nethogs - Per-Process Bandwidth Monitor Cheatsheet
nethogs is a small “net top” tool that groups bandwidth usage by process rather than by connection or subnet. When something is saturating your link, nethogs is the fastest way to see which program is responsible and how much it is sending and receiving — no packet filters or config required. It reads traffic per PID and needs root to do so.
Installation
| Platform | Command |
|---|
| Debian/Ubuntu | sudo apt install nethogs |
| Fedora/RHEL | sudo dnf install nethogs |
| Arch Linux | sudo pacman -S nethogs |
| macOS (Homebrew) | brew install nethogs |
| Verify | nethogs -V |
Running
| Command | Description |
|---|
sudo nethogs | Monitor the default interface |
sudo nethogs eth0 | Monitor a specific interface |
sudo nethogs eth0 wlan0 | Monitor multiple interfaces |
sudo nethogs -d 5 | Refresh every 5 seconds |
sudo nethogs -v 3 | View mode: total accumulated traffic |
The Display
| Column | Meaning |
|---|
PID | Process ID |
USER | Process owner |
PROGRAM | Executable path (and remote for some views) |
DEV | Network device |
SENT | Upload rate (KB/s by default) |
RECEIVED | Download rate |
Interactive Keys
| Key | Action |
|---|
m | Cycle units (KB/s, KB, B, MB) |
s | Sort by SENT |
r | Sort by RECEIVED |
q | Quit |
View Modes (-v)
| Mode | Shows |
|---|
-v 0 | KB/s (rate, default) |
-v 1 | Total KB |
-v 2 | Total B |
-v 3 | Total MB (accumulated since start) |
Options Worth Knowing
| Option | Description |
|---|
-d SECONDS | Refresh delay |
-t | ”Trace” / non-interactive text output |
-b | Bughunt mode (debug) |
-a | Monitor all devices (incl. loopback) |
-p | Promiscuous mode (see more traffic) |
-C | Capture in a limited/count mode |
Common Workflows
# Find the bandwidth hog on your main interface, sorted by download
sudo nethogs eth0 # then press 'r' to sort by RECEIVED
# Monitor Wi-Fi with a slower refresh
sudo nethogs wlan0 -d 3
# Non-interactive capture for a script/ticket
sudo nethogs -t eth0 > nethogs.log
| Tool | Groups by | Notes |
|---|
| nethogs | Process (PID) | “Who is using bandwidth?“ |
| iftop | Connection (host pairs) | “Which connections are busy?“ |
| bandwhich | Process + connection + remote | Rust, richest breakdown |
| nload | Interface totals | Simple aggregate graph |
nethogs answers which process; iftop answers which connection; use them together when chasing a network problem.
Resources
