Linux - Monitoring Network Traffic With nethogs

NetHogs is similar to Linux top command which is an open-source command-line program, that is used for monitoring network traffic in Linux. But do you ever wanted to notice which application in your system is eating up your bandwidth, Then Nethogs is one of the good choices. Nethogs will help you find out what bandwidth an PID is taking up as Nethogs groups bandwidth by process instead of breaking the traffic down per protocol or per subnet. . It is a great choice if you want to identify which program in your Linux system is taking up more bandwidth.

Think of NetHogs as a traffic cop for your internet connection. Instead of lumping all your network activity together, it breaks it down by program—like showing you that your web browser or a sneaky background app is the one slowing things down.

How to Install NetHogs on Debian-Based Linux

Installing NetHogs on Debian-based Linux (such as Ubuntu, Kali Linux, or Debian) is quick and straightforward using the apt package manager. Since NetHogs relies on a couple of libraries for its text-based interface and packet capture, we’ll install those first.

So first we install libncurses5-dev and libpcap0.8-dev on Debian-based machines such as Kali Linux because Nethogs depends on ncurses for the text-based interface and libpcap for user-level packet capture. Use the below command:

sudo apt-get install libncurses5-dev libpcap0.8-dev

Now we have to install nethogs by using the below command:

sudo apt-get install nethogs 

After installing it verify using the below command:

nethogs --version

How to Use NetHogs on Linux

After installing Nethogs we have to type sudo nethogs or normal nethogs if you are already a root user because it won't work without root privileges. 

sudo nethogs

Note: If you’re already logged in as the root user (common on Kali Linux), just type nethogs.

Output:

• PID: The Process ID of the program using the network.
• Program: The name of the app or command (e.g., firefox, curl).
• Device: The network interface being monitored (e.g., eth0 for Ethernet, wlan0 for Wi-Fi).
• Sent: How much data the program is sending (in KB/sec or MB/sec).
• Received: How much data it’s receiving.
• Total: The combined sent and received data.

So as we can see above screenshot is showing a clear view of the program that is consuming my network bandwidth. We can easily understand from the above screenshot that nethogs display us the details about the process id of the program which is currently using the bandwidth, the name of the program which is consuming this bandwidth, the device that is being monitored, sent data details, received data details and all total.

Interpret the Output

The NetHogs display updates in real-time, so you can instantly spot which program is eating your bandwidth. For example:

• A high Sent value for dropbox means it’s uploading files.
• A high Received value for chrome suggests you’re downloading or streaming.

Exit NetHogs

To stop NetHogs, press Ctrl + C in the terminal. It’ll close cleanly, returning you to the command prompt.

NetHogs Command-Line Options

NetHogs comes with handy options to customize how it monitors network traffic. Here’s a rundown of the most useful ones:

-h: display available commands usage.

nethogs -h

-V: Displays the NetHogs version.

nethogs -V

-d <seconds>: Sets the refresh rate (how often the display updates). For example, to refresh every 3 seconds:

You can set 3 seconds as your refresh rate, by typing the following command:-

sudo nethogs -d 3

 
<device>: Monitors a specific network interface (e.g., wlan0 for Wi-Fi or eth0 for Ethernet). To monitor Wi-Fi:

sudo nethogs wlan0

Or multiple interfaces:

sudo nethogs wlan0 eth0

-p: Runs in promiscuous mode to capture all network packets (not recommended, as it can be intrusive).

It will help you to sniff in promiscuous mode but according to the nethog's manual pages it is not recommended, but you can use it by typing the following command:

sudo nethogs -p

-t: Activates tracemode, which outputs connections line by line (useful for scripting or

Trace mode will output the connections one by one, to use tracemode you have to give the following command:

sudo nethogs -t

For more details, check the NetHogs manual:

man nethogs

NetHogs Interactive Controls

While NetHogs is running, you can use keyboard shortcuts to control it:

• m: Toggle between total (cumulative) and current (per-second) bandwidth display.
• q: Quit NetHogs (same as Ctrl + C).
• Up/Down Arrows: Scroll through the list if there are many processes.

These controls make it easy to navigate the text-based interface without leaving the keyboard.

Why Choose NetHogs

NetHogs stands out as the best Linux network monitoring choice because it's:

• Beginner-Friendly: Has a simple text-based interface with easy-to-read output.
• Process-Centric: Displays bandwidth used by program, not only network traffic.
• Lightweight: Runs smoothly on Ubuntu, Kali Linux, or any Debian-based system.
• Customizable: Provides settings such as tracemode and device-specific monitoring.
• Open-Source: Complimentary and actively supported by the Linux community.

Conclusion

NetHogs is your first-choice command-line utility for observing network traffic on Linux. By prioritizing bandwidth use per process, it quickly tells you which applications are causing your internet to slow down. This tutorial demonstrated installing NetHogs on Debian-based Linux such as Ubuntu or Kali Linux, operating its command-line interface, and adjusting settings like refresh interval or device monitoring. From fixing slow connections to optimizing Linux servers, NetHogs is a lean, effective tool for network monitoring.