301

I think I'm being the victim of a bug here. Sometimes while I'm working (I still don't know why), my network traffic goes up to 200 KB/s and stays that way, even tough I'm not doing anything internet-related.

This sometimes happens to me with the CPU usage. When it does, I just run a top command to find out which process is responsible and then kill it. Problem is: I have no way of knowing which process is responsible for my high network usage. Both the resource monitor and the top command only tell me my total network usage, neither of them tells me process specific network info.

I've found questions here about monitoring total bandwidth usage, but, as I mentioned, that's not what I need. Is there another command I can use to find out which process is getting out of hand?

The command iftop gives results that disagree entirely with the information reported by System Monitor. While the latter claims there's high network traffic, the former claims there's barely 1 KB/s.

I've already tried killing all the obvious ones (Firefox, update-manager, Pidgin, etc) with no luck. So far, restarting the machine is the only way I found of getting rid of the issue.

2

6 Answers 6

371

I've had a lot of success with nethogs. It has to run as root but there are different ways you can sort the statistics (like KB/s or total bandwidth monitored since nethogs started).

Also, if you use wireless you need to pass the device to it.

Install it with command: sudo apt-get install nethogs

Just run

sudo nethogs

If you want to check the total cumulative sum of bandwidth consumed since you open nethogs, do (it's useful to see which programs consume more bandwidth over the long run)

sudo nethogs -v 3
13
  • 1
    On closer inspection it's really annoying that it assumes the terminal is always 80 characters wide and truncates the command.
    – Li Lo
    Aug 18, 2010 at 22:46
  • 3
    nethogs is nice, but it seems to use way more cpu on my computer than iftop
    – aidan
    Jul 29, 2015 at 6:14
  • 4
    Be warned of a bug making some versions of nethog unusable: askubuntu.com/questions/726601/…
    – Rmano
    Mar 12, 2016 at 22:20
  • 5
    Also, nethogs isn't picking up everything at all! System Monitor is showing I'm receiving continually at 47 Mbps (which is HUGE bandwidth usage!), but nethogs isn't showing this traffic at all! Jan 3, 2020 at 0:22
  • 3
    I have the same issue as as @GabrielStaples. I see a huge difference between system monitor and and nethogs.
    – SaTa
    Oct 2, 2020 at 13:39
77

Use iftop to locate the TCP port on your machine that is receiving the most traffic. Then use sudo netstat -tup to locate the process "owning" that port.

That's the process you're looking for.

PS: Should work for UDP too.

8
  • 1
    Thanks, the command seems to work, but I'm getting strange results. System monitor claims a total of around 180KB/s, while iftop claims a total of barely 1 kilobyte per second.
    – Malabarba
    Aug 16, 2010 at 20:20
  • 2
    I'm accepting the answer since it does answer the original question. But I'll be nice if I can figure out what's going on here.
    – Malabarba
    Aug 16, 2010 at 20:25
  • 1
    iptop displays stats for a single interface. I'm not sure if System monitor looks at only one interface or all of them. If that's the case then there will be traffic shown by System monitor but not shown by iftop, which is OK because you only want to be looking at your internet interface anyway (and not lo). I just tested iftop on my system and it showed what I expected it to. Be aware though that iftop displays averages over 2s,10s,40s respectively. I ran iftop like 'sudo iftop -i eth0 -nPB', how did you run it?
    – Li Lo
    Aug 16, 2010 at 20:36
  • I ran it as sudo iftop -B -i eth0, that means it was only looking at my internet traffic right? It didn't occur to me that the system monitor might be checking other interfaces as well. Ironically, the problem disappeared 10 minutes ago (after many hours), so I can't check iftop again for now. What does the lo interface stand for?
    – Malabarba
    Aug 16, 2010 at 20:45
  • 3
    Since there are a lot of numbers on the iftop screen I've created a screenshot where I highlited the number you're interested in. Compare that to System monitor. The screenshot is at imgur.com/2iuiI . "lo" stands for localhost, it's an interface through which local programs can communicate with one another.
    – Li Lo
    Aug 16, 2010 at 21:09
17

You might want to look into ntop - which should monitor network activity on a process level. You can find ntop in the Software Center or with sudo apt-get install ntop

For installation instruction, follow their page http://packages.ntop.org/

5
  • 4
    not available with ubuntu 17.04 (zesty)
    – Shadi
    Nov 25, 2017 at 8:41
  • 2
    see packages.ntop.org/apt-stable for repos for later versions of ubuntu. also it's apt-get install ntopng
    – dw1
    Dec 2, 2018 at 10:58
  • 3
    It has its own local server, and is sooo confusing...
    – rogerdpack
    Apr 24, 2020 at 3:20
  • E: Unable to locate package ntop No, I will not install and trust a 3rd party package repository of a company I have never heard of. If they haven't been bothered to keep up with the official ubuntu package system then it's probably not worth wasting energy on.
    – Phil_1984_
    Jul 28, 2022 at 20:31
  • @Phil_1984_ ntopng appears to be part of the official 22.04 package system
    – Michael
    Mar 5, 2023 at 23:21
13

Here's one I like, it tells you what's reading from the network the most, anyway (doesn't seem to work for which one is "writing to" the network, so...you get half).

$ sudo apt install dstat
then
$ dstat --net --top-io-adv
-net/total- -------most-expensive-i/o-process-------
 recv  send|process              pid  read write cpu
   0     0 |chrome               1885   19k  17k0.4%
 504B  734B|chrome               1923    0   66k0.2%
 651k   18k|chrome               1923  597k 593k2.0%
  19k   26k|gnome-terminal-      25834 429B  59k0.8%

2
8

Late answer, but I had the same problem. Turned out to be Ubuntuone. Found that by running tcpdump. I went through the same learning curve on process identification.

From my notes:

Ubuntu box connection information

Started up my Ubuntu 10.04 desktop this morning to find that after a few minutes the Internet connection is crawling. I've seen this on Windows boxes before, and 99% of the time it's spyware. So, I needed to investigate...command line style.

tcpdump. Shows Ubuntuone going crazy.

System>Preferences>Ubuntu One. Turn all synchronization off. That did it.

So, I'm thinking I'd like to see all network connections and what they're doing. I can

netstat -cW (list network connections continuously in wide format so foreign addresses aren't truncated)

lsof -i |grep -v 'localhost' (list open files matching an Internet address of any, grep to remove any open files associated with localhost -- my thought here being that I don't want to see local services as they likely will not affect network utilization).

Some things to take away:

  1. Need to learn about Ubuntu logs for troubleshooting.
  2. Need to learn more about tcpdump, so I'll start with this tutorial by Daniel Miessler.

Editor's note: This answer was referring to tinker's blogspot article which is meant for invited users only. Since this answer has appreciable upvotes, so it is valuable. I found a copy of article on Wayback Machine. And included that here.

0
8

Another alternative is iptraf. It won't show you the PID of the process, but will tell you which connection uses how much bandwidth.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .