YouTip

[ Linux Command Manual](#) * * * nethogs is an open-source Linux command-line tool used for real-time monitoring of network bandwidth usage per process. Unlike traditional network monitoring tools (such as iftop), nethogs does not count traffic based on ports or protocols but directly displays the network activity of each process. * * * ## Why Use nethogs In a Linux system, when network anomalies occur, administrators often need to quickly identify which process is consuming a large amount of bandwidth. nethogs offers the following advantages: 1. **Process-Level Monitoring**: Directly displays network traffic for each process 2. **Real-Time Updates**: Refreshes data every second by default 3. **No Configuration Required**: Works out-of-the-box, no complex setup needed 4. **Lightweight**: Low resource consumption, suitable for use in production environments * * * ## Installing nethogs ### Ubuntu/Debian Systems ## Example sudo apt-get update sudo apt-get install nethogs ### CentOS/RHEL Systems ## Example sudo yum install epel-release sudo yum install nethogs ### Compile and Install from Source ## Example git clone https://github.com/raboof/nethogs cd nethogs make&& sudo make install * * * ## Basic Usage ### Monitor All Network Interfaces sudo nethogs Example Output: PID USER PROGRAM DEV SENT RECEIVED 1234 root /usr/bin/ssh eth0 12.456 5.678 KB/sec 5678 bob /usr/bin/firefox wlan0 45.789 32.123 KB/sec ### Monitor a Specific Network Interface sudo nethogs eth0 ### Set Refresh Interval (Seconds) sudo nethogs -d 5 # Refresh every 5 seconds * * * ## Common Command Options | Option | Description | | --- | --- | | `-d` | Set refresh interval time (seconds) | | `-c` | Exit after refreshing a specified number of times | | `-t` | Trace mode (show cumulative traffic) | | `-p` | Promiscuous mode (listen to all traffic) | | `-V` | Display version information | | `-h` | Display help information | * * * ## Advanced Usage ### 1. Trace a Specific Process sudo nethogs -p | grep "process_name" ### 2. Save Monitoring Results to a File sudo nethogs -t > network_log.txt ### 3. Monitor Processes for a Specific User sudo nethogs -u username ### 4. Combine Options sudo nethogs -d 10 -c 6 eth0 # Refresh every 10 seconds, exit after 6 refreshes * * * ## Output Field Explanation nethogs output contains the following key information: 1. **PID**: Process ID 2. **USER**: User running the process 3. **PROGRAM**: Process name or command line 4. **DEV**: Network interface used 5. **SENT**: Data sending rate for this process (KB/sec) 6. **RECEIVED**: Data receiving rate for this process (KB/sec) * * * ## Practical Application Scenarios ### Scenario 1: Diagnosing Network Slowness sudo nethogs Quickly locate the source of the problem by checking which process is using the most bandwidth. ### Scenario 2: Monitoring Abnormal Server Traffic sudo nethogs -d 30 -c 12 > /var/log/nethogs.log Record network activity every 30 seconds, for a total of 6 minutes. ### Scenario 3: Limiting Bandwidth for a Specific Process ## Example # First, use nethogs to identify high-traffic processes sudo nethogs # Then use tc or wondershaper to limit bandwidth sudo wondershaper eth0 1024 512# Limit upload to 1024Kbps, download to 512Kbps * * * ## Common Issue Resolution ### Issue 1: Insufficient Permissions Error: opening device eth0: Operation not permitted **Solution**: Run nethogs using sudo or as the root user. ### Issue 2: Unable to Identify Process Name PID USER PROGRAM DEV SENT RECEIVED 1234 - - eth0 12.456 5.678 KB/sec **Solution**: The process may have ended, or nethogs does not have sufficient permissions to obtain process information. ### Issue 3: Specific Network Interface Not Supported Error: No such device exists (device_name) **Solution**: Use the `ifconfig` or `ip a` command to confirm the correct interface name. * * * ## Alternative Tool Comparison | Tool | Characteristics | Applicable Scenarios | | --- | --- | --- | | **nethogs** | Displays traffic by process | Quickly locate problematic processes | | **iftop** | Displays traffic by connection | Analyze specific network connections | | **nload** | Displays total traffic by interface | Monitor overall bandwidth usage | | **bmon** | Graphical interface | Visually view traffic trends | * * * ## Summary nethogs is an indispensable network diagnostic tool in the Linux system administrator's toolkit, especially suitable for: 1. Quickly identifying processes with abnormal network activity 2. Monitoring bandwidth usage of various services on a server 3. Troubleshooting network performance issues With the basic usage and advanced techniques introduced in this article, you should be able to proficiently use nethogs to monitor and manage system network traffic. * * Linux Command Manual](#)