bandwhich - Per-Process Bandwidth Monitor Cheatsheet
bandwhich is a Rust terminal utility that displays current network utilization broken down by process, connection, and remote IP/hostname. Unlike iftop (per-connection) or nethogs (per-process only), bandwhich correlates sockets to the owning process and resolves remote endpoints, so you instantly see which app — and which remote host — is consuming bandwidth.
Installation
| Platform | Command |
|---|
| Cargo (all platforms) | cargo install bandwhich |
| Arch Linux | sudo pacman -S bandwhich |
| Debian/Ubuntu | sudo apt install bandwhich |
| Fedora | sudo dnf install bandwhich |
| macOS (Homebrew) | brew install bandwhich |
| Nix | nix-env -iA nixpkgs.bandwhich |
| Prebuilt binary | Download from the GitHub Releases page |
Privileges
bandwhich must sniff packets, so it needs elevated capabilities:
# Simplest: run with sudo
sudo bandwhich
# Or grant the binary capabilities once (no sudo afterward, Linux)
sudo setcap cap_net_raw,cap_net_admin=eip $(which bandwhich)
Basic Usage
| Command | Description |
|---|
sudo bandwhich | Monitor all interfaces, live TUI |
sudo bandwhich -i eth0 | Watch a single interface |
sudo bandwhich --interface wlan0 | Same, long form |
bandwhich --help | Full option list |
bandwhich --version | Version |
Key Options
| Option | Description |
|---|
-i, --interface NAME | Limit monitoring to one interface |
-n, --no-resolve | Skip reverse-DNS lookups (faster, raw IPs) |
-r, --raw | Machine-readable, non-interactive output (good for logging) |
-p, --processes | Show only the processes table |
-c, --connections | Show only the connections table |
-a, --addresses | Show only the remote-addresses table |
--total-utilization | Print a one-shot total instead of the live UI |
-s, --show-dns | Include DNS queries in the connection view |
-d, --dns-server IP | Use a specific resolver for reverse lookups |
Interactive Keys
| Key | Action |
|---|
Tab | Cycle the layout / rotate which table is expanded |
Space | Pause / resume updates |
↑ / ↓ | Scroll within a table |
q / Ctrl+C | Quit |
Reading the Display
bandwhich shows three live tables:
| Table | Tells you |
|---|
| Utilization by process | Which executables are sending/receiving, with up/down rates |
| Connections | Each socket: local → remote, protocol, and per-connection rate |
| Utilization by remote address | Which remote hosts (resolved) you’re exchanging the most data with |
Rates are shown as current up (▲) and down (▼) throughput, refreshed about once per second.
Common Workflows
# "What is eating my upload right now?" — processes only, no DNS lag
sudo bandwhich -p -n
# Investigate a noisy interface and log a raw stream for later analysis
sudo bandwhich -i eth0 --raw | tee bandwhich-eth0.log
# One-shot snapshot of total utilization (scripts/cron)
sudo bandwhich --total-utilization -n
# Find the top remote talkers (e.g. an exfiltration or backup job)
sudo bandwhich -a
bandwhich vs Other Network Monitors
| Tool | Granularity | Notes |
|---|
| bandwhich | Process + connection + remote host | Rust TUI, resolves remotes |
| nethogs | Per process | No remote-host grouping |
| iftop | Per connection | No process attribution |
| nload | Per interface totals | Simple aggregate graph |
| iptraf-ng | Per interface/connection | Older ncurses suite |
Resources
