Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I think I'm being the victim of a bug here. Sometimes while I'm working (I still don't know why), my network traffic goes up to 200 KB/s and stays that way, even tough I'm not doing anything internet-related.

This sometimes happens to me with the CPU usage. When it does, I just run a top command to find out which process is responsible and then kill it. Problem is: I have no way of knowing which process is responsible for my high network usage. Both the resource monitor and the top command only tell me my total network usage, neither of them tells me process specific network info.

I've found questions here about monitoring total bandwidth usage, but, as I mentioned, that's not what I need. Is there another command I can use to find out which process is getting out of hand?

The command iftop gives results that disagree entirely with the information reported by System Monitor. While the latter claims there's high network traffic, the former claims there's barely 1 KB/s.

I've already tried killing all the obvious ones (Firefox, update-manager, Pidgin, etc) with no luck. So far, restarting the machine is the only way I found of getting rid of the issue.

share|improve this question

5 Answers 5

up vote 56 down vote accepted

I've had a lot of success with nethogs. It has to run as root but there are different ways you can sort the statistics (like KB/s or total bandwidth monitored since nethogs started).

Also, if you use wireless you need to pass the device to it.

Install it with command: sudo apt-get install nethogs

Example: sudo nethogs wlan0

share|improve this answer
    
+1 This looks to be a one stop solution. –  Li Lo Aug 18 '10 at 13:23
    
This should be the accepted answer, instead of mine. –  Li Lo Aug 18 '10 at 13:46
    
On closer inspection it's really annoying that it assumes the terminal is always 80 characters wide and truncates the command. –  Li Lo Aug 18 '10 at 22:46
    
It's been a while, but this answer is considerably simpler indeed. –  Malabarba Dec 2 '10 at 17:05

Use iftop to locate the TCP port on your machine that is receiving the most traffic. Then use sudo netstat -tup to locate the process "owning" that port.

That's the process you're looking for.

PS: Should work for UDP too.

share|improve this answer
    
Thanks, the command seems to work, but I'm getting strange results. System monitor claims a total of around 180KB/s, while iftop claims a total of barely 1 kilobyte per second. –  Malabarba Aug 16 '10 at 20:20
    
I'm accepting the answer since it does answer the original question. But I'll be nice if I can figure out what's going on here. –  Malabarba Aug 16 '10 at 20:25
    
iptop displays stats for a single interface. I'm not sure if System monitor looks at only one interface or all of them. If that's the case then there will be traffic shown by System monitor but not shown by iftop, which is OK because you only want to be looking at your internet interface anyway (and not lo). I just tested iftop on my system and it showed what I expected it to. Be aware though that iftop displays averages over 2s,10s,40s respectively. I ran iftop like 'sudo iftop -i eth0 -nPB', how did you run it? –  Li Lo Aug 16 '10 at 20:36
    
I ran it as sudo iftop -B -i eth0, that means it was only looking at my internet traffic right? It didn't occur to me that the system monitor might be checking other interfaces as well. Ironically, the problem disappeared 10 minutes ago (after many hours), so I can't check iftop again for now. What does the lo interface stand for? –  Malabarba Aug 16 '10 at 20:45
2  
Since there are a lot of numbers on the iftop screen I've created a screenshot where I highlited the number you're interested in. Compare that to System monitor. The screenshot is at imgur.com/2iuiI . "lo" stands for localhost, it's an interface through which local programs can communicate with one another. –  Li Lo Aug 16 '10 at 21:09

You might want to look into ntop - which should monitor network activity on a process level. You can find ntop in the Software Center or with sudo apt-get install ntop

share|improve this answer

Another alternative is iptraf. It won't shouw you the PID of the process, but will tell you which connection uses how much bandwidth.

share|improve this answer

Late answer, but I had the same problem. Turned out to be Ubuntuone. Found that by running tcpdump. I went through the same learning curve on process identification. My notes are here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.