Linux - Monitoring Network Traffic With nethogs
Last Updated :
01 May, 2025
NetHogs is similar to Linux top command which is an open-source command-line program, that is used for monitoring network traffic in Linux. But do you ever wanted to notice which application in your system is eating up your bandwidth, Then Nethogs is one of the good choices. Nethogs will help you find out what bandwidth an PID is taking up as Nethogs groups bandwidth by process instead of breaking the traffic down per protocol or per subnet. . It is a great choice if you want to identify which program in your Linux system is taking up more bandwidth.
Think of NetHogs as a traffic cop for your internet connection. Instead of lumping all your network activity together, it breaks it down by program—like showing you that your web browser or a sneaky background app is the one slowing things down.
How to Install NetHogs on Debian-Based Linux
Installing NetHogs on Debian-based Linux (such as Ubuntu, Kali Linux, or Debian) is quick and straightforward using the apt package manager. Since NetHogs relies on a couple of libraries for its text-based interface and packet capture, we’ll install those first.
So first we install libncurses5-dev and libpcap0.8-dev on Debian-based machines such as Kali Linux because Nethogs depends on ncurses for the text-based interface and libpcap for user-level packet capture. Use the below command:
sudo apt-get install libncurses5-dev libpcap0.8-dev
sudo apt-get install libncurses5-dev libpcap0.8-dev
Now we have to install nethogs by using the below command:
sudo apt-get install nethogs
sudo apt-get install nethogsAfter installing it verify using the below command:
nethogs --version
How to Use NetHogs on Linux
After installing Nethogs we have to type sudo nethogs or normal nethogs if you are already a root user because it won't work without root privileges.
sudo nethogs
Note: If you’re already logged in as the root user (common on Kali Linux), just type nethogs.
sudo nethogsOutput:
Nethogs Interface on my linux system- PID: The Process ID of the program using the network.
- Program: The name of the app or command (e.g., firefox, curl).
- Device: The network interface being monitored (e.g., eth0 for Ethernet, wlan0 for Wi-Fi).
- Sent: How much data the program is sending (in KB/sec or MB/sec).
- Received: How much data it’s receiving.
- Total: The combined sent and received data.
So as we can see above screenshot is showing a clear view of the program that is consuming my network bandwidth. We can easily understand from the above screenshot that nethogs display us the details about the process id of the program which is currently using the bandwidth, the name of the program which is consuming this bandwidth, the device that is being monitored, sent data details, received data details and all total.
Interpret the Output
The NetHogs display updates in real-time, so you can instantly spot which program is eating your bandwidth. For example:
- A high Sent value for dropbox means it’s uploading files.
- A high Received value for chrome suggests you’re downloading or streaming.
Exit NetHogs
To stop NetHogs, press Ctrl + C in the terminal. It’ll close cleanly, returning you to the command prompt.
NetHogs Command-Line Options
NetHogs comes with handy options to customize how it monitors network traffic. Here’s a rundown of the most useful ones:
-h: display available commands usage.
nethogs -h
nethogs -h
-V: Displays the NetHogs version.
nethogs -V
sudo nethogs -V
-d <seconds>: Sets the refresh rate (how often the display updates). For example, to refresh every 3 seconds:
You can set 3 seconds as your refresh rate, by typing the following command:-
sudo nethogs -d 3
sudo nethogs -d 3
<device>: Monitors a specific network interface (e.g., wlan0 for Wi-Fi or eth0 for Ethernet). To monitor Wi-Fi:
sudo nethogs wlan0
Or multiple interfaces:
sudo nethogs wlan0 eth0
sudo nethogs wlan0 pan1-p: Runs in promiscuous mode to capture all network packets (not recommended, as it can be intrusive).
It will help you to sniff in promiscuous mode but according to the nethog's manual pages it is not recommended, but you can use it by typing the following command:
sudo nethogs -p
sudo nethogs -p wlan0
-t: Activates tracemode, which outputs connections line by line (useful for scripting or
Trace mode will output the connections one by one, to use tracemode you have to give the following command:
sudo nethogs -t
sudo nethogs -t wlan0For more details, check the NetHogs manual:
man nethogs
nethogs manualNetHogs Interactive Controls
While NetHogs is running, you can use keyboard shortcuts to control it:
- m: Toggle between total (cumulative) and current (per-second) bandwidth display.
