Terminal Guidenethogs
Network traffic monitor showing bandwidth per process.
Official WebsiteFeatures
Installation
apt install nethogspacman -S nethogsdnf install nethogsWhy Use nethogs?
Per-Process Network Tracking
See exactly which processes are sending and receiving data, including real-time bandwidth usage for each application.
Real-Time Bandwidth Monitoring
Monitor network performance in real-time to identify bandwidth-hungry applications and network anomalies quickly.
Simple and Focused
Specialized tool for network monitoring. Lightweight with minimal dependencies and quick to identify network issues.
Multiple Device Support
Monitor specific network interfaces or all interfaces simultaneously to track network activity across your system.
Installation
# Ubuntu/Debian
sudo apt install nethogs
# Fedora/RHEL
sudo dnf install nethogs
# Arch Linux
sudo pacman -S nethogs
# CentOS
sudo yum install nethogs
# Verify installation
nethogs -V
# Note: nethogs requires root/sudo privileges to runBasic Usage
# Start nethogs (monitors all interfaces by default)
sudo nethogs
# Monitor specific network interface
sudo nethogs eth0
# Monitor multiple interfaces
sudo nethogs eth0 eth1 wlan0
# Run in batch mode (non-interactive output)
sudo nethogs -b
# Set refresh interval (in seconds)
sudo nethogs -d 2
# Show packets instead of bandwidth
sudo nethogs -p
# Get help
nethogs -hKey Options & Interactive Commands
Command Line Options
| Option | Description |
|---|---|
-b, --batch | Non-interactive batch mode for logging |
-d SEC, --delay SEC | Refresh interval in seconds (default: 1) |
-p, --packets | Show packets per second instead of bytes/sec |
-u, --units B|K|M|G | Display units (bytes, kilobytes, megabytes, gigabytes) |
-s COL, --sort COL | Sort by column (RECV, SENT, or name) |
-t | Show on separate terminal via truss |
-c NUM | Run for NUM refreshes then exit |
Interactive Mode Shortcuts
| Key | Function |
|---|---|
r | Reverse sort order |
s | Sort by sent traffic |
p | Sort by process name |
m | Toggle display units |
q | Quit nethogs |
Practical Examples
1. Identify Bandwidth Hogs
# Start interactive monitoring on all interfaces
sudo nethogs
# Key tips:
# - Processes are sorted by total bandwidth by default
# - Red entries indicate the most bandwidth consumption
# - Press 'r' to reverse sort order
# - Press 's' to sort by sent traffic specifically2. Monitor Specific Interface
# Monitor only eth0 interface
sudo nethogs eth0
# Monitor only WiFi interface
sudo nethogs wlan0
# Useful when you have multiple network cards and want to focus on one3. Batch Mode for Logging
# Collect network data for 60 seconds with 5-second intervals
sudo nethogs -b -d 5 -c 12 > network_log.txt
# Background collection with timestamps
nohup bash -c 'while true; do echo "=== $(date) ===" >> nethogs.log; sudo nethogs -b -d 1 -c 5 >> nethogs.log; echo "---" >> nethogs.log; sleep 60; done' &
# Save ongoing monitoring
sudo nethogs -b -d 2 | tee -a network_traffic.log4. Monitor Network Activity by Protocol
# View packets instead of bandwidth
sudo nethogs -p
# Monitor with custom refresh rate
sudo nethogs -d 2
# Show in megabytes (easier to read for large transfers)
sudo nethogs -u M5. Find Network Issues
# Monitor during suspected network problems
watch -n 1 'sudo nethogs -b -d 1 -c 1'
# Run with packet monitoring to find anomalies
sudo nethogs -p
# Run in background and capture unusual activity
sudo nethogs -b -d 5 | tee -a network_analysis.txt
# Filter output for specific process
sudo nethogs -b -d 2 -c 10 | grep chromeUnderstanding the Output
Column Meanings
PID/Name
Process ID and name - identifies which process/application is using network
USER
Username who owns the process
RECV
Bandwidth being received (downloaded) by this process
SENT
Bandwidth being sent (uploaded) by this process
PROTO (optional)
Network protocol being used (TCP, UDP, etc.)
Example Output
nethogs (v0.8.6) running on ubuntu
Refreshing every 1s
interface: eth0
PID USER RECV SENT PROTO
1234 www-data 5.25 MB/s 2.10 MB/s TCP
5678 root 1.50 MB/s 0.75 MB/s TCP
9012 mysql 0.50 MB/s 0.30 MB/s TCP
3456 chrome 0.15 MB/s 0.08 MB/s TCP
7890 sshd 0.00 MB/s 0.00 MB/s TCP
TOTAL 7.40 MB/s 3.23 MB/sComparison with Similar Tools
vs. iftop
nethogs shows per-process bandwidth, while iftop shows bandwidth by host/connection. nethogs is better for identifying which applications are using the network.
vs. vnstat
nethogs provides real-time monitoring, while vnstat tracks historical network usage. Use nethogs for immediate diagnosis, vnstat for trend analysis.
vs. ss/netstat
nethogs shows real-time bandwidth by process, while ss/netstat show connection details. nethogs is more focused on bandwidth monitoring.
Tips
1. Root Privileges Required
nethogs needs root access to monitor network traffic. Always use 'sudo nethogs' or configure sudoers for passwordless access if running frequently.
2. Identify Unexpected Traffic
Regularly check nethogs output to identify unexpected processes consuming bandwidth. Unusual traffic patterns may indicate malware or misconfiguration.
3. Use Batch Mode with Cron
Schedule nethogs batch collection via cron for periodic network usage reports. Combine with grep to filter specific applications.
4. Monitor Specific Interfaces
On multi-interface systems, monitor specific interfaces to reduce noise and focus on relevant network activity.
5. Combine with Other Tools
Use nethogs with ss/netstat to get connection details, or with tcpdump for packet-level analysis when more details are needed.
6. Use watch for Continuous Monitoring
Wrap nethogs in watch command for automated refresh: 'watch -n 1 "sudo nethogs -b -d 1 -c 1"' for continuous updates.