nethogs

Start NetHogs as root (default device is eth0)

$ sudo nethogs

$ sudo nethogs [device]

$ sudo nethogs [device1] [device2]

$ sudo nethogs -t [seconds]

nethogs [options] [device ...]

-a
    Monitor all devices, including loopback interfaces and those without an IPv4 address.

-d seconds
    Delay for update refresh rate in seconds (default is 1). Can be a float value, e.g., -d 0.5.

-t
    Trace mode. Dumps the output to standard output (stdout) instead of using the interactive ncurses interface. Useful for scripting or logging.

-p
    Promiscuous mode. Sniff packets in promiscuous mode. This might be necessary on some network setups to see all traffic.

-s
    Sort by total (sent + received) bandwidth. By default, processes are sorted by received (download) bandwidth.

-v
    Print version information and exit.

-c cycles
    Run for a specified number of refresh cycles and then exit. Useful for automated monitoring.

-h
    Display help message and exit.

device
    Specify one or more network interfaces to monitor (e.g., eth0, wlan0, lo). If no device is specified, Nethogs monitors all non-loopback devices with an IPv4 address.

Nethogs is a small, open-source 'top'-like tool that provides a real-time, per-process bandwidth monitoring experience for Linux and macOS. Unlike traditional network monitoring tools that show only aggregated network usage, Nethogs breaks down usage by individual processes or programs, displaying how much upload and download bandwidth each application is consuming. This makes it an invaluable utility for identifying bandwidth-intensive applications, diagnosing unexpected network activity, or simply understanding where your network resources are being utilized. It functions by sniffing network traffic on specified interfaces and correlating it with process IDs (PIDs) by examining the /proc filesystem. The interactive curses-based interface allows users to sort data, toggle display modes, and refresh statistics dynamically, offering immediate and actionable insights into network resource consumption.

Nethogs requires root privileges (or appropriate capabilities) to operate, as it needs to access raw network sockets and read information from the /proc filesystem. It might not always accurately identify the process responsible for network activity in complex networking scenarios, such as traffic routed through VPN tunnels, network namespaces used by containers (e.g., Docker), or virtual machines. While generally lightweight, monitoring very high-traffic network interfaces can lead to a noticeable increase in CPU usage. Nethogs only reports on network activity that passes through the monitored interfaces and is associated with a running process on the local machine.

When Nethogs is running in its interactive curses-based interface, several key presses can be used to control its behavior:

• m: Cycles through display modes for bandwidth units (KB/s, MB/s, GB/s).
• r: Sorts processes by received (download) bandwidth.
• s: Sorts processes by sent (upload) bandwidth.
• q: Quits the application.
• K: Attempts to kill the selected process (use with extreme caution).
• d: Toggles display of received, sent, and total bandwidth columns.
• i: Toggles between displaying PID only and PID with program name.
• l: Toggles display of local/remote IP addresses and ports for connections.

The default interactive display of Nethogs provides the following columns:

• PID: The Process ID of the application.
• Program: The name of the executable or process responsible for the traffic.
• DEV: The network device (interface) through which the traffic is passing (e.g., eth0, wlan0).
• SENT: The upload bandwidth usage in real-time.
• RECEIVED: The download bandwidth usage in real-time.
• TOTAL: (Optional, toggle with d) The combined sent and received bandwidth.

Nethogs was initially developed by Arnout Engelen and first released around 2008. It was created to address a specific void in Linux system monitoring: the lack of a straightforward tool to visualize network bandwidth consumption broken down by individual processes, akin to how top provides CPU and memory insights. Being open-source and fulfilling such a critical niche, it quickly gained popularity among system administrators and power users. While its development pace has naturally evolved from rapid initial releases to more maintenance-focused updates, Nethogs remains a stable, widely used, and essential utility in many Linux troubleshooting and monitoring toolkits.

top(1): A common process monitor that shows CPU and memory usage per process., iftop(8): Displays real-time bandwidth usage on selected network interfaces, but not per-process., ss(8): Utility to investigate sockets, showing connections, listening ports, and socket statistics., netstat(8): Prints network connections, routing tables, interface statistics, and multicast memberships., lsof(8): Lists open files and can show network connections associated with specific processes.