bmon

Choose the interfaces to display, then use bmon’s curses view for live rates or a programmable output mode for scripts. The supplied manual describes Netlink interface and traffic-control counters, with /proc/net/dev as a fallback, plus wildcard interface filters, separate read/rate intervals and unit controls. Its JSON mode emits a timestamp with groups, elements, totals and rates per update. Check the installed build before relying on that newer output. Curses falls back to text when the console is incompatible. These are interface and kernel statistics, so use a process-attribution tool when the question is which application generated the traffic.