How to Find Out What Processes Are Using Your Network Bandwidth in Linux

The Mystery of the Slow Connection

If your Linux server suddenly slows to a crawl, or if your home network starts buffering wildly while you are watching a film, the immediate assumption is usually that your ISP is having issues. However, the problem often lies inside your own machine.

Unlike Windows, which has a graphical Task Manager that clearly shows exactly which app is downloading data, Linux can be incredibly opaque. If you run a standard system monitor like top or htop, you will see exactly which programs are consuming your CPU and RAM, but they will tell you absolutely nothing about network traffic.

To find out exactly which application or script is secretly hoarding your bandwidth, you need a specialized network monitoring tool. The absolute best, most intuitive command-line tool for this job is called nethogs.

What is Nethogs?

Most Linux network monitoring tools (like iftop or vnstat) group traffic by protocol (TCP/UDP) or by subnet. This is great for network engineers, but useless for a normal user who just wants to know, “Why is my internet slow right now?”

nethogs is different. It groups bandwidth by process. It will literally give you a clean list showing exactly how many kilobytes per second a specific program (like Firefox, Docker, or an apt update) is currently downloading and uploading. It is essentially the “Task Manager” for your internet connection.

How to Install Nethogs

Because it is a specialized diagnostic tool, nethogs is rarely installed by default on any Linux distribution. You will need to download it from your distro’s official software repository.

For Ubuntu, Debian, and Linux Mint:

sudo apt update
sudo apt install nethogs

For Fedora, CentOS, and RHEL:

sudo dnf install nethogs

For Arch Linux:

sudo pacman -S nethogs

How to Use Nethogs to Find the Culprit

Because nethogs needs to intercept live network packets as they enter and leave your computer’s network interface card, it requires root (administrator) privileges to run.

1. Open your terminal.
2. Type the following command and press Enter:

   sudo nethogs

3. Type your password if prompted.

Your terminal will instantly transform into a live, updating dashboard.

How to Read the Dashboard:

• PID: This is the Process ID. If you need to forcefully kill a rogue program, this is the number you need.
• USER: Tells you which user account started the program (e.g., root or your own username).
• PROGRAM: The actual name of the application consuming the data (e.g., /usr/bin/curl or /opt/google/chrome/chrome).
• DEV: The specific network interface the data is travelling through (e.g., eth0 for ethernet, or wlan0 for Wi-Fi).
• SENT / RECEIVED: This is the most important column. It shows you the live upload (Sent) and download (Received) speeds in KB/s. The program using the most bandwidth will automatically be sorted to the very top of the list.

How to Kill a Bandwidth Hog

Once you identify the specific program that is saturating your connection, you have two choices. You can let it finish its download, or you can forcefully terminate it.

If you see a suspicious script running that you did not authorize, or if a massive background update is ruining your current workflow, you can kill the process directly from the terminal without closing nethogs.

1. Look at the PID column for the program you want to stop (for example, let’s say the PID is 4092).
2. Press the Q key on your keyboard to quit the nethogs dashboard and return to the standard command line.
3. Type the kill command followed by the PID:

   sudo kill -9 4092

4. Press Enter.

The rogue program will instantly terminate, and your network bandwidth will return to normal.