Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I've googled and read, and googled and read. Everything I've found makes reference to it counting IP packets, but it obviously displays Bits/Byte and packets come all manner of size.
What bits does iftop actually count? Do the header bytes in for UDP,TCP, and/or IP get counted?
Based on their definition it should be counting the entire IP packet, which would include the header.
But since the IP packet may be layered inside of a transport protocol, or delivered as the payload inside of an ethernet frame, it sounds like there may technically be some headers or trailers that wouldn't be counted.
All the technicality aside, it is probably a pretty good measure of actual bandwidth utilization but there are some things listed in the manual that elude to reasons the numbers may appear to be inaccurate.
http://www.fifi.org/cgi-bin/man2html/usr/share/man/man8/iftop.8.gz
Some of them are listed in man pages at the link above if you scroll down to the "Quirks(aka they're features not bugs)" section.
I think the main thing to keep in mind is that the bandwidth is being calculated using packets, and a packet includes the IP header. A frame may or may not include an entire IP packet, and whether or not the frame header and footer add a significant amount of overhead to throughput or bandwidth utilization is somewhat non-trivial and I am personally not sure.
