Linux See Bandwidth Usage Per Process With Nethogs Tool

I have Red Hat Enterprise Linux 6.x/7.x server. How do I find out and groups network bandwidth usage by process under Linux operating systems? How do I know what programs are using network bandwidth under Linux operating systems? How can I see bandwidth usage per PID, command, and user on a Linux operating systems?

You need to use the nethogs command. It is a small “net top” tool. A tool resembling top for network traffic. From the nethogs project home page:
Tutorial details
DifficultyEasy (rss)
Root privilegesYes
Requirementsnethogs+RHEL/Debian
Ubuntu/CentOS
TimeN/A

ADVERTISEMENTS

Instead of breaking the traffic down per protocol or per subnet, like most such tools do, it groups bandwidth by process and does not rely on a special kernel module to be loaded. So if there’s suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this, and if it’s some kind of spinning process, kill it.

Linux See Bandwidth Usage Per Process With Nethogs

The nethogs tool only works under Linux operating systems. Let us see how to install and use Nethogs tool on Linux operating systems to see bandwidth usage per process.

Install nethogs on a Debian or Ubuntu Linux

Type the following apt-get command/apt-get command:
$ sudo apt-get install nethogs
Sample outputs:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libavutil-extra-51 libggiwmh0-target-x libggi2 libgii1
  libvo-aacenc0 libgii1-target-x mplayer-skin-blue libggiwmh0
  libggi-target-x libvo-amrwbenc0
Use 'apt-get autoremove' to remove them.
The following NEW packages will be installed:
  nethogs
0 upgraded, 1 newly installed, 0 to remove and 4 not upgraded.
Need to get 0 B/28.2 kB of archives.
After this operation, 115 kB of additional disk space will be used.
Selecting previously deselected package nethogs.
(Reading database ... 331881 files and directories currently installed.)
Unpacking nethogs (from .../nethogs_0.7.0-3_amd64.deb) ...
Processing triggers for man-db ...
Setting up nethogs (0.7.0-3) ...

Install nethogs on a RHEL or CentOS or Fedora Linux

First turn on EPEL repo and type the following yum command to install nethogs package:
# yum install nethogs
Sample outputs:

Loaded plugins: product-id, rhnplugin, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
This system is receiving updates from RHN Classic or RHN Satellite.
rhel-x86_64-server-6                          | 1.5 kB     00:00     
rhel-x86_64-server-6/primary                  |  13 MB     00:01     
rhel-x86_64-server-6                                     10127/10127
rhel-x86_64-server-6-debuginfo                | 1.3 kB     00:00     
rhel-x86_64-server-6-debuginfo/primary        | 776 kB     00:00     
rhel-x86_64-server-6-debuginfo                             4240/4240
rhel-x86_64-server-optional-6                 | 1.5 kB     00:00     
rhel-x86_64-server-optional-6-debuginfo       | 1.3 kB     00:00     
rhel-x86_64-server-supplementary-6            | 1.5 kB     00:00     
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package nethogs.x86_64 0:0.8.0-1.el6 will be installed
--> Finished Dependency Resolution
 
Dependencies Resolved
 
=====================================================================
 Package        Arch          Version              Repository   Size
=====================================================================
Installing:
 nethogs        x86_64        0.8.0-1.el6          epel         28 k
 
Transaction Summary
=====================================================================
Install       1 Package(s)
 
Total download size: 28 k
Installed size: 53 k
Is this ok [y/N]: y
Downloading Packages:
nethogs-0.8.0-1.el6.x86_64.rpm                |  28 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : nethogs-0.8.0-1.el6.x86_64                        1/1 
  Verifying  : nethogs-0.8.0-1.el6.x86_64                        1/1 
 
Installed:
  nethogs.x86_64 0:0.8.0-1.el6                                       
 
Complete!

If you are using Fedora Linux, type:
$ sudo dnf install nethogs

Install nethogs on an Arch Linux

$ sudo pacman -S nethogs

Install nethogs on an OpenSuse Linux

# zypper install nethogs

How do I use the nethogs command?

