# Continuously Monitor Linux Traffic With VnStat and Picosnitch


When traffic on a VPS looks abnormal, there are usually two questions: which network interface transferred how much data and when, and which service was actually responsible.

[vnStat](https://humdi.net/vnstat/) records sent and received traffic per network interface. It is useful for total egress and hourly, daily, or monthly trends. [picosnitch](https://github.com/elesiuta/picosnitch) records connections per executable, letting you continue down to processes, domains, ports, and byte counts. Both keep collecting data in the background, but at different levels, so they complement each other well.

## vnStat: per-interface traffic

vnStat is not a packet sniffer. It reads the network-interface counters exposed by the kernel, while `vnstatd` periodically writes the data to its database. Resource usage stays low. It retains traffic records at five-minute, hourly, daily, monthly, and yearly resolutions.

Install it and start the service on Arch Linux:

```bash
sudo pacman -S vnstat
sudo systemctl enable --now vnstat
```

On its first start, the service creates database entries for available interfaces. List the ones already being recorded:

```bash
vnstat --dbiflist
```

An interface added later can be explicitly added, for example after Tailscale creates `tailscale0`:

```bash
sudo vnstat --add -i tailscale0
```

Common overview queries:

```bash
# Default summary: today, current month, and all time
vnstat -i wlan0

# Short summary
vnstat -i wlan0 -s

# Single parseable line for scripts
vnstat --oneline -i wlan0

# Last 7 days, 12 hours, and recent months
vnstat -i wlan0 -d 7
vnstat -i wlan0 -h 12
vnstat -i wlan0 -m
```

For the time range of an anomaly, combine `--begin` and `--end` with daily, hourly, or five-minute lists. With `--end`, vnStat adds a `sum` line at the end: the total received and transmitted traffic for that range.

```bash
# Daily records and the range total
vnstat -i wlan0 -d --begin 2026-07-20 --end 2026-07-31

# Hourly records within a day, precise to the minute
vnstat -i wlan0 -h --begin "2026-07-28 08:00" --end "2026-07-28 20:00"

# Five-minute records during a peak period
vnstat -i wlan0 -5 --begin "2026-07-28 12:00" --end "2026-07-28 14:00"
```

`--begin` accepts `YYYY-MM-DD HH:MM`, `YYYY-MM-DD`, and `today`; `--end` accepts the first two formats. They are only available with list output, JSON, or XML.

Use JSON when a script needs raw byte counts:

```bash
vnstat -i wlan0 -d --begin 2026-07-28 --end 2026-07-30 --json \
  | jq '.interfaces[0].traffic.days'
```

For a real-time rate or graphs:

```bash
# Press Ctrl+C to show statistics for this run
vnstat --live -i wlan0

# Terminal bar graph for the past 24 hours
vnstat -i wlan0 -hg

# Render daily data to a PNG
vnstati -i wlan0 -d -o ~/wlan0.png
```

Five-minute data is retained for only 48 hours by default. To keep fine-grained records of peak periods longer, change `5MinuteHours` in `/etc/vnstat.conf`, then restart the service:

```ini
5MinuteHours 336
```

```bash
sudo systemctl restart vnstat
```

vnStat only records traffic from the point `vnstatd` starts running; it cannot recover traffic that passed through an interface earlier.

## picosnitch: per-process traffic

vnStat can reveal when total interface traffic grows, but it cannot say which service generated it. picosnitch is a userspace daemon using BPF and fanotify. It records network connections by executable and stores them in SQLite. Its records include the executable path and hash, parent process, domain, port, user, and bytes sent and received. It can identify applications running in containers too.

The picosnitch upstream project recommends a system-wide pipx installation. On Arch Linux:

```bash
sudo pacman -S python-pipx
sudo pipx install picosnitch --global
sudo picosnitch systemd
sudo systemctl enable --now picosnitch
```

It requires Python 3.12 or newer and a Linux kernel capable of running modern libbpf CO-RE programs.

There are three ways to view the data:

```bash
# Terminal UI for historical connections
picosnitch tui

# Web UI, listening on http://localhost:5100 by default
picosnitch webui

# Live event stream
sudo picosnitch top
```

Configuration is at `/etc/picosnitch/config.toml`. The local SQLite database defaults to `/var/lib/picosnitch/picosnitch.db` and retains 30 days of history by default. To retain more history, change `retention_days` and restart the service:

```toml
[database]
retention_days = 90
```

```bash
sudo systemctl restart picosnitch
```

The Web UI listens locally by default. To make it reachable from a LAN or reverse proxy, set its address and port before launching it. Apply appropriate access control before exposing it publicly:

```bash
PICOSNITCH_HOST=0.0.0.0 PICOSNITCH_PORT=5100 picosnitch webui
```

## Investigate anomalies with both tools

Start with vnStat to see the traffic that actually passed through an interface, then identify the day or hour when it grew. With that time window narrowed, open picosnitch's TUI or Web UI and inspect the executables, domains, and ports for the same period.

For example, if vnStat shows a sharp increase in transmitted traffic through `wlan0` across two hours at noon, check that range in picosnitch next. If the traffic is concentrated in `caddy`, inspect the clients it connected to; if it is concentrated in a backup job or downloader, continue with that service's logs and configuration. Interface accounting finds the problem. Process accounting identifies its source.


---

> Author: Nite  
> URL: https://www.nite07.com/en/posts/linux-traffic-monitoring-vnstat-picosnitch/