Who – s hogging the network? Bandwidth usage on a Linux system #bandwith #usage


Who’s hogging the network? Bandwidth usage on a Linux system

There are a lot of reasons why systems slow down.

Some process might be bogging down the CPU, you may be seeing a lot of disk contention, or maybe memory is in high demand and a lot of swapping is going on. Then again, the system may be slowed down because of network bandwidth contention.

Like a busy door with too many people wanting to enter and exit at the same time, a system’s network connection can represent a serious limiting factor in how well it performs. That said, if you’re looking for good, real-time insights on how a system is using its network bandwidth — in particular which processes may be using far more than their fair share — you’re going to have a hard time beating nethogs .

What is nethogs?

Different than commands such as iftop (for checking bandwidth usage), netstat (for looking at interface statistics), and top (for examining process resource usage as well as CPU and memory usage), the nethogs command provides real-time bandwidth per process statistics that can help you nail down and resolve network interface contention problems.

This open source, command-line tool lets you spot right away what process is responsible when you notice that your network interface is bogged down and you want to pin down what’s going on.

Getting nethogs

The nethogs tool is very likely already installed on your system. It’s included in most Linux distributions today. A quick which nethogs command will let you know for sure. If it isn’t installed, a sudo yum install nethogs of sudo apt install nethogs command will quickly set it up for you. As with tools like top. nethogs runs on the command line, but it requires that you use sudo or run as root.

Using nethogs

Using nethogs is easy, but there are some options worth looking into.

For one thing, you can have the stats updated less frequently than the default once/second with -d option if you’d like to slow things down a bit.Example:

The -r and -s options allow you to sort by the sent or received values instead of overall bandwidth.

If you have multiple network interfaces and just want to examine one of them, use a command such as nethogs eth0. You can specify more than one interface with this option if you like (e.g. nethogs eth0 eth1 ). The default is to look at all of them.

The output from nethogs will look something like this:

This should all be fairly straightforward — PID, username, process, and network interface, followed by the bandwidth consumed in both the outgoing and incoming directions. The summary line gives you an easy view of how the outgoing and incoming data flows compare.

As you can see, the name of the process that is running is truncated). The network interface may also be truncated (as it is in the example above where the interface is actually enp0s25).

Looking more closely, you will also likely notice that two of the lines in the output above show a truncated rendition of the IP addresses and ports for two of the connections. Were the PROGRAM column wider, we might see something like “ “.

You can also use trace mode with the -t option to watch network connections as they occur.

The nethogs output above shows fairly modest network usage. The system is working, but not working up a sweat. If the total bandwidth is considerably higher, you might want to look more deeply into what’s going on. But, as I’ve said before, knowing how your system normally works is key to understanding when it’s under unusually high demand. The data below would indicate a considerably busier system with respect to its network usage.


The nethogs command is a great tool for looking at one important aspect of system performance. It can be used with other important commands to get a clear idea how systems are working and can be invaluable in nailing down performance problems when the network interface is what’s slowing things down.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Sandra Henry-Stocker has been administering Unix systems for more than 30 years. She describes herself as “USL” (Unix as a second language) but remembers enough English to write books and buy groceries. She lives in the mountains in Virginia where, when not working with or writing about Unix, she’s chasing the bears away from her bird feeders.

Must read: 10 new UI features coming to Windows 10

Leave a Reply

Your email address will not be published. Required fields are marked *