Network Bandwidth Utilization Report: How to Build One on Linux

Updated: 2026-10-09

A bandwidth utilization report answers three questions: how much traffic did the server move, how close to the link limit did it get, and is that changing. Everything below uses tools available on any Linux server - no SNMP collector required.

What a Useful Report Contains

Metric	Why it matters	Source
Total RX/TX per day and month	Billing, transfer quotas, trends	`vnstat`
Average utilization (% of link)	Normal load	`sar -n DEV`, counters
Peak utilization	Short saturation users feel as slowness	`sar -n DEV` at 1-min resolution
95th percentile	How most providers bill and size links	counter samples
Top hosts / ports	What is using the bandwidth	`iftop`, `nethogs`, flow logs
Errors and drops	A "slow network" that is really a faulty NIC or cable	`ip -s link`
Change vs previous period	Growth for capacity planning	previous report

Step 1: Collect the Data

Daily and monthly totals with vnstat

vnstat reads kernel counters and keeps history, so it survives reboots and costs nothing to run:

sudo apt install vnstat        # Debian/Ubuntu; dnf install vnstat on RHEL-based
sudo systemctl enable --now vnstat
vnstat -d                      # last days
vnstat -m                      # months
vnstat -h                      # hours of today
vnstat --json m                # machine-readable, for your own report

Utilization over time with sar

sar (package sysstat) records network rates every 10 minutes by default:

sar -n DEV -i 60 -f /var/log/sysstat/sa$(date +%d) | grep eth0   # today's samples for eth0
sar -n DEV 1 10                                                   # live, 10 one-second samples

The rxkB/s and txkB/s columns are the rates; %ifutil (on recent sysstat versions) is utilization of the interface speed.

Link speed

cat /sys/class/net/eth0/speed      # Mb/s, e.g. 1000
ethtool eth0 | grep Speed

On virtual machines the reported speed is often meaningless (10000 Mb/s for a VPS capped at 200). Use the limit from your provider's plan instead.

Step 2: Calculate Utilization and the 95th Percentile

Utilization is the rate divided by the link speed:

utilization % = (bits per second) / (link speed in bits per second) * 100

The 95th percentile is the value that 95% of your samples stay under - it ignores the top 5% of short bursts, which is why providers bill on it. From a file with one rate per line (in Mb/s), sampled every 5 minutes for a month:

sort -n rates.txt | awk '{a[NR]=$1} END {print "p95:", a[int(NR*0.95)], "Mb/s"}'

A small collector that writes one 5-minute sample per line, using kernel counters only:

#!/bin/sh
i=eth0
rx1=$(cat /sys/class/net/$i/statistics/rx_bytes); tx1=$(cat /sys/class/net/$i/statistics/tx_bytes)
sleep 60
rx2=$(cat /sys/class/net/$i/statistics/rx_bytes); tx2=$(cat /sys/class/net/$i/statistics/tx_bytes)
echo "$(date -Is) $(( (rx2-rx1)*8/60/1000000 )) $(( (tx2-tx1)*8/60/1000000 ))" >> /var/log/bandwidth-samples.log

Run it from cron every 5 minutes; column 2 is RX and column 3 TX in Mb/s.

Step 3: Find What Uses the Bandwidth

Totals tell you how much; the report should also say what:

sudo iftop -i eth0 -t -s 30 -n            # top connections over 30 s, text output
sudo nethogs -t eth0                      # traffic per process
ss -tnp state established | head          # who is connected right now

For web servers, the access log often answers it faster - bytes sent per URL or client:

awk '{bytes[$7]+=$10} END {for (u in bytes) print bytes[u], u}' /var/log/nginx/access.log | sort -rn | head

Step 4: Check Errors and Drops

ip -s link show eth0

Rising errors, dropped or overrun counters mean packets are lost below the application - often a duplex mismatch, a bad cable or a saturated host. Include the numbers in the report; see check network interface errors and drops.

Report Template

Bandwidth report - web-01 (eth0, 1 Gb/s plan limit 500 Mb/s) - September 2026

Transfer            RX 1.82 TiB   TX 6.40 TiB   Total 8.22 TiB   (+14% vs August)
Average rate        RX 5.8 Mb/s   TX 20.3 Mb/s
Peak (1 min)        TX 412 Mb/s on 2026-09-17 20:41  (82% of plan limit)
95th percentile     TX 61 Mb/s   (12% of plan limit)
Busiest hours       19:00-22:00 daily
Top consumers       /media/*.mp4 (58% of TX), backup sync to 10.0.0.12 (21% of TX, 02:00-03:00)
Errors / drops      0 / 0
Notes               Peak on 09-17 = newsletter send; backup window overlaps nothing.
Actions             Move video to CDN before quota (10 TiB) is reached in ~2 months.

Reading the Numbers

Observation	Meaning
p95 low, peaks near 100%	Link is fine most of the time; users feel short bursts - schedule backups and syncs off-peak
p95 above 70%	Time to plan more capacity or offload traffic (CDN, compression, caching)
Monthly total growing faster than visitors	Something new is sending data - a crawler, a backup, a misconfigured sync
RX much higher than usual	Possible attack, scraping or uploads; check top hosts
Errors or drops rising	Hardware or driver problem, not a capacity problem

Automating the Report and Alerts

A monthly report is for planning; problems need alerts in between. Two checks cover most cases: sustained utilization above a threshold, and the monthly transfer approaching the provider's quota. Thresholds and ready scripts are in bandwidth usage alerts on Linux; for the tools themselves see network bandwidth monitoring on Linux.

In Zuzia, vnstat --json m or the sample script above can run as a scheduled task on each server: the output of every run is kept and summarised by AI, so the month-by-month numbers for all your servers are in one place next to their CPU, RAM and disk metrics.

FAQ

What is a network bandwidth utilization report?

A summary of how much of a network link was used over a period: total transfer, average and peak rates, the 95th percentile, what caused the traffic and how it compares with the previous period.

How do I generate a bandwidth report on Linux?

Install vnstat for daily and monthly totals (vnstat -m), use sar -n DEV from sysstat for rates over time, and add iftop or nethogs to show what used the bandwidth.

What is the 95th percentile in bandwidth?

Sort all rate samples for the period and drop the highest 5%; the highest remaining value is the 95th percentile. With 5-minute samples, it ignores about 36 hours of peaks per month.

What bandwidth utilization is too high?

Sustained average or 95th percentile above 70-80% of the link means users will notice slowdowns at peaks. Short bursts to 100% are normal.

How often should bandwidth be reported?

Monthly for capacity planning and billing, weekly while you investigate a problem, and real-time alerts for saturation or quota limits.