When an internet connection suddenly slows down or server bandwidth limits are exceeded, identifying the culprit process on Linux can be frustrating. Standard networking utilities like netstat or ss reveal open sockets and connection states, while system monitors like top track CPU and memory usage, but neither tells you how many kilobytes per second a specific program is transmitting or receiving in real time.
bandwhich (previously known as what) bridges this observability gap. Written in Rust, bandwhich sniffs packets traversing your network interfaces, correlates socket connections with active process IDs, and renders an intuitive, real-time terminal user interface. It displays live upload and download speeds categorised by running process, local port, and remote destination IP address.
How bandwhich Correlates Bandwidth with Linux Processes
bandwhich relies on raw network packet sniffing and Linux procfs inspection to build its real-time analytics table:
- Real-Time Packet Sniffing: It captures network frames using packet sockets (or pcap) on specified network interfaces without requiring intrusive kernel modules.
- Socket-to-PID Mapping: bandwhich continuously maps TCP/UDP connection endpoints against open file descriptors in
/proc, identifying the exact executable binary responsible for each traffic spike. - Reverse DNS Resolution: It asynchronously resolves numeric IP addresses into human-readable hostnames and cloud provider domains in the background.
- Multi-Dimensional Panes: The terminal interface divides bandwidth metrics into three correlated views: Process utilisation, Connection endpoints, and Remote addresses.
Installing bandwhich on Linux Distributions
bandwhich is available across official distribution repositories and through the Rust Cargo package manager.
Installing on Arch Linux and Manjaro
Arch Linux packages bandwhich natively in the official community repository:
sudo pacman -S bandwhichInstalling on Ubuntu, Debian, and Linux Mint
On Debian and Ubuntu, you can install the compiled binary via Cargo or download the release package directly from GitHub:
curl -sL https://github.com/imsnif/bandwhich/releases/latest/download/bandwhich-v0.20.0-x86_64-unknown-linux-musl.tar.gz | tar -xz
sudo mv bandwhich /usr/local/bin/Installing via Cargo
If you have Rust and Cargo installed, compile bandwhich from source:
cargo install bandwhichRunning bandwhich with Root Privileges
Because packet sniffing and inspecting socket tables for all running user processes requires administrative access, bandwhich must be executed with sudo:
sudo bandwhichThe terminal immediately clears and presents an interactive, full-screen live bandwidth monitoring dashboard.
Navigating the bandwhich Terminal Interface
The bandwhich interface is divided into three primary horizontal tables:
| Panel | Metrics Displayed | Diagnostic Purpose |
|---|---|---|
| Processes | Process Name, PID, Upload Rate (B/s), Download Rate (B/s). | Pinpoints whether bandwidth spikes stem from curl, Docker, backup agents, or background system updates. |
| Connections | Local IP:Port <> Remote IP:Port, live transfer speed. | Identifies individual socket sessions saturating network interfaces. |
| Remote Addresses | Resolved hostname / IP, total upload, total download. | Reveals external cloud endpoints, CDN nodes, or database targets generating heavy data traffic. |
Press Tab to switch focus between the three panes. Use the Up and Down arrow keys to scroll through long process lists. Press q or Ctrl + C to exit.
Monitoring a Specific Network Interface
By default, bandwhich monitors your primary default gateway interface. If your Linux server runs multiple network cards, VPN tunnels, or virtual bridges (e.g. eth0, wlan0, tun0, or docker0), specify the interface explicitly using the -i flag:
# Monitor Wi-Fi interface
sudo bandwhich -i wlan0
# Monitor a WireGuard or OpenVPN tunnel
sudo bandwhich -i wg0Displaying Raw IP Addresses (Disabling DNS Resolution)
In environments where outbound DNS queries are restricted or slow, resolving remote IP addresses can cause interface lag. You can force bandwhich to display raw IP addresses without performing reverse DNS queries using the --no-dns flag:
sudo bandwhich --no-dnsDisplaying Total Accumulated Data Transfer
If you need to audit cumulative data transferred during a backup or benchmarking session rather than instant transfer rates per second, use the total data mode:
sudo bandwhich --total-utilizationThe columns switch from transfer speeds (e.g. 1.4 MB/s) to cumulative byte counters (e.g. 450 MB Total), allowing you to audit which processes transferred the largest volume of data over time.
Granting Non-Root Access with Linux Capabilities
If you prefer running bandwhich without typing sudo every time, grant the compiled binary network packet sniffing capabilities using setcap:
sudo setcap cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep $(which bandwhich)Once permissions are applied, standard unprivileged users can launch bandwhich directly from their shell prompt.
By combining process correlation with real-time transfer telemetry, bandwhich transforms network troubleshooting on Linux from guesswork into actionable clarity.