bwmon

bwmon is a focused bandwidth investigator for administrators who need to understand traffic on one Linux machine. It is especially suitable when process-level attribution and local history matter more than fleet dashboards or cloud integrations. The free, self-hosted deployment keeps data on the host, but its Linux, root, and single-interface constraints define its audience.

Overview

bwmon combines live receive and transmit rates, process attribution, spike records, alerts, and historical analysis in a browser dashboard. It monitors one interface, normally selecting the interface on the default route unless you override it, so it fits host-level troubleshooting rather than switches, routers, or multi-server operations.

There is no cloud account, signup, or agent service to manage. The MIT license and self-hosted design suit organizations that want local control and can administer their own Linux host. The trade-off is operational responsibility: deployment, authentication, dependency management, and ongoing maintenance remain yours.

Key features

Live traffic and attribution

The live panel polls RX/TX every second and presents a rolling chart alongside top processes. A daemonized nethogs process refreshes talker data about every two seconds, giving administrators a practical link between aggregate traffic and the processes causing it, though attribution is not an instantaneous stream.

Spike investigation and alerts

When interface traffic exceeds five times its rolling two-minute average, bwmon records process attribution, rates for all interfaces, and top conntrack flows. That context is more useful for post-spike investigation than a threshold alone. Separately, a banner appears when the rolling five-minute average reaches 40 Mbps, and cleared alerts remain in the history table, creating a record of sustained high usage.

History and resource use

Five-minute samples remain available for six months. Views range from one hour, 24 hours, seven days, 30 days, and six months to all time, with adaptive bucketing. A time-of-week heatmap and rate histogram help identify recurring or unusual patterns. The project states that six months of history uses at most 50 MB per interface, while the bwprocs daemon uses less than one percent of a CPU core at idle.

Pricing

There is no trial because the sole plan is free. The practical limit is architectural rather than commercial: one host and one monitored interface, with no multi-host tier to expand into.

Platforms

bwmon provides an API and web dashboard for a self-hosted Linux installation. It requires Linux kernel 4.0 or later and root access. The one-command setup uses sudo ./setup.sh, installs the collector, systemd service, cron jobs, and nginx server block, and serves the dashboard on port 8080 by default.

On Debian and Ubuntu, the installer uses apt and can install nethogs, PHP-FPM, PHP CLI, and nginx. Other distributions require manual installation of those dependencies. The bundled nginx configuration is open; internet-facing deployments should be placed behind an authenticated reverse proxy or protected with basic authentication.

Who it's for

Choose bwmon for a Linux administrator investigating which processes consume bandwidth, documenting sudden spikes, or reviewing six months of behavior on a single host. Its low stated storage and idle CPU use make it reasonable for a dedicated server where local observability is the priority.

Look elsewhere if you need multiple hosts, multiple monitored interfaces, SNMP, user-level monitoring, or long-horizon network analytics. The single-interface design and root requirement also make it a poor fit for environments where central operations teams cannot install privileged host software.

Pros and cons

Pros

• Useful process context: nethogs-based attribution connects traffic to top talkers instead of stopping at interface totals.
• Investigative spike records: five-times-baseline capture includes process, all-interface, and conntrack information.
• Long local history: six months of five-minute samples, heatmap, and histogram support pattern analysis.
• Low direct cost: the complete plan is free, self-hosted, and MIT-licensed.

Cons

• One-host, one-interface scope: it cannot serve as a fleet or broad network monitoring platform.
• Privileged Linux deployment: kernel 4.0+, root access, and manual dependency work on non-Debian systems narrow deployment options.
• Security setup is yours: the open nginx block requires an authenticated reverse proxy or basic authentication before internet exposure.
• No built-in expansion path: there is no paid tier for additional hosts or interfaces.

Alternatives

SoftPerfect Bandwidth Manager is the better choice when Windows or macOS support, rule-based control, or a trial matters; its Lite plan is free with five rules/streams, while Standard for one device costs 49.00 USD.

ntopng suits readers needing broader network visibility across Linux, macOS, Windows, and self-hosted deployments; its free Community edition targets small networks with a suggested maximum of 256 live local hosts.

GlassWire is aimed at Android and Windows users who prefer a desktop-oriented freemium product; its free tier keeps one day of usage and 24 hours of network history.

sFlowTrend is an alternative for traffic monitoring in switched-network environments.

ManageEngine NetFlow Analyzer is the stronger fit for interface-based network management, with a free edition for two interfaces and paid editions starting at $172 a month.

Cacti is appropriate when you want open-source graphing across a conventional PHP, MySQL, RRDTool, and Net-SNMP stack.

FlowViewer is a free Unix-server option for flow analysis, with paid hourly support available.

Nagios XI is preferable when bandwidth work belongs inside wider infrastructure monitoring; its free tier covers seven nodes or 100 services, whichever comes first.

Verdict

bwmon is a strong recommendation for a Linux administrator who needs free, private, process-aware bandwidth investigation on one host. Its spike forensics and six-month local history are the main reasons to choose it. Choose another product when you need multi-host coverage, network-wide interfaces, or a less privileged and more centrally managed deployment.