Linux nethogs Command

Linux 命令大全Linux Command Encyclopedia

nethogs is an open-source Linux command-line tool used to monitor network bandwidth usage in real time by process. Unlike traditional network monitoring tools (such as iftop), nethogs does not measure traffic based on ports or protocols; instead, it directly displays the network activity of each process.

Why Use nethogs

On Linux systems, when network anomalies occur, administrators typically need to quickly identify which process is consuming a large amount of bandwidth. nethogs offers the following advantages:

  1. Process-level monitoring: directly displays the network traffic of each process
  2. Real-time updates: refreshes data every second by default
  3. No configuration required: works out of the box, no complex setup needed
  4. Lightweight: low resource usage, suitable for production environments

Install nethogs

Ubuntu/Debian Systems

Example

sudo apt-get update
sudo apt-get install nethogs

CentOS/RHEL Systems

Example

sudo yum install epel-release
sudo yum install nethogs

Compile and Install from Source

Example

git clone https://github.com/raboof/nethogs
cd nethogs
make && sudo make install

Basic Usage

Monitor All Network Interfaces

sudo nethogs

Example output:

PID   USER    PROGRAM              DEV        SENT      RECEIVED
1234  root    /usr/bin/ssh         eth0      12.456    5.678 KB/sec
5678  bob     /usr/bin/firefox     wlan0     45.789    32.123 KB/sec

Monitor a Specific Network Interface

sudo nethogs eth0

Refresh Interval Setting (Seconds)

sudo nethogs -d 5  # 每5秒刷新一次

Common Command Options

Option Description
-d Set the refresh interval time (seconds)
-c Exit after refreshing a specified number of times
-t Trace mode (displays cumulative traffic)
-p Promiscuous mode (listens to all traffic)
-V Display version information
-h Display help information

Advanced Usage

1. Track a Specific Process

sudo nethogs -p | grep "进程名"

2. Save Monitoring Results to a File

sudo nethogs -t > network_log.txt

3. Monitor a Specific User's Processes

sudo nethogs -u username

4. Combine Options

sudo nethogs -d 10 -c 6 eth0  # 每10秒刷新一次，共刷新6次后退出

Output Field Explanation

nethogs output includes the following key information:

  1. PID: Process ID
  2. USER: The user running the process
  3. PROGRAM: Process name or command line
  4. DEV: Network interface used
  5. SENT: Data sending rate of the process (KB/sec)
  6. RECEIVED: Data receiving rate of the process (KB/sec)

Practical Application Scenarios

Scenario 1: Diagnosing Slow Network Issues

sudo nethogs

Quickly identify the source of the problem by checking which process occupies the most bandwidth.

Scenario 2: Monitoring Abnormal Server Traffic

sudo nethogs -d 30 -c 12 > /var/log/nethogs.log

Record once every 30 seconds, capturing a total of 6 minutes of network activity.

Scenario 3: Limiting Bandwidth for a Specific Process

Example

# First use nethogs to find high-traffic processes
sudo nethogs

# Then use tc or wondershaper to limit bandwidth
sudo wondershaper eth0 1024 512  # Limit upload to 1024Kbps, download to 512Kbps

Common Problem Solutions

Problem 1: Insufficient Permissions

Error: opening device eth0: Operation not permitted

Solution: Run nethogs with sudo or as the root user.

Problem 2: Unable to Identify Process Name

PID   USER    PROGRAM              DEV        SENT      RECEIVED
1234  -       -                    eth0      12.456    5.678 KB/sec

Solution: The process may have ended, or nethogs does not have sufficient permissions to obtain process information.

Problem 3: Specific Network Interface Not Supported

Error: No such device exists (device_name)

Solution: Use theifconfigorip acommand to confirm the correct interface name.

Alternative Tool Comparison

Tool Features Applicable Scenarios
nethogs Displays traffic by process Quickly locate problematic processes
iftop Displays traffic by connection Analyze specific network connections
nload Displays total traffic by interface Monitor overall bandwidth usage
bmon Graphical interface Visually view traffic trends

Summary

nethogs is an indispensable network diagnostic tool in a Linux system administrator's toolbox, especially suitable for:

  1. Quickly identifying processes with abnormal network activity
  2. Monitoring the bandwidth usage of each service on a server
  3. Troubleshooting network performance issues

With the basic usage and advanced techniques introduced in this article, you should be able to use nethogs proficiently to monitor and manage system network traffic.

Linux 命令大全Linux Command Encyclopedia

Other Extensions