How to monitor network usage for Linux processes

Luckily, with some popular Linux utilities, it's easy to monitor which processes are using your bandwidth. Here are some of those tools.

1. nethogs

nethogs is a program that does the same Internet connections as htop or top does for CPU and memory usage. It shows you a quick look at which processes are accessing the network.

Like top, htop or atop, nethogs is a full screen program that updates every few seconds to show you current network connections in progress.

Installing nethogs is very simple. You just need to go through your package manager.

For example, on Debian and Ubuntu:

sudo apt install nethogs

And on Arch Linux:

sudo pacman -S nethogs

On the Red Hat family:

sudo dnf install nethogs

To run nethogs, you need to be root:

sudo nethogs

It is possible to set it up so that you can run nethogs as a regular user using this command:

sudo setcap "cap_net_admin,cap_net_raw+pe" /path/to/nethogs

You should replace "/path/to/nethogs" with the absolute pathname of nethogs. You can find this with the which command:

which nethogs

2. lsof

Although lsof is a utility to list open files, it can also list open network connections. The -i option lists the Internet connections associated with processes running on the system. After all, on Linux, everything is a file.

To see the current Internet connections, use this command:

lsof -i

lsof will show you the name of any command with an open Internet connection, its PID, file descriptor, Internet connection type, size, protocol, and the official file name of the connection.

Using the -i4 and -i6 options allows you to see connections that use IPv4 or IPv6.

You most likely have lsof installed already. It's also easy to install on major Linux distributions if you haven't already.

On Debian and Ubuntu, type:

sudo apt install lsof

And on Arch:

sudo pacman -S lsof

On the Red Hat distro line:

sudo dnf install lsof

3. netstat

netstat is a powerful program that allows you to view network connections on your system. It doesn't show you which network connection is attached. As with lsof, you can see this with a command line option.

netstat is part of the network tools package. You can install it on most Linux distributions using the default package manager.

For example, on Debian or Ubuntu:

sudo apt install net-tools

On Arch Linux:

sudo pacman -S net-tools

To install netstat on Fedora, CentOS and RHEL, run:

sudo dnf install net-tools

You can run netstat at the command line. By default, it will show you information like the protocol, address, and status of the connection, but the -p option adds a column showing the process ID and command name.

netstat -p

When you run it, netstat will just list all network connections and then exit. With the -c option , you can see a constantly updated list of connections:

netstat -pc

This would be similar to using a screen-oriented program like nethogs, but the advantage of doing it this way is that you can pipe the output to another program like grep or pager to check it out:

netstat -p | grep 'systemd'

To see all networked processes on your system, you may have to run netstat as root:

sudo netstat

Lesley Montoya

Update 18 August 2023