nethogs

Start NetHogs as root (default device is eth0)

$ sudo nethogs

$ sudo nethogs [device]

$ sudo nethogs [device1] [device2]

$ sudo nethogs -t [seconds]

nethogs [options] [device]

-d
    Refresh delay in seconds.

-v
    View mode: 0 = KB/s, 1 = KB, 2 = B, 3 = MB.

-t
    Tracemode - shows only the totals.

-i
    Interface name - monitors only that interface.

-c
    Number of updates.

-p
    Sniff in promiscuous mode (not recommended).

device
    Specific network interface to monitor (e.g., eth0, wlan0). If omitted, monitors all interfaces.

Nethogs is a command-line tool that monitors network traffic bandwidth used by each process on a Linux system.

Unlike tools that monitor per-interface, nethogs groups bandwidth by process. This helps quickly identify which applications are consuming the most network resources. It provides a real-time view of network usage, updating its output every second by default. Nethogs shows the process ID (PID), user, program name, and the amount of traffic sent and received. This allows for easy identification of resource hogs and troubleshooting network bottlenecks or suspicious activity. The tool is especially useful when multiple applications are competing for bandwidth on a server or workstation. It requires root privileges to access process and network information.

Nethogs is not included by default in most Linux distributions and needs to be installed using the system's package manager.

Requires root privileges to run. Network interface monitoring may be affected by certain firewall configurations.

During runtime, several keypresses provide interactive control: 'q' quits the program, 'm' toggles between total KB/s, KB, B, and MB, 'r' sorts by received traffic, 's' sorts by sent traffic.

tcpdump(1), iftop(1), ss(8), netstat(1)