Nethogs – A Small ‘Net Top’ Tool

Table of Contents#

1. Installation
2. Basic Usage
3. Common Practices
4. Best Practices
5. Example Usage
6. Advanced Features
7. Running Without Root
8. Conclusion
9. References

Installation#

On Debian/Ubuntu#

sudo apt update
sudo apt install nethogs

On RHEL, CentOS, Fedora, Rocky Linux, and AlmaLinux#

On Fedora, nethogs is available directly:

sudo dnf install nethogs

On RHEL, CentOS, Rocky Linux, and AlmaLinux, first enable the EPEL repository:

sudo dnf install epel-release
sudo dnf install nethogs

On Arch Linux#

sudo pacman -S nethogs

Verifying the Installation#

After installing, check the version to confirm:

nethogs -V

Basic Usage#

Once installed, you can simply run nethogs in the terminal. By default, it monitors all network interfaces and displays a table with columns such as PID, Program, DEV (network device), SENT, and RECEIVED.

sudo nethogs

The sudo is required because nethogs needs to access network interfaces and process information at a privileged level.

To set a custom refresh interval (in seconds), use the -d flag:

sudo nethogs -d 3

This updates the display every 3 seconds instead of the default.

Common Practices#

Regular Monitoring#

• Monitoring During Peak Hours: Focus on monitoring during peak usage times (e.g., business hours for office networks) to catch any misbehaving applications that might be consuming excessive bandwidth.

Comparing with Baseline#

• Establish a Baseline: Run nethogs during a period of normal network usage (e.g., when only essential services are running) and note down the typical bandwidth consumption per process. Later, when you suspect an issue, compare the current output with this baseline.

Best Practices#

Filtering by Interface#

If you have multiple network interfaces (e.g., eth0 for wired and wlan0 for wireless), you can specify which interface to monitor.

sudo nethogs eth0

This reduces clutter and allows you to focus on the relevant network connection.

Using Keyboard Shortcuts#

• Sorting: Press s to sort by sent traffic and r to sort by received traffic. This helps quickly identify the processes consuming the most bandwidth.
• Toggle units: Press m to cycle through display units (KB/sec, total KB, total B, total MB).
• Scrolling: Use the Up and Down arrow keys to scroll through the process list.
• Quitting: Press q to quit the nethogs session gracefully.

Logging Output#

You can use trace mode (-t) to log output in a format suitable for piping or redirection to a file:

sudo nethogs -t > nethogs.log 2>&1

The 2>&1 redirects both standard output and standard error to the log file. Unlike interactive mode, trace mode continuously outputs traffic data without refreshing the screen.

Example Usage#

Identifying a Bandwidth-Hogging Application#

Suppose you notice that your network speed is slow. Run nethogs:

sudo nethogs

You might see an output like this:

In this example, firefox (PID 1234) is receiving a relatively large amount of data (1000 KB). If this is unexpected (e.g., you're not actively browsing a data-heavy website), you can investigate further (e.g., check for background downloads or misconfigured plugins).

Advanced Features#

Trace Mode#

nethogs provides a -t trace mode that prints output in a machine-readable format, suitable for logging and further analysis. Unlike interactive mode, trace mode continuously outputs traffic data without refreshing the screen, making it convenient to use with pipes or redirection.

Monitoring Multiple Interfaces#

You can specify multiple network interfaces to monitor simultaneously:

sudo nethogs eth0 wlan0

This is useful when your system has both wired and wireless connections active.

Promiscuous Mode#

The -p flag enables promiscuous mode, which captures all packets on the network segment (not just those destined for the local machine). This is generally not recommended unless you have a specific need for it, as it can be intrusive and produce noisy output.

Python Bindings#

Starting from version 0.8.7, nethogs includes Python bindings (libnethogs), allowing developers to integrate per-process network monitoring into their own scripts and applications. This is experimental but useful for building custom monitoring dashboards.

Remote Monitoring (with Caution)#

You can monitor a remote server's network usage by running nethogs over an SSH session. For a persistent session, combine SSH with tools like tmux or screen:

ssh user@remote-server "sudo nethogs -t"

Ensure your SSH connection is secured and that you have the necessary privileges on the remote system.

Running Without Root#

By default, nethogs requires root privileges. However, you can grant the necessary Linux capabilities to the binary so it can run as a non-root user:

sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" /usr/local/sbin/nethogs

• cap_net_admin and cap_net_raw allow packet capture
• cap_dac_read_search and cap_sys_ptrace allow reading process names from /proc

After setting these capabilities, any user can run nethogs without sudo. Note that these capabilities are lost if the binary is updated or reinstalled.

Conclusion#

nethogs is a simple yet effective tool for per-process network monitoring on Linux. Unlike tools such as iftop or nload that break traffic down by connection or interface, nethogs uniquely groups bandwidth by process, making it easy to identify exactly which application is hogging your network. Its intuitive interface, lightweight design, and useful features like trace mode and interface filtering make it a valuable asset for system administrators, network engineers, and power users. By following the common and best practices outlined above, you can make the most of nethogs to keep your network running smoothly and identify issues promptly.

References#

• nethogs GitHub Repository
• nethogs Releases
• nethogs Man Page (Arch Linux)
• Tecmint: Nethogs – Monitor Linux Network Traffic Usage Per Process
• GeeksforGeeks: Monitoring Network Traffic With nethogs