Nethogs: Real‑Time Network Traffic Monitoring by Process on Linux

There are tons of open-source network monitoring tools available for the Linux operating systems on the web. Say, you can use the iftop command to monitor bandwidth usage, netstat command, or ss command to see reports on interface statistics, or top command to watch running process on your system.

But if you are really looking for something that can give you real-time statistics of your network bandwidth per process usage, then NetHogs is the only utility you should look for.

What is NetHogs?

NetHogs is an open-source command-line program (similar to Linux top command) that is used to monitor real-time network traffic bandwidth used by each process or application in Linux.

From NetHogs Project Page

NetHogs is a small ‘net top’ tool. Instead of breaking the traffic down per protocol or per subnet, as most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded. If there’s suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this. This makes it easy to identify programs that have gone wild and are suddenly taking up your bandwidth.

In this article, you will learn how to install and find out real-time per-process network bandwidth usage with nethogs utility under Unix/Linux operating systems.

How to Install NetHogs in Linux Systems

This NetHogs bandwidth monitoring solution is available across numerous Linux operating systems. Based on the Linux distribution you are running, you can install nethogs from one of the following ways:

Install NetHogs in RHEL, CentOS, Rocky Linux, and AlmaLinux

To install nethogs, you must turn on the EPEL repository under RedHat-based Linux distributions and then run the following yum command to download and install the nethogs package as shown.

# yum install epel-release
# yum install nethogs

On Fedora Linux, use the dnf command as shown.

# dnf install nethogs

Install NetHogs in Ubuntu, Linux Mint, and Debian

To install nethogs, type the following apt command to install nethogs package.

$ sudo apt install nethogs

How to Use NetHogs to Monitor Bandwidth By Process

To run the nethogs utility, type the following command under red-hat-based systems.

# nethogs

On Debian-based Linux, you must have root permissions, so run with the sudo command as shown.

$ sudo nethogs

NetHogs Sample Previews:

As you see above the send and received lines show the amount of traffic being used per process. The total sent and received usage of bandwidth is calculated at the bottom. You can sort and change the order by using the interactive controls discussed below.

NetHogs Command-Line Options

Following are the nethogs command-line options. Using ‘-d‘ to add a refresh rate and ‘device name‘ to monitor specific given device or devices bandwidth (default is eth0).

For example, to set 5 seconds as your refresh rate, then type the command as.

# nethogs -d 5

$ sudo nethogs -d 5

To monitor specific device (eth0) network bandwidth only, use the command as.

# nethogs eth0

$ sudo nethogs eth0

To monitor the network bandwidth of both eth0 and eth1 interfaces, type the following command.

# nethogs eth0 eth1

$ sudo nethogs eth0 eth1

NetHogs Options and Usage

• -d – delay for refresh rate.
• -h – list available commands usage.
• -p – sniff in promiscuous mode (not recommended).
• -t – tracemode.
• -V – show version info.

NetHogs Interactive Controls

Following are some useful interactive controls (Keyboard Shortcuts) of the nethogs program.

• -m – Change the units displayed for the bandwidth in units like KB/sec -> KB -> B-> MB.
• -r – Sort by the magnitude of respective traffic.
• -s – Sort by the magnitude of sent traffic.
• -q – Hit quit to the shell prompt.

For a full list of nethogs utility command-line options, please check out the nethogs man pages by using the command ‘man nethogs‘ or ‘sudo man nethogs‘ from the terminal.

For more information visit the Nethogs project home page.

Take Your Linux Skills to the Next Level

Root members get full access to every course, certification prep track, and a growing library of hands-on Linux content — with new courses added every month.

What You Get

Ad-free access to all premium articles

Access to all courses: Learn Linux, AI for Linux, Bash Scripting, Ubuntu Handbook, Golang and more.

Access to Linux certifications (RHCSA, RHCE, LFCS and LFCA)

Access new courses on release

Get access to weekly newsletter

Priority help in comments

Private Telegram community

Connect with the Linux community

I'm Ravi Saive, an award-winning entrepreneur and founder of several successful 5-figure online businesses, including TecMint.com, GeeksMint.com, UbuntuMint.com, and the premium learning hub Pro.Tecmint.com.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.