Most VPS plans include a monthly traffic allowance, and many workloads (downloads, video, backups, proxies) can use more bandwidth than you’d expect. vnStat is a tiny daemon that records how much data each network interface sends and receives, and keeps hourly, daily and monthly statistics. It uses almost no resources, and answers “how much traffic have I used this month?” in one command.

Install

sudo apt install vnstat          # Debian/Ubuntu
sudo dnf install vnstat          # RHEL family (EPEL)
sudo systemctl enable --now vnstat

vnStat detects interfaces automatically. Check which ones it monitors:

vnstat --iflist
vnstat -i eth0 --add      # add an interface if needed (vnStat 2.x)

Statistics start from installation. Give it a few minutes to collect data before the first reports.

Everyday commands

vnstat                 # summary for all interfaces
vnstat -i eth0         # one interface
vnstat -h              # hourly
vnstat -d              # daily
vnstat -m              # monthly
vnstat -y              # yearly
vnstat -t              # top days
vnstat -l              # live traffic rate (Ctrl+C to stop)
vnstat -tr 10          # average rate over 10 seconds

Example monthly output:

 eth0  /  monthly

        month        rx      |     tx      |    total    |   avg. rate
     ------------------------+-------------+-------------+---------------
       2026-09     182.40 GiB |  1.21 TiB   |   1.39 TiB  |    4.60 Mbit/s
       2026-10      96.12 GiB | 702.55 GiB  | 798.67 GiB  |    5.20 Mbit/s
     ------------------------+-------------+-------------+---------------
     estimated     185 GiB    |  1.35 TiB   |   1.54 TiB  |

The estimated line projects the current month’s total, which is useful for spotting that you’ll exceed your allowance.

  • rx is received (inbound) and tx is transmitted (outbound). Web and download servers mostly send (tx).

Compare with your plan’s allowance

Check how your provider counts traffic: inbound, outbound or both, and the billing cycle dates. For example, VPS.DO USA VPS plans include monthly transfer (1–10 TB depending on plan) on a 1 Gbps port, and Hong Kong plans are unmetered at a fixed Mbps rate. See USA VPS and Hong Kong VPS.

If your billing month doesn’t start on the 1st, set MonthRotate in /etc/vnstat.conf to your billing day, so monthly totals line up:

MonthRotate 15

Restart vnstat after changing the configuration.

Alerts when traffic is high

vnStat 2.x can check limits for scripts with --alert:

# exit code 1 if this month's total traffic exceeds 900 GiB
vnstat -i eth0 --alert 0 3 m total 900 GiB

Run it daily from cron, and send an email or webhook when it triggers:

0 8 * * * root vnstat -i eth0 --alert 0 3 m total 900 GiB || curl -fsS -d "Traffic over 900 GiB on $(hostname)" https://ntfy.sh/my-alerts

See crontab.

Find what’s using the bandwidth

vnStat tells you how much, not who. For per-connection or per-process views, use:

  • iftop: live traffic per connection (remote host);
  • nethogs: live traffic per process.

See iftop and nethogs. Web server logs show which files or pages are downloaded most:

awk '{print $10, $7}' /var/log/nginx/access.log | sort -rn | head    # largest responses

See Nginx logs.

Machine-readable output and graphs

vnstat --json m          # JSON for scripts and dashboards
vnstat --oneline         # compact single-line summary

vnstati (package vnstati) renders PNG summary graphs:

vnstati -i eth0 -m -o /var/www/stats/monthly.png
vnstati -i eth0 -h -o /var/www/stats/hourly.png

Protect any page exposing these with authentication. For full dashboards, Netdata or Prometheus’ node_exporter graph interface traffic in real time. See Netdata.

Reduce bandwidth usage

Quick reference

Task Command
Summary vnstat
Monthly vnstat -m
Daily / hourly vnstat -d / vnstat -h
Live rate vnstat -l
JSON vnstat --json m
Billing day MonthRotate N in /etc/vnstat.conf
Limit check vnstat --alert 0 3 m total 900 GiB

Related: iperf3 and latency vs bandwidth.

  • Networking
  • Monitoring
  • Linux