- q: Quit NetHogs (same as Ctrl + C).
- Up/Down Arrows: Scroll through the list if there are many processes.
These controls make it easy to navigate the text-based interface without leaving the keyboard.
Why Choose NetHogs
NetHogs stands out as the best Linux network monitoring choice because it's:
- Beginner-Friendly: Has a simple text-based interface with easy-to-read output.
- Process-Centric: Displays bandwidth used by program, not only network traffic.
- Lightweight: Runs smoothly on Ubuntu, Kali Linux, or any Debian-based system.
- Customizable: Provides settings such as tracemode and device-specific monitoring.
- Open-Source: Complimentary and actively supported by the Linux community.
Conclusion
NetHogs is your first-choice command-line utility for observing network traffic on Linux. By prioritizing bandwidth use per process, it quickly tells you which applications are causing your internet to slow down. This tutorial demonstrated installing NetHogs on Debian-based Linux such as Ubuntu or Kali Linux, operating its command-line interface, and adjusting settings like refresh interval or device monitoring. From fixing slow connections to optimizing Linux servers, NetHogs is a lean, effective tool for network monitoring.
Similar Reads
Linux - Network Monitoring Tools
Network monitoring is using a system (hardware or software) that continuously observes your network and the data flows through it, depending on how the monitoring solution actually functions and informs the network administrator. We can keep a check on all the activities of our network easily. While
4 min read
What is Network Traffic Analysis in Cybersecurity?
Network traffic analysis (NTA) is a way of monitoring network availability and activity to identify anomalies, such as security and operational issues. Network Traffic Analysis in Cybersecurity means monitoring the data that goes through a computer network. It helps to detect and prevent bad things
6 min read
How to Monitor Network Traffic Using Wireshark in Windows?
Monitoring network traffic is critical for diagnosing network issues, analyzing performance, and enhancing security. Wireshark is an important and generally- used network protocol analyzer that allows you to capture and inspect packets in real- time on your Windows system. In this article, we will w
5 min read
Espionage - Network Packet And Traffic Interceptor
Espionage is a free and open-source tool available on GitHub. This is a free tool that can be downloaded and installed free of cost. Espionage is a network sniffer. Espionage performs sniffing on data packets of the network. Espionage is used to intercept data packets at the time when data is passed
2 min read
saidar Utility - Monitor the Linux Box
Saidar is a curses-based (Curses-based software is software whose user interface is implemented through the curses library) tool for viewing system statistics and monitors the Linux system. It is a command-line based tool as it is run on a terminal. To install saidar on Debian based Linux system run
3 min read
What is Traffic Throttling in Computer Networks?
A network is made by connecting various devices either through ethernet or by connecting them wirelessly. When the performance of the network reduces due to the availability of so many packets in the subnet it is known as congestion. If the size of the router is small it leads to congestion and even
4 min read
What is Prometheus Monitoring ?
In a dynamic era of international reality, important to maintain the capacity and effectiveness of systems. an increasing number of teams rely on robust and distributed architectures, the need for effective tracking solutions has once again to be discussed. Prometheus, an open supply chain monitorin
6 min read
Network Traffic Analysis Visualization in R
In today's interconnected world, where the internet plays a crucial role in both personal and professional spheres, understanding network traffic becomes paramount. Network traffic analysis involves the monitoring and analysis of data flowing across a network, which helps identify patterns, anomalie
8 min read
How To Monitor AWS VPC Traffic ?
AWS VPC traffic monitoring is very important in terms of maintaining cloud VPCs and security. Traffic monitoring allows for the monitoring of incoming and outgoing traffic in the vpc. It helps in the resolution of threats, and network issues and ensures compliance. Let's understand how we can perfor
5 min read
Monitoring Linux Users and Processes in Real Time Using whowatch
Whowatch is a console-based, interactive user and process monitoring tool. Whowatch shows the information about the user's currently logged on the machine, in real-time. It shows the information like login name, tty, host, user's processes of logging user's. whowatch shows all processes of the selec
2 min read