NetHogs is a Linux command-line tool that shows network bandwidth usage per process in real-time. Learn how to install and use this powerful monitoring utility to track which applications consume your server's network resources.
Publish date: 8/5/2025
Ever wondered which process is eating up all your server's bandwidth? While traditional network monitoring tools show overall interface statistics, they leave you guessing about which specific application or service is the culprit behind unexpected traffic spikes.
Enter NetHogs, a lightweight command-line utility that bridges this gap by displaying real-time network usage statistics grouped by process.
NetHogs is an open-source network monitoring tool designed specifically for Linux systems. It functions as a "top" command for network traffic, providing a live view of which processes are consuming network bandwidth on your system.
The tool operates by capturing network packets and correlating them with running processes through the /proc filesystem. This approach allows NetHogs to attribute network activity directly to specific applications, giving you granular visibility into your system's network behavior.
Unlike comprehensive network analyzers like Wireshark or interface-focused tools like iftop, NetHogs specializes in answering one critical question: which process is using how much bandwidth right now?
NetHogs offers several features that make it particularly useful for server administrators:
Real-time process monitoring: View live network usage statistics updated every few seconds, showing both sent and received traffic for each active process.
Minimal resource overhead: The tool uses very little CPU and memory, making it safe to run on production systems without impacting performance.
Process identification: See the full command line and process ID for each network-active application, making it easy to identify exactly what's consuming bandwidth.
Customizable refresh rates: Adjust the update interval to balance between responsiveness and system impact.
Multiple interface support: Monitor network usage across different network interfaces simultaneously.
Most Linux distributions include NetHogs in their standard repositories, making installation straightforward through your package manager.
sudo apt update
sudo apt install nethogs
For older CentOS and RHEL versions:
sudo yum install nethogs
For newer RHEL distributions such as AlmaLinux, Rocky Linux, and Fedora:
sudo dnf install nethogs
sudo pacman -S nethogs
If you need the latest features or your distribution doesn't include NetHogs, you can compile it from source. NetHogs depends on ncurses for the text-based interface and libpcap for packet capture, so install both development libraries first.
Ubuntu/Debian:
sudo apt-get install build-essential libncurses5-dev libpcap-dev
Yum-based distributions (older CentOS/RHEL):
sudo yum install gcc-c++ libpcap-devel.x86_64 libpcap.x86_64 "ncurses*"
DNF-based distributions (newer RHEL/Fedora):
sudo dnf install gcc-c++ libpcap-devel.x86_64 libpcap.x86_64 "ncurses*"
Getting and building the source:
git clone https://github.com/raboof/nethogs
cd nethogs
make
sudo make install
hash -r
Important: Make sure to change into the nethogs directory before running make. The makefile is located within the cloned repository, not in your current working directory.
You can also download source releases from the GitHub releases page if you prefer not to clone the repository.
NetHogs typically requires root privileges since it needs to capture network packets. The basic syntax is straightforward:
sudo nethogs
This command starts monitoring the default network interface and displays a real-time table showing:
If you need to run NetHogs as a non-root user, you can set the required capabilities on the executable:
sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" /usr/local/sbin/nethogs
This grants the necessary permissions for packet capture (cap_net_admin, cap_net_raw) and process information access (cap_dac_read_search, cap_sys_ptrace) without requiring full root access.
To monitor a particular network interface, specify it as an argument:
sudo nethogs eth0
You can monitor multiple interfaces simultaneously:
sudo nethogs eth0 eth1 wlan0
By default, NetHogs updates every second. Use the -d flag to change the refresh interval:
# Update every 3 seconds
sudo nethogs -d 3
To show network usage for processes owned by specific users:
sudo nethogs -u username
While NetHogs is running, you can use these keyboard shortcuts:
NetHogs proves particularly valuable in several common scenarios that server administrators encounter regularly.
When users report slow network performance or you notice unusual traffic patterns in your monitoring dashboards, NetHogs can quickly identify the source. For instance, you might discover that a backup script is consuming excessive bandwidth during business hours, or that a compromised service is generating unexpected outbound traffic.
On web servers, database servers, or application servers, NetHogs helps verify that network usage aligns with expected patterns. You can confirm that your web server processes are handling the expected load, or identify if background services are consuming more bandwidth than anticipated.
Unexpected network activity often indicates security issues. NetHogs can help detect compromised processes that might be participating in botnets, exfiltrating data, or performing other malicious activities by showing unusual network patterns for system processes.
Understanding which applications consume the most bandwidth helps with infrastructure planning. This data becomes particularly valuable when considering server upgrades or network capacity changes.
The NetHogs display shows network usage in a tabular format that updates continuously. Traffic measurements appear in human-readable units (KB/s, MB/s) and represent the current transfer rate, not cumulative totals.
You'll notice a line labeled "unknown TCP" in the output. This represents traffic that cannot be associated with any specific process, typically because the process terminated before its network activity could be properly attributed. As long as the amount of unknown traffic remains relatively small, it can usually be ignored safely.
Process identification includes both the executable name and command-line arguments, which helps distinguish between multiple instances of the same program running with different configurations.
While Nethogs excels at process-level network monitoring, it has some limitations to keep in mind.
The tool only captures traffic that passes through network interfaces, so local communication between processes using Unix sockets won't appear in the output. Additionally, Nethogs requires root access to function, which may limit its use in environments with strict privilege restrictions.
On systems with very high network throughput, the process of packet capture and correlation can introduce some overhead, though this is typically minimal for most server workloads.
For comprehensive network analysis involving protocol details, connection states, or historical data, you'll need additional tools alongside NetHogs.
You can capture NetHogs output to files for later analysis:
sudo nethogs -t > network_usage.log
The -t flag switches to "tracing mode," which outputs machine-readable text instead of the interactive display.
While NetHogs doesn't have built-in process filtering, you can combine it with other tools:
sudo nethogs -t | grep -E "(apache2|nginx|mysql)"
For automated monitoring, you can parse NetHogs output and send metrics to monitoring systems like Prometheus, Grafana, or custom dashboards.
Consider creating a systemd service to run NetHogs continuously and log output for historical analysis, particularly useful on production servers where ongoing monitoring is important.
NetHogs fills a critical gap in Linux network monitoring by providing process-level visibility into bandwidth usage. Whether you're troubleshooting performance issues, monitoring application behavior, or investigating security concerns, NetHogs offers the specific insight you need to understand which processes are consuming network resources.
The combination of real-time monitoring, minimal overhead, and straightforward output makes NetHogs an essential addition to any system administrator's toolkit. When network issues arise, having the ability to quickly identify the responsible process can save hours of investigation time and prevent costly downtime.
Why not give it a try?
Thanks for reading! If you're looking for reliable digital infrastructure, xTom offers enterprise-grade dedicated servers, colocation services, IP transit solutions, scalable KVM VPS hosting, and more. We'd love to help you next!
NetHogs focuses specifically on showing network usage per process, while tools like iftop show traffic between hosts and vnstat provides historical interface statistics. NetHogs answers "which process is using bandwidth," while other tools answer different networking questions.
Yes, NetHogs can monitor network usage by Docker containers since it tracks processes. Container processes appear in the output with their process IDs, though you may need to correlate PIDs with specific containers using Docker commands.
NetHogs provides very accurate real-time measurements by capturing actual network packets. However, measurements represent instantaneous rates that fluctuate constantly, so observe the tool for several minutes to understand typical usage patterns.
NetHogs has minimal performance impact on most systems. The packet capture process uses very little CPU and memory, making it safe for production use even on busy servers.