devstat and libstatgrab
Provides support for an unlimited number of interfaces/devices
Dynamically adds or removes interfaces/devices from the list
Includes a white-/blacklist of interfaces/devices
Outputs data in KB/s, Kb/s, packets, errors, average, max and total sum
Allows output in curses, plain console, CSV, or HTML
Uses a configfile for configuration settings

12. bandwidth-checker

This simple app allows you to ⚡ Test and graph your internet bandwidth over time.

13. wrtbwmon

This is a collection of free and open-source shell scripts for monitoring bandwidth on Linux.

14. udp-latency

This is a small end-to-end latency testing tool using UDP protocol in Python. It supports both one-way and round-trip latency measurement with 'udp_latency.py' for one-way latency and 'udp_rrt.py' for round-trip latency.

Features

Support UDP
Flexible packet size
Flexible bandwidth
Specific sending period
Simple as single Python file

15. MonBand

MonBand is a lightweight bandwidth monitoring application that adds a toolbar to the Windows taskbar for rendering bandwidth graphs.

Features

Deskband with monitoring of multiple interfaces simultaneously with an autoscaling graph for each one.
Standalone configuration application that administers the configuration and communicates with the deskband when configuration is updated without needing to restart the shell.
Deskband standalone test mode (without installation in Windows) by running MonBand.Windows.Standalone.exe deskband-test.
Bandwidth monitoring of any local network interface traffic rate using performance counters.
Bandwidth monitoring of a remote network interface using SNMPv1/2c counters:
- GUI to query remote interface names and pick which one to monitor. To monitor multiple interfaces, create another SNMP monitor to the same server.
- Configurable poll interval with automatic compensation for poll latency to reduce rate calculation inaccuracy.
- 32-bit counter wrap-around is transparently handled.
- 64-bit counters are preferred if present and wrap-around is transparently handled.
- Anomalous rate spikes (due to slight irregularities of polling interval and multiple counter updates in case of slow updating counters) are smoothed using ZScore algorithm.