How to Install and Use bandwhich in Linux to Monitor Terminal Bandwidth Utilisation by Process

When a Linux server or development workstation experiences sudden network slowdowns or saturates its upload pipe, identifying the responsible program using standard tools like netstat or ss is difficult. While socket utilities display active connections, they do not show real-time transfer speeds. Conversely, interface monitors like iftop show IP bandwidth but fail to map that traffic back to specific Linux Process IDs (PIDs).

bandwhich (formerly known as what) is an open-source terminal utility written in Rust that sniffs network packets to map live bandwidth consumption directly to running processes, socket connections, and remote hostnames simultaneously. This guide covers how to install, configure, and use bandwhich to diagnose rogue network processes in Linux.

Core Features of bandwhich

• Process-to-Bandwidth Mapping: Instantly exposes which specific executable (e.g. rsync, node, docker) is consuming network bandwidth.
• Three-Pane Dashboard: Displays simultaneous breakdown tables for Processes, Remote Addresses, and Active Sockets.
• Automatic DNS Resolution: Resolves remote IP addresses into human-readable hostnames in the background.
• Zero Kernel Patching: Sniffs packets using raw sockets without requiring kernel modules or invasive eBPF tracing.

Installing bandwhich on Linux

Method 1: Distribution Package Managers

# Arch Linux
sudo pacman -S bandwhich

# Ubuntu / Debian (via pre-compiled GitHub releases)
curl -s https://api.github.com/repos/imsnif/bandwhich/releases/latest | grep "browser_download_url.*x86_64.*linux-musl.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf bandwhich-*.tar.gz
sudo mv bandwhich /usr/local/bin/

Method 2: Using Cargo

cargo install bandwhich

Setting Execution Privileges

Because packet sniffing requires raw network socket access, run bandwhich with sudo or assign raw network capabilities to the binary:

sudo setcap 'cap_net_raw,cap_net_admin+ep' $(which bandwhich)

Running bandwhich

Launch the monitor in your terminal:

sudo bandwhich

Interface Navigation Shortcuts

Keybinding	Triggered Action	Diagnostic Value
Tab	Switch Active Pane	Cycles focus between Processes, Connections, and Remote Addresses
Up / Down	Scroll Table	Inspects long process lists and background sockets
d	Toggle DNS Resolution	Switches between numerical IP addresses and resolved hostnames
q	Quit	Exits the application cleanly

Targeting Specific Network Interfaces

On multi-homed servers or machines with active Docker virtual bridges, bind bandwhich to a specific physical or virtual network interface:

# Monitor primary Ethernet interface
sudo bandwhich -i eth0

# Monitor Docker container bridge
sudo bandwhich -i docker0

Diagnostic Best Practices

• Identifying Unauthorized Outbound Traffic: If an unknown process or suspicious Python script shows continuous upstream bandwidth, use the PID shown in the Processes pane to locate its executable path: ls -l /proc/<PID>/exe.
• Raw IP Mode in Firewalled Environments: If DNS reverse lookups stall due to firewall restrictions, launch bandwhich with -n (bandwhich -n) to display raw IP addresses without lookup delays.