How to track LAN usage? (AKA 'top for LAN')
Solution 1
What about nethogs? In my opinion, it is lot more humane. Lists which command/program using network and how much bandwidth for each of them, in realtime.
Install it in ubuntu/debian systems with:
sudo apt-get install nethogs
Run it to monitor your network interface like this:
sudo nethogs eth0
Solution 2
iftop
is a console/shell-based program similar to top that can use the pcap library (also used by tcpdump and wireshark). It is available for Ubuntu from Universe.
sudo aptitude install iftop
sudo iftop
While running an upgrade on an ubuntu system:
With netstat, you can find out what process is connected to a particular port or IP. For ports, its a good idea to prefix with a colon.
sudo netstat -plantu | grep "some_port_number_or_ip_address"
For example, to look at open connections for ssh:
sudo netstat -plantu | grep :22
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2376/sshd
tcp 0 0 10.13.37.122:22 10.13.37.105:59130 ESTABLISHED 4033/sshd: jtimberm
tcp6 0 0 :::22 :::* LISTEN 2376/sshd
You can also look for open port connections with lsof:
sudo lsof -i:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 2376 root 3u IPv4 5613 0t0 TCP *:ssh (LISTEN)
sshd 2376 root 4u IPv6 5615 0t0 TCP *:ssh (LISTEN)
sshd 4033 root 3u IPv4 11608 0t0 TCP 10.13.37.122:ssh->10.13.37.105:59130 (ESTABLISHED)
sshd 4086 jtimberman 3u IPv4 11608 0t0 TCP 10.13.37.122:ssh->10.13.37.105:59130 (ESTABLISHED)
You can get more information about the open files from lsof with -p PID.
sudo lsof -p 2376
(Lots of output from that suppressed)
Solution 3
ntop is your friend. Packages are in linux repos and macports.
Solution 4
In addition to using iftop to identify the address and port that's using bandwidth, you can use netstat to identify the process
sudo netstat -ntp
This will show all TCP connections open and the process name/id attached to each.
Solution 5
nload is a great tool for monitoring bandwidth in real time and easily installed in Ubuntu or Debian with sudo apt-get install nload.
Device eth0 [10.10.10.5] (1/2):
=====================================================================================
Incoming:
. ...|
# ####|
.. |#| ... #####. .. Curr: 2.07 MBit/s
###.### #### #######|. . ## | Avg: 1.41 MBit/s
########|#########################. ### Min: 1.12 kBit/s
........ ################################### .### Max: 4.49 MBit/s
.##########. |###################################|##### Ttl: 1.94 GByte
Outgoing:
########## ########### ###########################
########## ########### ###########################
##########. ########### .###########################
########### ########### #############################
########### ###########..#############################
############ ##########################################
############ ##########################################
############ ########################################## Curr: 63.88 MBit/s
############ ########################################## Avg: 32.04 MBit/s
############ ########################################## Min: 0.00 Bit/s
############ ########################################## Max: 93.23 MBit/s
############## ########################################## Ttl: 2.49 GByte
Another excellent tool is iftop, also easily apt-get'able:
191Mb 381Mb 572Mb 763Mb 954Mb
└────────────┴──────────┴─────────────────────┴───────────┴──────────────────────
box4.local => box-2.local 91.0Mb 27.0Mb 15.1Mb
<= 1.59Mb 761kb 452kb
box4.local => box.local 560b 26.8kb 27.7kb
<= 880b 31.3kb 32.1kb
box4.local => userify.com 0b 11.4kb 8.01kb
<= 1.17kb 2.39kb 1.75kb
box4.local => b.resolvers.Level3.net 0b 58b 168b
<= 0b 83b 288b
box4.local => stackoverflow.com 0b 42b 21b
<= 0b 42b 21b
box4.local => 224.0.0.251 0b 0b 179b
<= 0b 0b 0b
224.0.0.251 => box-2.local 0b 0b 0b
<= 0b 0b 36b
224.0.0.251 => box.local 0b 0b 0b
<= 0b 0b 35b
─────────────────────────────────────────────────────────────────────────────────
TX: cum: 37.9MB peak: 91.0Mb rates: 91.0Mb 27.1Mb 15.2Mb
RX: 1.19MB 1.89Mb 1.59Mb 795kb 486kb
TOTAL: 39.1MB 92.6Mb 92.6Mb 27.9Mb 15.6Mb
Don't forget about the classic and powerful sar and netstat utilities on older *nix!
Related videos on Youtube
![Nấm Lùn](https://i.stack.imgur.com/Bemhu.jpg?s=256&g=1)
Nấm Lùn
Web and mobile Developer, wanterpreneur, Linux user, and Brazilian from Rio de Janeiro but with a foot in Canada :) Currently, I work as a freelancer web developer for Toptal clients, and spend some of my free time as a local Community Leader for the company and helping with meetups @ PHPRio. Toptal is an amazing way to work on projects you like, from all around the world, with a good pay while having fun - and from anywhere you want! If you like the idea, ping me (@igorsantos07) or take a look at the details in the Toptal Application Page :)
Updated on September 17, 2022Comments
-
Nấm Lùn almost 2 years
There's an evil application that is eating ALL my upload bandwidth (I'm brazilian, it's only ~35kbps) for like 80% of the time my PC is turned on.
I would like to know if there's any way to track this usage and discover what app is doing this.
-
jtimberman almost 15 yearsntop is an excellent program, but it is probably overkill and overcomplicated for this.
-
Nấm Lùn almost 15 yearsIn fact i think that using my ADSL router just to solve this small problem is overkill and overcomplicated. I think it's just an easy thing to solve. But thank you for your help!
-
Nấm Lùn almost 15 yearsI think I already have UFW in my Ubuntu.. Anyway I think that this would be a little bit trouble to solve with this approach.. The problem doesn't happen all the time, it, intermitent but a little frequent. But if the other net info apps fails, i'll give the firewall a try! Thank you!
-
Nấm Lùn almost 15 yearsWith this program I could determine where IT was eating my connection... and with netstat I could determine who was doing this. I need to mark those both answers as correct! XD
-
Nấm Lùn almost 15 yearsAs I can't vote "accepted" for both you and
iftop
, I'll accept him - that showed me EXACTLY when and how someone was eating my bandwidth - and vote you up 'cos withnetstat
I could know who I should kill. Thank you! -
Nấm Lùn almost 15 yearsI don't think it's friendly as I would like to... I think there are so much info for what I need. And your answer is not exactly.... helful. But thank you anyway =]
-
Admin almost 15 yearsAlternatively, you can use
lsof -i tcp:80
to concentrate your search on one port. This particular version will list all the processes connected on tcp port 80. -
Nấm Lùn almost 15 yearsI really don't think it's fair to edit your answer and add a lot of new info... but i can't think about any other solution, so.. thank you again =]
-
jtimberman almost 15 years@Igoru Just making the answer better so people get more relevant information if they're searching for questions similar to your own.
-
Nấm Lùn over 14 yearsvery interesting! =D Fix my problem better than the combo iftop+netstat. Not that both are not good, they are awesome, but not for what I needed. =D
-
jtimberman over 12 yearsI ssh'd to an ubuntu system from my mac.
-
Nicholas DiPiazza almost 8 yearsthis doesn't seem to have a batch mode.