Traffic Analysis with Bandwidthd

If you've ever wondered which device on your network is hogging up all the bandwidth, or if you're a networking/cybersecurity student who wants to get a grasp on real-time traffic monitoring, this guide is for you. In this tutorial, we will go through Traffic Analysis with Bandwidthd. Bandwidthd is a lightweight, open-source tool that tracks bandwidth usage on a per IP address basis and displays usage in clean, HTML-based graphical reports.

What is Bandwidthd?

Bandwidthd is a network monitoring tool which tracks TCP/IP network traffic and builds up usage graphs for each IP address on your network. It breaks down traffic into protocols (HTTP, FTP, P2P, TCP, UDP, ICMP and more) so you can easily see:

• Which hosts are using the most bandwidth
• What type of traffic is dominating your network (web browsing, streaming, file transfer etc)
• When your network is at peak usage

It's a go-to tool for network administrators, students, and cybersecurity enthusiasts who want a simple, visual way to keep an eye on network health.

In this tutorial The idea here is to use Bandwidthd to monitor, capture and analyze network traffic, determine how much bandwidth is being used by each host on the network and make sense of the different types of traffic flowing across it.

Requirements

Before you start, make sure you have:

• An active internet connection
• Bandwidthd – the bandwidth usage tracker with web-based visualization
• Apache2 – to host the Bandwidthd HTML reports
• Root or sudo access on your Linux machine

Step-by-Step Installation and Configuration

Step 1: Install Bandwidthd

• Open your terminal and run:

  sudo apt install bandwidthd -y

• This installs Bandwidthd along with its default configuration files.

Step 2: Configure Bandwidthd

• Before editing the configuration, find your network interface's IP address:

ip a

• Note down the IP address assigned to your eth0 interface (or your active network interface). You'll need this in the next step.
• Now run the below command to open the Bandwidthd configuration file:

sudo nano /etc/bandwidthd/bandwidthd.conf

Inside this file, make two key changes:

1) Paste your network's IP/subnet in front of the subnet line, for example:

subnet 192.168.11.202/24

2) Make sure the dev line points to your correct network interface:

dev "eth0"

• Save the file (in nano: Ctrl+O, then Enter, then Ctrl+X to exit).

Step 3 & 4: Verify Configuration

Make sure that the subnet and device values are in sync with your actual network setup. It’s worth checking this before proceeding, as this is the most common reason Bandwidthd fails to capture any traffic.

Step 5: Start the Apache Web Server

Bandwidthd generates HTML reports, and Apache2 is what serves them in your browser.

sudo systemctl start apache2 

sudo systemctl enable apache2

The enable command ensures Apache2 starts automatically every time your system boots.

Step 6: Start Bandwidthd

Now start the Bandwidthd service itself:

sudo systemctl start bandwidthd 

sudo systemctl enable bandwidthd

Bandwidthd will now begin silently capturing traffic in the background and generating reports at regular intervals.

Step 7: View the Traffic Reports

Open your browser and navigate to:

http://localhost/bandwidthd/

You'll see a dashboard listing the Top 20 IPs by Traffic, broken down by total data sent, total received, and protocol type (FTP, HTTP, MAIL, P2P, TCP, UDP, ICMP).following is the output when you enter the above url in the web browser:

Reading the above Graphical Output: A Real Example

Here's how to interpret a typical Bandwidthd report:

Top Host: The IP address with the highest usage — in our test run, 192.168.x.x used 10.8 KB of bandwidth, most of it through:

• UDP: 8.8 KB (this usually points to DNS lookups, streaming, or VoIP traffic)
• HTTP: 1.9 KB (regular web browsing)

Other Hosts:

• 192.168.x.x used about 3.0 KB, almost entirely UDP traffic
• The broadcast address 192.168.x.x received about 1.1 KB — this is completely normal and typically comes from ARP requests or general broadcast packets, not a cause for concern

Traffic Graphs:

• Peak send rate: 496 bits/sec
• Peak receive rate: 32 bits/sec
• The graphs are color-coded by protocol, with UDP traffic (shown in red) dominating and a smaller portion of HTTP traffic (shown in blue)

Why This Matters Practical Use Cases

But understanding traffic patterns is not a purely academic exercise, there is a practical value to it:

• Network troubleshooting: Quickly identify a device flooding the network and slowing things down for everyone else
• Security surveillance: Anomalous spikes in traffic from a single host may be an early indication of malware or unauthorized data transfer.
• Capacity planning:  Knowing when peak usage times are helps identify when upgrades or bandwidth limits might be necessary.

Conclusion

Bandwidthd is a great entry point into network traffic analysis, it's lightweight, easy to setup and gives you a really useful visual breakdown of what's happening on your network without needing complex packet-capture tools like Wireshark. Whether you're a student learning the basics of networking or an admin monitoring a small office LAN, this setup provides instant, actionable insight into bandwidth usage.

If you liked this walk-through, try running it on your own home or lab network and comparing the traffic patterns you see - you might be surprised at what's actually using your bandwidth.

Click on the Download button to download the pdf of this tutorial.