View Network Usage with nethogs

Nethogs is a small ‘net top’ tool that groups bandwidth by process rather than by protocol or subnet. It provides a convenient, real‐time view of which applications are consuming your network resources. This article dives deep into nethogs: installation, usage patterns, advanced options and integration with popular VPN services.

Table of Contents

• Overview
• Installation
• Basic Usage
• Advanced Options
• Filtering and Sorting
• Using nethogs with VPNs
• Practical Examples
• FAQs
• Conclusion

1. Overview

Functionality: Tracks TCP/UDP traffic by process.
Advantages: Lightweight, no GUI required, cross‐platform (Linux, BSD).

2. Installation

2.1 On Debian/Ubuntu

sudo apt update
sudo apt install nethogs

2.2 On CentOS/RHEL

sudo yum install epel-release
sudo yum install nethogs

2.3 From Source

git clone https://github.com/raboof/nethogs.git
cd nethogs
make
sudo make install

3. Basic Usage

Run sudo nethogs. By default, it monitors all interfaces:

sudo nethogs

To monitor a specific interface (e.g., eth0):

sudo nethogs eth0

4. Advanced Options

• -v [level]: Verbosity (0–3).
• -d [seconds]: Refresh delay.
• -t: Trace mode (machine‐readable output).

5. Filtering and Sorting

While nethogs doesn’t support native filtering by PID or name, you can combine it with other tools:

• Use grep on trace mode:
  sudo nethogs -t grep ssh
• Pipe through awk to sum traffic per PID.

6. Using nethogs with VPNs

When connected to a VPN, traffic is encapsulated within a virtual interface (e.g., tun0). You can attach nethogs directly to that interface.

6.1 Common VPN Services

6.2 Monitoring the VPN Tunnel

sudo nethogs tun0

This will list processes sending data through the encrypted tunnel.

7. Practical Examples

7.1 Identifying a Bandwidth Hog

1. Start nethogs: sudo nethogs
2. Look for processes with high “Sent” or “Recv”.
3. Terminate or throttle the offending application.

7.2 Logging Output

To capture a session:

sudo nethogs -t > /var/log/nethogs.log

8. Frequently Asked Questions

Q: Can nethogs measure data over a period

A: It shows cumulative usage since launch restart to reset counters.

Q: Does it work on Wi-Fi

A: Yes—specify interface (e.g., wlan0).

9. Conclusion

nethogs is an invaluable command‐line utility for real‐time, process‐based network monitoring. Its simplicity, combined with powerful options, helps you quickly pinpoint network usage and optimize performance. Whether you’re troubleshooting local traffic or ensuring your VPN tunnel is secure, nethogs provides clarity on who’s consuming your bandwidth.