Is there a way to find out what application using most of bandwidth in Linux?
Solution 1
You can try NetHogs.
NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded. If there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this. This makes it easy to indentify programs that have gone wild and are suddenly taking up your bandwidth.
Solution 2
There is quite a few listed here.
My favorites however remain iftop and tcpdump. Wireshark is also a very good option.
Solution 3
Try atop
... to get the most out of it you may have to enable some additional kernel patches (I/O accounting patches).
If atop
isn't an option then use netstat -anp --inet
(as root) to provide a listing of which TCP/UDP ports are in use by which processes (or possibly use lsof
for that). From there simply iterate over each process that's got an open socket and either attach to it using ltrace -S
or strace
to look at the reads, writes, sends and receives, or use tcpdump
with a filter specifying your local IP address(es) and the TCP/UDP ports that were listed.
atop
is certainly the most convenient of these ... if you have it and the necessary kernel support installed. In the past I've had customers and employers set up special systems (different from their production images) for the sole purpose of supporting I/O profiling using atop
. However these other techniques will get you there.
I'm sure we could also do something using SystemTap ... but I don't know of any easy pre-cooked recipes for doing this. SystemTap is very much a programming analysis tool.
Related videos on Youtube
![CTarczon](https://i.stack.imgur.com/1TQd5.png?s=256&g=1)
CTarczon
Yet another developer. All my code samples you could find here are given freely to the public domain on an "as is" basis, but no warranty is given (implied or assumed).
Updated on September 17, 2022Comments
-
CTarczon almost 2 years
I'm looking for an utility that could show me how much of a bandwidth each process are using. It should just print the data and exit as I want to feed that list into conky.
-
Gnoupi almost 15 yearsI have ethical issues with Wireshark, if not alone on the network... Unless you have a way to make it probe only the localhost, in which case I'm interested.
-
Amok almost 15 yearsIf you don't enable promiscuous mode it should only capture traffic directed to your host.
-
CTarczon almost 15 yearsAlmost exactly what I need but it just doesn't work :(
-
CTarczon almost 15 yearsHuh, not one of those utilities can tell me which process are using most bandwidth and that's what I'm after.
-
John.D almost 15 yearsWell, what doesn't work? Any errors? Doesn't it start at all? Console output?
-
zb' about 10 yearsit not works with ipv6
-
Anandu M Das over 9 yearsYou have to run it as root. Promiscous mode is recommended.
sudo nethogs -p eth2
. You have to specify your ethernet if it is not eth0 by default. -
Matthew almost 8 years@vava There's a problem with the one in the repo, it's fixed in 0.8.1 but you have to build from source (which is extremely easy). See this post: askubuntu.com/questions/726601/…
-
vossad01 over 7 years@AnanduMDas
man nethogs
says promiscious mode is "not recommended". -
kurdtpage over 6 yearsNetHogs v0.8.5-2 works fine when installing from apt-get. No need to compile from source
-
SuperSafie almost 6 yearsif you just want to know which process is hogging the network, not the real bandwidth used, you can just use
netstat -anp --inet
, and check theRecv-Q
andSend-Q
columns -
Michael Scheper over 5 yearsHow about that! It's my browser using the most data! Now I just have to find a Nethogs Chrome plug-in. (The Task Manger has a column for the current bandwidth, but not cumulative data use.)