Parent page: Internet and Networking


Aimed at people with a small home network, who want to monitor the amount uploaded / download from the internet but not the local traffic on the LAN. This might be useful if your ISP sets monthly bandwidth limits, and you also transfer files across your local network.

The instructions guide you through setting up IPAC-NG, an iptables/ipchains based IP accounting package.


13.10 and later

It seems the package is not included in Ubuntu 13.10 anymore and has to be installed manually. See for details.

13.04 and before

You will need access to the Universe repository - see AddingRepositoriesHowto if you need more information.

First install ipac-ng, either with Synaptic (SynapticHowto)or type in a terminal:

sudo aptitude install ipac-ng


Edit /etc/ipac-ng/rules.conf to tell it the type of traffic you want to log. To simply measure upload and download totals, it should read:

# /etc/ipac-ng/rules.conf

total upload |ipac~i|eth0|all||
total download |ipac~o|eth0|all||

Note: replace eth0 with the network adapter you wish to measure.

Edit /etc/ipac-ng/ipac.conf and change the storage method to gdbm, otherwise the logs will take up a very large amount of space. (postgre could probably be used too)

# /etc/ipac-ng/ipac.conf

storage = gdbm

To ignore LAN traffic, some simple iptables rules are added to the startup scripts. Edit /etc/init.d/ipac-ng and add the four lines between the ##'s as follows:

## /etc/init.d/ipac-ng

case "$1" in
        echo -n "Starting $DESC: "
        $DAEMON -S
        $IPTABLES -I INPUT -s aaa.bbb.ccc.0/24 -j ACCEPT
        $IPTABLES -I OUTPUT -d aaa.bbb.ccc.0/24 -j ACCEPT
        echo "$NAME."
        echo -n "Stopping $DESC: "
        # fetch accounting before removing the rules
        echo -n "flushing IP accounting rules ..."
        $IPTABLES --flush ipac~o
        $IPTABLES --flush ipac~i
        $IPTABLES --flush ipac~fi
        $IPTABLES --flush ipac~fo
        # here should the ipac_* rule be removed from INPUT OUTPUT and FORWARD but --flush is
        # evil because it would remove all rules in these chains.
        $IPTABLES -D INPUT -s aaa.bbb.ccc.0/24 -j ACCEPT
        $IPTABLES -D OUTPUT -d aaa.bbb.ccc.0/24 -j ACCEPT
        echo "$NAME stopped."

Note: replace aaa.bbb.ccc.0 with your local network. For example, if your router is at, you would use

That's it! The traffic totals will be automatically fetched from iptables every 10 minutes when your computer is running. To view the totals, use 'ipacsum'. It can be configured to display a specific time interval, and will even draw graphs of the traffic.


vnstat is another app that can be used to monitor bandwidth usage. It is a little simpler and easier to use then the ipac-ng package. One of the benefits of vnstat is it's not a running daemon so it takes up no memory. The process is created via a cron job which is run every 5 minutes.


The vnstat package is very easy to install from the repositories with no dependencies.

sudo apt-get install vnstat


vnstat is meant to be used by any user so it needs to be set up that way first by giving correct permission. The following gives any user permission to use this feature. If desired you can set up a group so only users in the group can use this.

sudo chmod o+x /usr/bin/vnstat

sudo chmod o+wx /var/lib/vnstat/

Now vnstat should be ready to run.


To create the cron job simply run this command

vnstat -u -i eth0

Replace eth0 with the interface you want to monitor

This creates a file in /var/lib/vnstat/ that collects the data for that interface. A cron job will run every 5 minutes to update the data. Below is a sample output with no options.

Database updated: Thu Jan 12 22:20:01 2006


           received:           0.11 MB (nan%)
        transmitted:           0.01 MB (nan%)
              total:           0.12 MB

                        rx     |     tx     |  total
            today      0.11 MB |    0.01 MB |    0.12 MB
        estimated         0 MB |       0 MB |       0 MB

You can read more about options you can use to modify the output in the man page of vnstat.


HowToMonitorInternetTrafficTotals (last edited 2014-02-20 20:29:51 by lifeboy)