---
title: NetHogs — Network Analysis and Diagnostics
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A Linux 'net top' tool that shows bandwidth usage per process.
tags: program, Network Analysis and Diagnostics, nethogs
---

A Linux 'net top' tool that displays bandwidth by process.

## Basic Information

| Program Name | NetHogs |
| --- | --- |
| Brief Description | A Linux 'net top' tool that displays bandwidth by process. |
| Development & Maintenance | Raboof (Andy Postnikov) and community |
| Official Homepage | https://github.com/raboof/nethogs |
| Official Documentation | https://github.com/raboof/nethogs |
| Official Download | https://github.com/raboof/nethogs/releases |
| Supported Operating Systems | Linux (Debian, Ubuntu, Fedora, Arch, etc.) |
| License | GPL-2.0 |
| Stable Version | 0.8.7 — Verified 2026-10-18 |
| GitHub Repository | https://github.com/raboof/nethogs |
| Category | Network Analysis & Diagnostics (Tags: bandwidth, process, network monitoring, linux) |

## What is this program?

NetHogs is a Linux command-line tool that displays total network traffic broken down by process (program). Unlike iftop, which shows traffic by IP/subnet, or nload, which shows it by interface, NetHogs indicates which process is using bandwidth by PID and program name.

It operates using libpcap without a kernel module, allowing you to immediately identify which program is causing a sudden spike in network traffic. Sorting and filtering are also available in its interactive interface.

## What problem does it solve?

- Finds the process causing a sudden increase in server bandwidth.
- Identifies if malicious processes or backdoors are generating abnormal traffic.
- Checks for unexpected network usage after application deployment.
- Tracks bandwidth usage patterns by process within containers or virtual environments.
## Key Features

### Per-Process Bandwidth Separation

Displays upload and download speeds by PID and program name.

- **Use Case**: Used to track the process causing a bandwidth spike.
- **Result**: Instantly shows which program is consuming bandwidth.
- **Limitation**: Kernel threads and processes inside containers are only partially displayed.
### Interactive Sorting

Enables real-time sorting by received data, sent data, or speed.

- **Use Case**: Used to quickly find the process using the most bandwidth.
- **Result**: Top consuming processes appear at the top of the list.
- **Limitation**: Sorting criteria are primarily speed-based by default.
### Multiple Interface Support

Monitors traffic across multiple network interfaces simultaneously.

- **Use Case**: Used in environments with dual NICs, VPNs, or container networks.
- **Result**: Separately view process traffic per interface.
- **Limitation**: The screen can become cluttered with many interfaces.
### No Kernel Module Required

Operates using only libpcap, so no kernel module installation is needed.

- **Use Case**: Used for quick deployment and execution in containers or lightweight environments.
- **Result**: Can be used immediately without installation overhead.
- **Limitation**: Requires packet capture privileges (root or cap_net_raw).
## Installation and Execution

### Ubuntu / Debian (Repository Package)

Install from the distribution repository.

```
sudo apt update
sudo apt install nethogs

# Verify Installation
nethogs --version
```

### Fedora / RHEL

Install using dnf.

```
sudo dnf install nethogs
```

### Arch Linux

Install using pacman.

```
sudo pacman -S nethogs
```

## Practical Usage Examples

### Basic Execution (All Interfaces)

View per-process bandwidth for all network interfaces.

```
# Run with root privileges
sudo nethogs

# Example output:
# PID   PROGRAM         USER        SENT      RECEIVED
# 1234  nginx           www-data    1.5 MB    12.3 MB
# 5678  python3         youngbae    0.2 MB    0.8 MB
```

### Monitor a Specific Interface Only

View process traffic on a designated interface.

```
# Monitor only the eth0 interface
sudo nethogs eth0

# Set refresh interval to 2 seconds
sudo nethogs -d 2 eth0
```

### Track a Specific PID Only

Focus monitoring on a suspicious process's bandwidth.

```
# Track only PID 1234
sudo nethogs -p 1234

# Result: Real-time upload/download speed of that process
```

---
Source (HTML): https://games.aidebatehub.com/programs/apps/network/nethogs.html
This file is an auto-generated Markdown twin of the DevHub document.