nethogs
A Linux 'net top' tool that groups network bandwidth usage by process instead of protocol or subnet.
What is nethogs?
NetHogs is a command-line network monitoring tool for Linux that displays real-time network bandwidth usage grouped by process. It solves the problem of identifying which specific application or process is consuming network resources, especially useful when diagnosing unexpected traffic spikes or bandwidth hogs.
System administrators, DevOps engineers, and Linux users who need to monitor and troubleshoot network usage at the process level on Linux systems.
Developers choose NetHogs for its unique process-centric view of network traffic, its lightweight design requiring no kernel modules, and its immediate visibility into bandwidth-hungry applications without complex setup.
Overview
Linux 'net top' tool
Use Cases
Best For
- Identifying which process is causing sudden network bandwidth spikes on a Linux server
- Monitoring real-time network usage per application in a multi-service environment
- Troubleshooting unexpected network traffic from specific programs or services
- Analyzing process-level network consumption for performance optimization
- Quickly diagnosing bandwidth hogs on development or production Linux machines
- Complementing protocol-based network tools with a process-focused view
Not Ideal For
- Cross-platform monitoring on Mac OS X or FreeBSD where full process visibility is required
- Long-term network traffic logging and historical data analysis
- Environments requiring detailed protocol or IP subnet breakdowns for security auditing
- Systems where assigning Linux capabilities to binaries is restricted or not allowed
Pros & Cons
Pros
NetHogs uniquely groups network traffic by PID and process name instead of protocol, providing immediate visibility into which applications are consuming bandwidth, as emphasized in the README for quick problem identification.
It offers a live, updating display similar to the 'top' command, showing current network usage per process, which is ideal for troubleshooting sudden traffic spikes without complex setup.
Relies on standard `/proc` filesystem and user-space libpcap, avoiding custom kernel modules and simplifying deployment on Linux, as stated in the README's key features.
Included in most Linux distributions and described as a 'mature piece of software,' NetHogs is stable and ready for production use with minimal resource overhead.
Cons
Heavy reliance on `/proc` means that on Mac OS X and FreeBSD, it only shows connections, not processes, severely limiting its utility for cross-platform monitoring as admitted in the README.
The libnethogs library is labeled 'highly experimental' with expected breaking changes, making it unsuitable for stable integrations or packaging, as cautioned in the README.
Running without root requires setting multiple Linux capabilities like cap_net_admin and cap_net_raw via setcap, adding administrative overhead and potential security concerns, as detailed in the 'Running without root' section.
Frequently Asked Questions
Related Projects
termsharkA terminal UI for tshark, inspired by Wireshark
iperfiperf3: A TCP, UDP, and SCTP network bandwidth measurement tool
openwifiopen-source IEEE 802.11 WiFi baseband FPGA (chip) design: driver, software
pysharkPython wrapper for tshark, allowing python packet parsing using wireshark dissectors
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.