How to Monitor Network Traffic in Linux Using nethogs

If your Linux server or desktop is suddenly experiencing slow internet speeds, it can be frustrating trying to figure out which application is hogging all the bandwidth. While standard monitoring tools like top are great for showing CPU and RAM usage, they don’t tell you anything about network traffic. For that, one of the best and simplest tools available is nethogs.

What is nethogs?

Nethogs is a small ‘net top’ tool. Instead of breaking down traffic by protocol or subnet like most network monitors, it groups bandwidth by process. This means you can look at the terminal screen and instantly see that Firefox is downloading at 5 MB/s, while apt-get is using 2 MB/s.

How to Install nethogs

Nethogs is available in the default repositories of almost all major Linux distributions, making installation a breeze.

For Ubuntu, Debian, or Linux Mint, open your terminal and run:

sudo apt update
sudo apt install nethogs

For Fedora, CentOS, or RHEL-based systems, use:

sudo dnf install nethogs

How to Run nethogs

Because nethogs needs to monitor network interfaces deeply, you must run it with root (sudo) privileges. To launch the tool monitoring your default network interface, simply type:

sudo nethogs

Your terminal will clear, and you will see a live, updating table. The columns display the PID (Process ID), the User running the process, the Program name, and the current Send and Receive speeds (in KB/sec).

Useful nethogs Commands

While nethogs is running, you can use interactive keyboard shortcuts to change how the data is displayed:

• m: Press ‘m’ to cycle between display units. By default, it shows KB/sec. Pressing ‘m’ will switch it to show KB, B, or MB of total transferred data instead of the live speed.
• r: Press ‘r’ to sort the list by received (download) traffic.
• s: Press ‘s’ to sort the list by sent (upload) traffic.
• q: Press ‘q’ to quit the program and return to the normal terminal prompt.

Monitoring Specific Interfaces

If your machine has multiple network connections (like an Ethernet connection and a Wi-Fi connection), nethogs might not pick the one you want to monitor by default. You can specify the interface by adding its name to the command.

For example, to monitor a wireless interface usually named wlan0:

sudo nethogs wlan0

To monitor a specific ethernet interface like eth0:

sudo nethogs eth0

Conclusion

When your internet crawls to a halt, you don’t need to guess which background process is downloading a massive update. By running a quick sudo nethogs, you can immediately identify the culprit process and either wait for it to finish or kill it to regain your bandwidth.