Linux view NIC traffic tools iptraf, iftop and nethogs etc., iftop can be used in real-time traffic monitoring NIC (network segment can be specified), reverse resolution IP, display port information. iftop centos command to install the following:
- yum install iftop -y
Common Parameters:
-i is set to monitor card, such as:
- iftop -i eth1
Wherein eth1 public network card server, name of the NIC can ifconfig view, as my ECS the ipconfig results below 
remote SSL Run view the external network occupation bandwidth, you can view the situation corresponding IP occupied bandwidth, to determine which of up bandwidth, whether malicious connection: 
as shown above, the IP will take up bandwidth, or block access to the firewall security group. Of course, it is best to observe a period of time, if it is sustained bandwidth, plus the IP was in the field, you can shield it. In order to better monitor the bandwidth available in a particular IP, you can execute the command:
. Iftop -i eth1 -B -F 182.92 *** 20.
Display 182.92 20 *** interact with the IP server network card eth1.. the amount of data, the unit is Byte.
Interface Description:
"<=" and "=>", indicates the direction of the flow
, "the TX": traffic from the NIC
"the RX": NIC receives traffic
"TOTAL": card transmitting and receiving a total flow
"cum": iftop Start run to the current point in time the total flow
"peak": peak flow card
"rates": indicate recent 2s, 10s, 40s average flow of
exit iftop by "q" key on the keyboard