7

I'm looking for a utility to continuously monitor network traffic by process.

Something like top but instead of focusing on CPU/memory, I would like to see TCP and UDP ports and throughput for the most network-active processes. I imagine a regularly updated screen with headers like:

PID   USER  PROTO  PORTNO   Kbps   STARTTIME  COMMAND...

The closest I could find are atop and lsof -i. atop shows aggregate network activity in the main screen (not by process). Hitting N for a network focused view gives:

Kernel module 'netatop' not active or no root privs; request ignored!
# When run under sudo, so how do I install the 'netatop' kernel module ?

lsof -i shows the processes holding the ports, but no throughput/activity.

sudo watch netstat -Wtunape is another good option. It includes IP addresses, ports (both local and remote) and even connection states, but doesn't include throughput and process start-time.

Any tips appreciated.

1

1 Answer 1

6

You can use nethogs a small 'net top' tool to continuously monitor network traffic by process.

It has PID, USER, PROGRAM, DEV, SENT and RECEIVE column.

2
  • Thanks! nethogs seems the closest to what I'm looking for. I wasn't aware of it. Wish it would have displayed a PROTO, PORT and process STARTTIME too. This is especially needed for the unknown TCP entries...
    – arielf
    Aug 19, 2014 at 19:42
  • It is very useful command. I am looking for something similar. A command having the same output in addition to the CPU and Mem details ?! any recommendations ?!
    – McLan
    Sep 1, 2016 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .