You can install VnStat using the following commands:

For Ubuntu / Debian

apt install vnstat

For CentOS

yum install vnstat

Done. Let's move on. You can configure the information in the CLI interface of the utility using the configuration file located at /etc/vnstat.conf.
For example, you can specify the default network interface to be monitored.

VnStat stores interface statistics databases in /var/lib/vnstat.
Using the command vnstat -i eth0, you can view the overall statistics (if it has been accumulated) for the load on a specific interface or for all interfaces if you do not specify a parameter.
Replace eth0 with the required network interface.

Available arguments:

-l: Collect real-time traffic.
-s: Display concise information.
-t: Display the top ten days with the highest load.
-h: Display information for the last hour.
-d: Display information for the last day.
-w: Display information for the last week.
-m: Display information for the last month.

For example, if you want to check the current network traffic load on your server, you can use the following command. Make sure to specify the correct network interface.

vnstat -l -i eth0

This type of information output allows you to determine if your server is under a DDoS attack. High incoming traffic and a large number of incoming packets do not guarantee that it is a DDoS attack of this type, but it is essential to pay attention to DDoS protection services.