GENWiki

iftop is a fantastic tool to show you the current connections and traffic to a linux box in fairly real time, but running it as root for any period is really not a bright idea. When you try and run it as a normal user, you get "Operation Not Permitted" or something similar.

We need to 'allow' iftop to capture packets, and to do that we use the setcap command as

setcap cap_net_raw=eip $(which iftop)

Here we are saying that the process iftop is permitted to capture raw packets from the network interface(s).

To run iftop for only a single interface just use the -i switch…

iftop -i ens2BT

Where our public interface is called ens2BT. use ifconfig to see what interface names are assigned to which networks.