The syntax is:

nethogs
nethogs eth1
nethogs [option] eth0 eth1
nethogs [option] eth0 eth1 ppp0
sudo /usr/sbin/nethogs eth0

Sample outputs:

Fig.01: nethogs in action

Fig.01: nethogs in action

Another output from one of my personal RHEL server:
Fig.02: Linux See Bandwidth Usage Per Process With Nethogs Tool On My Centos/Rhel box

Fig.02: Nethogs in action on my centos/rhel box

Keyboard shortcuts

Use the following interactive controls, when nethogs is running:

  1. m : Cycle between display modes (kb/s, kb, b, mb)
  2. r : Sort by received.
  3. s : Sort by sent.
  4. q : Quit and return to the shell prompt.

Other options

       -d     delay for refresh rate.
       -h     display available commands usage.
       -p     sniff in promiscious mode (not recommended).
       -t     tracemode.
       -V     prints Version info.

A note about error “creating socket failed while establishing local IP – are you root?”

If you get an error that read as follows:

creating socket failed while establishing local IP – are you root?

Make sure you are using the latest version of nethogs and run it as a root user:
$ sudo nethogs eth1

nethogs-qt – Qt-based GUI

Not a fan of the CLI? Try using GUI tool. Here is how to install nethogs-qt on Ubuntu 16.04/18.04 LTS desktop:
$ sudo apt-get install g++ make qt5-default qt5-qmake git libpcap-dev
$ git clone https://github.com/qtproject/qtcharts.git
$ cd qtcharts
$ qmake
$ make
$ sudo make install
$ wget http://slist.lilotux.net/linux/nethogs-qt/nethogs-qt-0.0.4.tgz
$ tar zxvf nethogs-qt-0.0.4.tgz
$ cd nethogs-qt-0.0.4
$ qmake
$ make
$ sudo ./nethogs-qt
$ sudo ./nethogs-qt

Check out related media

This tutorial is also available in a quick video format:


Video 01: Linux: Nethogs Tool Grouping Bandwidth Usage Per Process (PID)

See also
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source/DevOps topics:
CategoryList of Unix and Linux commands
File Managementcat
FirewallCentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNCentOS 8 Debian 10 Firewall Ubuntu 20.04

ADVERTISEMENTS
13 comments… add one
  • Dariusz Mar 8, 2013 @ 9:19

    how better is it from old well known iftop?

    • Teresa e Junior Apr 13, 2013 @ 18:13

      It displays the actual process that is consuming the bandwidth (PID, command, and user).

  • Jalal Hajigholamali Mar 8, 2013 @ 9:23

    Hi,
    very nice and useful article..

    thanks a lot

  • chmod.fr Mar 8, 2013 @ 22:29

    useful, thanks.

  • Majid Mar 14, 2013 @ 13:38

    thanks,very usefull

  • Peter May 7, 2013 @ 20:16

    It’s a nice tool but what’s the point if I can’t see the root process IDs and processes, even if I run it using sudo? I’m not a linux guru and just use ubuntu and I can see a bunch of root processes making connections, constantly, and I believe it’s causing lag in my gaming. So how can I figure out which processes these are?

    It would also be nice if there was a logging option or batch mode. Sometimes it’s not practical to quickly switch to the console to see which process is popping up.

  • koosha Aug 4, 2014 @ 20:17

    and of-course there is:

    sudo pacman -S nethogs

  • Brad Oct 10, 2014 @ 13:47

    It would be handy if there was a way to collapse processes up to their parent. I have hundreds of tor processes running and dozens of apache MPM processes, and I can’t see much of anything due to the way they’re displayed.

  • Venkat Mar 3, 2015 @ 6:36

    very usefull

  • Roger Mar 10, 2015 @ 9:58

    A very useful tool, feeds my needs. Thanks for sharing!

  • felipe1982 Sep 16, 2015 @ 3:02

    I want to keep historical data on programs that push the most bytes on a network over time. Which is the best tool for this job?

  • RonHD Sep 25, 2015 @ 17:44

    Awesome! The tool I’ve been looking for, to tell me what program is responsible for unexpected internet traffic (and at least with Chromium, which web page out of the many tabs I have open), so I can kill the culprit.

  • Kristian Kirilov Dec 28, 2015 @ 14:03

    Thanks for the good tutorial. It is very useful for me.

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.