NETHOGS(8)

📦
version 0.9.0 · 3 versions
, in alpine 3.24, arch rolling, debian trixie, epel 10, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu resolute, ubuntu stonking

nethogs 💖

okay bestie, welcome to the manual page for nethogs, from the System Manager's Manual — a lil' "net top" tool that groups bandwidth per process 👑

✨ NAME ✨

nethogs — net top tool grouping bandwidth per process 🦋

🌸 SYNOPSIS 🌸

nethogs [-V] [-h] [-x] [-d seconds] [-v mode] [-c count] [-t] [-p] [-s]
[-a] [-l] [-f filter] [-C] [-b] [-g period] [-P pid] [device(s)]

💅 DESCRIPTION 💅

So NetHogs is this smol "net top" tool, right? And the way most of those tools do it is they break your traffic down per protocol or per subnet. NetHogs said no 🙅‍♀️ — it groups bandwidth by process, and it does not rely on any special kernel module being loaded. No cap.

Which means: if there's suddenly a whole lot of network traffic happening, you just fire up NetHogs and immediately see which PID is causing it. And if it's some kind of spinning process?? You can literally just kill it. slay 💀

🎀 Options 🎀

  • -V — prints version. that's it, that's the whole job 💖
  • -h — prints available commands usage. your little helper 🫶
  • -x — bughunt mode. lowkey implies tracemode too.
  • -d — delay for update refresh rate, in seconds. default is 1.
  • -v — view mode. the vibes are: 0 = kB/s, 1 = total kB, 2 = total bytes, 3 = total MB, 4 = MB/s, 5 = GB/s. default is 0.
    • and the units, bestie: kB: 2e10 bytes, MB: 2e20 bytes, GB: 2e30 bytes ✨
  • -c — number of updates. default is 0 (unlimited — go feral, girl).
  • -t — tracemode.
  • -p — sniff in promiscuous mode. not recommended 🚩
  • -s — sort output by sent column.
  • -l — display command line.
  • -a — monitor all devices, even loopback/stopped ones. inclusivity icon 🌈
  • -C — capture TCP and UDP.
  • -b — Display the program basename.
  • -g — garbage collection period, in number of refresh. default is 50.
  • -P — Show only processes with the specified pid(s).
  • -f — EXPERIMENTAL: specify string pcap filter (like tcpdump). This may be removed or changed in a future version. ⚠️ so don't get too attached
  • device(s) — to monitor. default is all interfaces up and running excluding loopback.

🧚 INTERACTIVE CONTROL 🧚

  • q — quit 👋
  • s — sort by SENT traffic
  • r — sort by RECEIVED traffic
  • l — display command line
  • b — display the program basename
  • m — switch between total (KB, B, MB) and throughput (KB/s, MB/s, GB/s) mode 🔁

👑 RUNNING WITHOUT ROOT 👑

So you wanna run this as an unprivileged user? Respect. But nethogs needs the cap_net_admin and cap_net_raw capabilities. And additionally, to display process names, it needs cap_dac_read_search and cap_sys_ptrace capabilities too. No shortcuts, bestie.

You set these on the executable using the setcap(8) command, like this:

sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" /usr/local/sbin/nethogs

💜 Notes 💜

  1. When using the -P <pid> option, in a case where a process exited (normally or abruptly), Nethogs does not track that it exited. So, the operating system might create a new process (for another program) with the same pid. In this case, this new process will be shown by Nethogs. 😭 (pid recycling is a menace, fr fr)

🔥 SEE ALSO 🔥

netstat(8) tcpdump(1) pcap(3)

🫶 AUTHOR 🫶

Written by Arnout Engelen <arnouten@bzzt.net>.

okay that's the whole page bestie, mwah 💋 this lil' icon is from the System Manager's Manual, the version tag is NETHOGS(8), and it's dated 14 February 2004 — a vintage queen 👑✨ periodt.

📦 where this page comes from