nethogs - Man Page

Net top tool grouping bandwidth per process

Examples (TL;DR)

Synopsis

nethogs [-h] [-V] [-d] [-v] [-t] [-c] [-p] [-a] [-s] [-l] [device(s)]

Description

NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most such tools do, it groups bandwidth by process - and does not rely on a special kernel module to be loaded. So if there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this, and if it's some kind of spinning process, kill it.

Options

-h

display available commands usage

-V

print version info

-d

delay for refresh rate

-v

select view mode

-p

sniff in promiscuous mode (not recommended)

-a

monitor all devices, even loopback/stopped ones

-t

tracemode

-c

limit number of refreshes

-s

sort by traffic sent

-l

display command line

device(s) to monitor. By default eth0 is being used

Interactive Control

m

cycle between display modes (KB/s, KB, B, MB, MB/s, GB/s)

l

display command line

r

sort by 'received'

s

sort by 'sent'

q

quit

Running Without Root

In order to be run by an unprivileged user, nethogs needs the cap_net_admin and cap_net_raw capabilities. These can be set on the executable by using the setcap(8) command, as follows:

sudo setcap "cap_net_admin,cap_net_raw+pe" /usr/local/sbin/nethogs

See Also

netstat(8) tcpdump(1) pcap(3)

Author

Written by Arnout Engelen <arnouten@bzzt.net>.

Info

14 February 2004