nethogs
nethogs is a small, command-line network monitoring tool that breaks down network traffic by process rather than by protocol or interface. Unlike iftop (which shows per-connection bandwidth) or nload (which shows per-interface totals), nethogs groups bandwidth usage by the program responsible — showing you at a glance that Firefox is using 500 KB/s, not just that port 443 is busy.
Key Features
- Per-process bandwidth — Network traffic grouped by process name and PID
- Send/receive breakdown — Separate columns for transmitted and received data
- Total bandwidth — Aggregate network usage at the bottom of the display
- Interactive refresh — Auto-updating display with configurable refresh interval
- Device selection — Monitor specific network interfaces (e.g., eth0, wlan0)
- Lightweight — Minimal overhead, no daemon required, runs on any Linux system
- Traffic accumulation — Tracking mode accumulates traffic from all seen PIDs
- KB/s display — Bandwidth displayed in kilobytes per second for readability
Why Use It
When you notice high network activity but do not know what is causing it, nethogs provides the answer fastest. While iftop shows connections and nload shows interface totals, only nethogs tells you the actual program using the bandwidth — whether it is a browser, backup tool, system update, or malicious process.
Use Cases
- Runaway application detection — Find which app is unexpectedly consuming bandwidth
- Malware investigation — Spot unexpected network activity from suspicious processes
- Bandwidth accounting — Understand which applications are using your internet connection
- Cloud cost optimisation — Identify processes generating excessive outbound traffic on cloud servers
Platform
Linux
Licence
GNU General Public License v2.0