What it does
nethogs displays network usage grouped by process instead of by interface or protocol. It’s ideal for quickly identifying which application is saturating a link.
How it works (mechanical)
nethogs captures packets using libpcap and correlates
them with processes by inspecting socket ownership via /proc.
It periodically aggregates transmit and receive rates per PID.
- Packet capture via libpcap
- Process mapping via kernel socket tables
- Live refresh with interactive TUI
- Measures current rate, not cumulative totals
10 Practical Examples
# 1) Monitor all interfaces (default) sudo nethogs
# 2) Monitor a specific interface sudo nethogs eth0
# 3) Monitor multiple interfaces sudo nethogs eth0 wlan0
# 4) Disable hostname and port resolution (faster) sudo nethogs -d 2 -v 3
# 5) Set refresh interval (seconds) sudo nethogs -d 5
# 6) Show only TCP traffic sudo nethogs -t | grep TCP
# 7) Run in trace (non-interactive) mode sudo nethogs -t
# 8) Log output to a file sudo nethogs -t > nethogs.log
# 9) Combine with watch for snapshots watch -n 2 sudo nethogs -t
# 10) Find the bandwidth hog, then inspect it sudo nethogs ps aux | grep <pid>
Notes & Gotchas
- Root privileges are required for packet capture.
- Short-lived connections may not be attributed correctly.
- UDP-heavy workloads can be harder to map precisely.
- Shows instantaneous rate, not long-term totals.
- Not suitable for precise accounting or billing.
Historical Context
nethogs emerged to solve a gap left by tools like iftop
and iptraf, which focus on interfaces and flows rather than
the processes responsible for traffic.
Modern Equivalent / Related Tools
- iftop — per-host / per-flow bandwidth usage
- iptraf-ng — interactive network monitoring
- ss — socket-level inspection
- bpftrace / eBPF tools — precise per-process metrics
- systemd-cgtop — cgroup-based resource usage