Find out network traffic per IP

I'm going to have to be cheap and copy my answer from this question.

ntop is probably the best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you which clients are receiving/sending the most traffic, where theyre recieving/sending to, what protocols and ports are being used etc.
It then uses a web GUI to navigate and display this information.

ntop is a fairly well known tool, so I would be highly surprised if its not in Ubuntu's package repository.

ntop


ntop can give you exactly what you're asking for. It collects data about all the traffic flowing through your network (and can collect data from other networks if they have a device configured to send netfow data to your system).

It will show you every host on the network, with how much bandwidth they've used. It will let you drill down into each host and see what type of traffic they are generating and to/from whom. It will let you see currently established TCP connections. You can pretty much get lost for days going through the data it can give you.

The program can be a memory-hog, though, depending on how you have the options setup.


To see realtime usage by IP (rather, by IP and port):

sudo apt install tcptrack
sudo tcptrack -i eth0

To see realtime usage by MAC address, a nice ncurses based tool is iptraf-ng:

sudo apt install iptraf-ng
sudo iptraf-ng

(And then, select "LAN station monitor → eth0".)

To see daily aggregate data volume by IP, my favourite is ipfm. Install with:

sudo apt install ipfm

Then configure in /etc/ipfm.conf according to man ipfm.conf and start with sudo ipfm.