NetHogs — Network Analysis and Diagnostics

Latest Tool Guides / Network Analysis and Diagnostics / nethogs.html

A Linux 'net top' tool that displays bandwidth by process.

Basic Information

What is this program?

NetHogs is a Linux command-line tool that displays total network traffic broken down by process (program). Unlike iftop, which shows traffic by IP/subnet, or nload, which shows it by interface, NetHogs indicates which process is using bandwidth by PID and program name.

It operates using libpcap without a kernel module, allowing you to immediately identify which program is causing a sudden spike in network traffic. Sorting and filtering are also available in its interactive interface.

What problem does it solve?

• Finds the process causing a sudden increase in server bandwidth.
• Identifies if malicious processes or backdoors are generating abnormal traffic.
• Checks for unexpected network usage after application deployment.
• Tracks bandwidth usage patterns by process within containers or virtual environments.

Key Features

Per-Process Bandwidth Separation

Displays upload and download speeds by PID and program name.

• Use Case: Used to track the process causing a bandwidth spike.
• Result: Instantly shows which program is consuming bandwidth.
• Limitation: Kernel threads and processes inside containers are only partially displayed.

Interactive Sorting

Enables real-time sorting by received data, sent data, or speed.

• Use Case: Used to quickly find the process using the most bandwidth.
• Result: Top consuming processes appear at the top of the list.
• Limitation: Sorting criteria are primarily speed-based by default.

Multiple Interface Support

Monitors traffic across multiple network interfaces simultaneously.

• Use Case: Used in environments with dual NICs, VPNs, or container networks.
• Result: Separately view process traffic per interface.
• Limitation: The screen can become cluttered with many interfaces.

No Kernel Module Required

Operates using only libpcap, so no kernel module installation is needed.

• Use Case: Used for quick deployment and execution in containers or lightweight environments.
• Result: Can be used immediately without installation overhead.
• Limitation: Requires packet capture privileges (root or cap_net_raw).

Installation and Execution

Ubuntu / Debian (Repository Package)

Install from the distribution repository.

sudo apt update
sudo apt install nethogs

# Verify Installation
nethogs --version

Fedora / RHEL

Install using dnf.

sudo dnf install nethogs

Arch Linux

Install using pacman.

sudo pacman -S nethogs

Practical Usage Examples

Basic Execution (All Interfaces)

View per-process bandwidth for all network interfaces.

# Run with root privileges
sudo nethogs

# Example output:
# PID   PROGRAM         USER        SENT      RECEIVED
# 1234  nginx           www-data    1.5 MB    12.3 MB
# 5678  python3         youngbae    0.2 MB    0.8 MB

Monitor a Specific Interface Only

View process traffic on a designated interface.

# Monitor only the eth0 interface
sudo nethogs eth0

# Set refresh interval to 2 seconds
sudo nethogs -d 2 eth0

Track a Specific PID Only

Focus monitoring on a suspicious process's bandwidth.

# Track only PID 1234
sudo nethogs -p 1234

# Result: Real-time upload/download speed of that process