NLOAD

nload is a lightweight, terminal-based network traffic monitor. It displays real-time inbound and outbound bandwidth usage per network interface and is commonly used for quick diagnosis of network activity on a VPS or Linux server.

It is useful when you need a fast answer to questions like:

• Is the server currently receiving or sending a lot of traffic?
• Which interface is busy (public NIC vs internal NIC)?
• Did traffic spikes happen during a deployment or incident window?
• Is bandwidth usage consistent with expected workload?

What nload shows

• Current, average, minimum, and maximum bandwidth usage
• Total data transferred (in/out)
• A live graph in the terminal per selected interface

What nload does not show

• It does not break traffic down by process, port, or remote IP.
• It does not show packet loss, retransmits, or application-level metrics. For deeper analysis, combine it with ss, tcpdump, or iftop.

Installation

Ubuntu / Debian

sudo apt update
sudo apt install nload -y

RHEL / CentOS / Rocky / AlmaLinux

sudo dnf install nload -y

Basic Usage

Start nload:

nload

This opens an interactive view showing traffic for the first detected interface.

Select a specific interface

nload eth0

If your interface name is different (common on cloud servers), list interfaces first:

ip link show

Navigation and Controls

Inside nload:

Key	Action
	-
Left/Right Arrow	Switch between interfaces
F2	Options menu
q	Quit

Understanding the Display

nload typically shows:

• Incoming rate (In)
• Outgoing rate (Out)
• Graph of bandwidth usage over time
• Totals transferred since start

Common interpretation:

• High In: traffic inbound to server (requests, downloads to server)
• High Out: traffic leaving server (responses, uploads from server, backups, CDN origin traffic)

Practical Use Cases

Confirm traffic spike during an incident

Run:

nload

Look for:

• sustained high bandwidth
• sudden peaks that match reported downtime or slowness

Correlate with connections:

sudo ss -tan state established | wc -l
sudo ss -tan state syn-recv | wc -l

Identify which interface is busy

If your server has multiple interfaces (public + private):

nload

Use arrow keys to switch interfaces and compare.

Validate backup or migration bandwidth usage

During rsync, backups, or object storage uploads:

nload eth0

You can estimate:

• whether the transfer is saturating your uplink
• whether throughput matches expectations

Basic DDoS / abuse signal check (not a detector)

nload can reveal abnormal bandwidth patterns, but it cannot confirm attack types.

If traffic is abnormally high, check:

sudo ss -tan | head
sudo ss -tan state syn-recv | head
sudo ss -s

If you suspect HTTP floods, also check web logs:

sudo tail -n 200 /var/log/nginx/access.log 2>/dev/null || true
sudo tail -n 200 /usr/local/lsws/logs/access.log 2>/dev/null || true

Common Pitfalls

Symptom	Likely Cause	Fix
nload shows zero traffic but site is active	Wrong interface selected	Use arrow keys or specify interface explicitly
Traffic looks “low” but users report slowness	Latency/CPU/disk bottleneck, not bandwidth	Check CPU, RAM, disk I/O and web/PHP process limits
Bandwidth is high but unclear source	nload has no per-IP/process view	Use iftop, ss, or tcpdump

Related Tools

Tool	Best For
	--
iftop	Per-connection bandwidth (remote IPs)
ss	Connection counts, socket states
tcpdump	Packet capture and deep inspection
mtr	Route + loss analysis
Netdata	Dashboard-level network metrics + history

Next step for “who is using bandwidth”

For per-IP visibility:

sudo apt install iftop -y
sudo iftop -i eth0

Quick Reference

Task	Command
--
Install (Ubuntu/Debian)	sudo apt install nload -y
Run	nload
Run on interface	nload eth0
List interfaces	ip link show
Quit	q