Вывод iftop

ты ман дальше первого абзаца не читаешь?

iftop(8)

When running, iftop uses the whole screen to display network usage. At the top of the display is a logarithmic scale for the bar graph which gives a visual indication of traffic.

The main part of the display lists, for each pair of hosts, the rate at which data has been sent and received over the preceding 2, 10 and 40 second intervals. The direction of data flow is indicated by arrows, <= and =>. For instance,

foo.example.com  =>  bar.example.com      1Kb  500b   100b
                 <=                       2Mb    2Mb    2Mb

shows, on the first line, traffic from foo.example.com to bar.example.com; in the preceding 2 seconds, this averaged 1Kbit/s, around half that amount over the preceding 10s, and a fifth of that over the whole of the last 40s. During each of those intervals, the data sent in the other direction was about 2Mbit/s. On the actual display, part of each line is inverted to give a visual indication of the 10s average of traffic. You might expect to see something like this where host foo is making repeated HTTP requests to bar, which is sending data back which saturates a 2Mbit/s link.

Да это встраиваемая железяка, там мана вообще нет, но упрек принял. В общем я прав оказался в своих подозрениях, спасибо за ответ.