CheatPress

nethogs Bandwidth per process

Version 0.9.0 · source

nethogs, Postcard, light preview Light · Postcard 102 × 152 mm · PDF nethogs, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF nethogs, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
nethogs, A5, light preview Light · A5 148 × 210 mm · PDF nethogs, A5, dark preview Dark · A5 148 × 210 mm · PDF nethogs, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
nethogs, A4, light preview Light · A4 210 × 297 mm · PDF nethogs, A4, dark preview Dark · A4 210 × 297 mm · PDF nethogs, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
nethogs, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF nethogs, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF nethogs, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
nethogs, A3, light preview Light · A3 297 × 420 mm · PDF nethogs, A3, dark preview Dark · A3 297 × 420 mm · PDF nethogs, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
nethogs, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF nethogs, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF nethogs, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
nethogs, Letter, light preview Light · Letter 8.5 × 11 in · PDF nethogs, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF nethogs, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
nethogs, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF nethogs, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF nethogs, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

sudo nethogs
Bandwidth per process
sudo nethogs <if>
Watch one interface
m
Cycle units and totals
r
Sort by received
s
Sort by sent
sudo nethogs -d 5
Refresh every 5 s
sudo nethogs -t
Plain text output
q
Quit

Concepts

  1. Packets libpcap
  2. Connection socket inode
  3. Process PID, program
How a byte gets a name

Run

sudo nethogs
Monitor all running interfaces
sudo nethogs <if> <if>
Monitor only these interfaces
sudo nethogs -a
Include loopback and down interfaces
sudo nethogs -d <sec>
Set refresh interval (default 1)
sudo nethogs -c <n>
Quit after n refreshes
sudo nethogs -P <pid>
Show only this process
sudo nethogs -f '<filter>'
Apply a pcap filter (experimental)
sudo nethogs -C
Count UDP as well as TCP
sudo nethogs -p
Promiscuous capture (not advised)
sudo nethogs -g <n>
Prune dead entries every n refreshes
nethogs -V
Print version
nethogs -h
Print help

Display

-v 0
Rates in kB/s (default)
-v 1
Total kB
-v 2
Total bytes
-v 3
Total MB
-v 4
Rates in MB/s
-v 5
Rates in GB/s
-l
Show full command line
-b
Show program basename only
-s
Start sorted by sent

Interactive keys

q
Quit
r
Sort by received
s
Sort by sent
m
Cycle kB/s, kB, B, MB, MB/s, GB/s
The same set as the -v values.
l
Toggle full command line
b
Toggle program basename

Output

sudo nethogs -t
Trace mode: plain text, no curses
sudo nethogs -t -c <n>
Print n samples and exit
sudo nethogs -t -d <sec>
Trace with a custom interval

Permissions

sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" $(which nethogs)
Allow non-root use
The first two capture packets; the last two let it read process names. Re-run after every upgrade.
getcap $(which nethogs)
Check granted capabilities

Recipes

Log per-process traffic for a minute
sudo nethogs -t -d 5 -c 12 > nethogs.log
Which program is eating the Wi-Fi
sudo nethogs wlan0# press r to sort by received# press m to switch to totals
Watch one service
pid=$(pidof firefox | cut -d' ' -f1)sudo nethogs -P "$pid" -b
Non-root monitoring
sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" /usr/sbin/nethogsnethogs eth0