Tink vs iftop
iftop is a libpcap bandwidth TUI. It ranks who is talking on one interface right now. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
iftop shows the flows. Tink answers “why is this VPS sick?”
Accidental sysadmins land on iftop because iftop -i eth0 -nP is the first answer for a saturated NIC. Then disk is at 91%, nginx dies, and nobody is in the TUI — no sentence that says what to run. A filling /var is a Tink warning; it is invisible to iftop until you SSH and pick the wrong interface.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using iftop if you already want live per-host bars on an SSH session. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | iftop |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | apt/yum install iftop, pick -i/-n/-P/-f, then stay SSH'd in watching the bars |
| What you get | Working monitoring, diagnosis, and approved fixes | A curses bandwidth ranking — you still decide if that IP is backup, abuse, or a stuck rsync |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who is logged in when the NIC saturates |
| Hidden costs | None — fully managed | CAP_NET_RAW, the right interface name, a BPF filter you remember, and no pager unless you wrap it |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Interactive TUI on one NIC. iftop does not parse auth.log or propose a command |
| Configuration | None after install — heuristics and AI | Interface, DNS vs numeric, ports, text vs bits, and which BPF filter hides noise |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read two-way bars and cumulative totals yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Monitoring only — iftop cannot stop a backup, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — iftop draws a screen; paging is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live snapshot only — iftop forgets the flow when you quit |
| SSH brute-force detection | Built-in — parses auth.log every scan | Not included — a flood of port-22 lines is not "Invalid user" from auth.log |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down you cannot SSH into iftop either |
| Public status page | Shareable URL with 90-day history | Not included — iftop has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a remembered bar chart is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + a curses TUI. No mechanic you text when the uplink is full |
| Learning curve | None — works after install | Low to launch; higher to map a remote IP back to the process that opened the socket |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators already SSH'd in who want a live per-host bandwidth ranking on that NIC |
When iftop is the right choice
Keep using iftop when you already want that exact job:
- Live per-host bandwidth — you are already SSH'd in and need send/receive bars on this NIC right now.
- BPF filters —
iftop -f 'port 443'to hide everything except that flow. - No extra service — a package on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer a TUI and will never use a mechanic.
The real cost of “just run iftop”
The package is easy to install. A working ops loop for five Linux boxes is not:
- A healthy TUI still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and SSH brute-force never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — iftop stays a pair of bandwidth bars until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another curses session
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens iftop after the uplink is already full, and every scan includes a diagnosis a quiet TUI will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs nmon · Tink vs htop · Tink vs Glances