How to Find Out What Processes are Using Your Network

If your internet connection feels sluggish, or if you suspect some background application is quietly downloading or uploading massive amounts of data without your permission, you need a way to see exactly what is using your bandwidth. On Linux systems like Ubuntu, you don’t need a heavy graphical application to figure this out; you can use a powerful command-line tool called NetHogs.

What is NetHogs?

Most traditional network monitoring tools (like iftop) show you how much traffic is going to different IP addresses, but they don’t tell you which program on your computer is responsible for that traffic. NetHogs solves this by grouping bandwidth by the specific Process ID (PID) and program name, much like the Windows Task Manager does for CPU usage.

How to Install NetHogs

NetHogs does not come pre-installed on Ubuntu, but it is available in the official repositories. To install it, open your terminal and run:

sudo apt update
sudo apt install nethogs

Enter your password and press ‘Y’ to confirm the installation.

How to Use NetHogs

Because monitoring network traffic requires deep system access, you must run NetHogs with root (sudo) privileges.

sudo nethogs

Once you run the command, your terminal will transform into a live, updating monitor.

Understanding the Output:

• PID: The Process ID number. If you need to forcefully stop a program, this is the number you will use with the kill command.
• USER: Which user account started the process.
• PROGRAM: The exact name of the executable file (e.g., /usr/bin/firefox or /usr/bin/apt).
• DEV: The network interface being used (e.g., eth0 for ethernet or wlan0 for Wi-Fi).
• SENT / RECEIVED: The live upload and download speed for that specific program, usually displayed in kilobytes per second (KB/sec).

NetHogs Keyboard Shortcuts

While NetHogs is running, you can press a few keys to change how the data is displayed:

• m : Changes the display unit. It cycles between KB/sec, KB, B, and MB. (This is very useful if you want to see the total data transferred instead of the current live speed).
• r : Sorts the list by the highest download speed (Received).
• s : Sorts the list by the highest upload speed (Sent).
• q : Quits the program and returns you to the normal terminal prompt.

Conclusion

Whether you are trying to find a runaway background update, a hidden torrent client, or just want to see how much data your web browser is pulling, NetHogs is the fastest and most efficient way to pinpoint the exact culprit on your Ubuntu system.