been using iftop for live bandwidth monitoring. way easier than trying to read tcpdump output. shows you exactly whos using bandwidth in real time