224

I think I'm being the victim of a bug here. Sometimes while I'm working (I still don't know why), my network traffic goes up to 200 KB/s and stays that way, even tough I'm not doing anything internet-related.

This sometimes happens to me with the CPU usage. When it does, I just run a top command to find out which process is responsible and then kill it. Problem is: I have no way of knowing which process is responsible for my high network usage. Both the resource monitor and the top command only tell me my total network usage, neither of them tells me process specific network info.

I've found questions here about monitoring total bandwidth usage, but, as I mentioned, that's not what I need. Is there another command I can use to find out which process is getting out of hand?

The command iftop gives results that disagree entirely with the information reported by System Monitor. While the latter claims there's high network traffic, the former claims there's barely 1 KB/s.

I've already tried killing all the obvious ones (Firefox, update-manager, Pidgin, etc) with no luck. So far, restarting the machine is the only way I found of getting rid of the issue.

275

I've had a lot of success with nethogs. It has to run as root but there are different ways you can sort the statistics (like KB/s or total bandwidth monitored since nethogs started).

Also, if you use wireless you need to pass the device to it.

Install it with command: sudo apt-get install nethogs

Example: sudo nethogs wlan0

| improve this answer | |
  • 1
    On closer inspection it's really annoying that it assumes the terminal is always 80 characters wide and truncates the command. – Li Lo Aug 18 '10 at 22:46
  • 3
    It's been a while, but this answer is considerably simpler indeed. – Malabarba Dec 2 '10 at 17:05
  • 2
    nethogs is nice, but it seems to use way more cpu on my computer than iftop – aidan Jul 29 '15 at 6:14
  • 4
    Be warned of a bug making some versions of nethog unusable: askubuntu.com/questions/726601/… – Rmano Mar 12 '16 at 22:20
  • 7
    You don't need to pass the device if you're using wireless. sudo nethogs works fine. – Ads20000 Apr 29 '17 at 15:15
62

Use iftop to locate the TCP port on your machine that is receiving the most traffic. Then use sudo netstat -tup to locate the process "owning" that port.

That's the process you're looking for.

PS: Should work for UDP too.

| improve this answer | |
  • 1
    Thanks, the command seems to work, but I'm getting strange results. System monitor claims a total of around 180KB/s, while iftop claims a total of barely 1 kilobyte per second. – Malabarba Aug 16 '10 at 20:20
  • 2
    I'm accepting the answer since it does answer the original question. But I'll be nice if I can figure out what's going on here. – Malabarba Aug 16 '10 at 20:25
  • iptop displays stats for a single interface. I'm not sure if System monitor looks at only one interface or all of them. If that's the case then there will be traffic shown by System monitor but not shown by iftop, which is OK because you only want to be looking at your internet interface anyway (and not lo). I just tested iftop on my system and it showed what I expected it to. Be aware though that iftop displays averages over 2s,10s,40s respectively. I ran iftop like 'sudo iftop -i eth0 -nPB', how did you run it? – Li Lo Aug 16 '10 at 20:36
  • I ran it as sudo iftop -B -i eth0, that means it was only looking at my internet traffic right? It didn't occur to me that the system monitor might be checking other interfaces as well. Ironically, the problem disappeared 10 minutes ago (after many hours), so I can't check iftop again for now. What does the lo interface stand for? – Malabarba Aug 16 '10 at 20:45
  • 3
    Since there are a lot of numbers on the iftop screen I've created a screenshot where I highlited the number you're interested in. Compare that to System monitor. The screenshot is at imgur.com/2iuiI . "lo" stands for localhost, it's an interface through which local programs can communicate with one another. – Li Lo Aug 16 '10 at 21:09
17

You might want to look into ntop - which should monitor network activity on a process level. You can find ntop in the Software Center or with sudo apt-get install ntop

For installation instruction, follow their page http://packages.ntop.org/

| improve this answer | |
  • 2
    not available with ubuntu 17.04 (zesty) – shadi Nov 25 '17 at 8:41
  • see packages.ntop.org/apt-stable for repos for later versions of ubuntu. also it's apt-get install ntopng – dw1 Dec 2 '18 at 10:58
  • It has its own local server, and is sooo confusing... – rogerdpack Apr 24 at 3:20
8

Another alternative is iptraf. It won't show you the PID of the process, but will tell you which connection uses how much bandwidth.

| improve this answer | |
6

Late answer, but I had the same problem. Turned out to be Ubuntuone. Found that by running tcpdump. I went through the same learning curve on process identification.

From my notes:

Ubuntu box connection information

Started up my Ubuntu 10.04 desktop this morning to find that after a few minutes the Internet connection is crawling. I've seen this on Windows boxes before, and 99% of the time it's spyware. So, I needed to investigate...command line style.

tcpdump. Shows Ubuntuone going crazy.

System>Preferences>Ubuntu One. Turn all synchronization off. That did it.

So, I'm thinking I'd like to see all network connections and what they're doing. I can

netstat -cW (list network connections continuously in wide format so foreign addresses aren't truncated)

lsof -i |grep -v 'localhost' (list open files matching an Internet address of any, grep to remove any open files associated with localhost -- my thought here being that I don't want to see local services as they likely will not affect network utilization).

Some things to take away:

  1. Need to learn about Ubuntu logs for troubleshooting.
  2. Need to learn more about tcpdump, so I'll start with this tutorial by Daniel Miessler.

Editor's note: This answer was referring to tinker's blogspot article which is meant for invited users only. Since this answer has appreciable upvotes, so it is valuable. I found a copy of article on Wayback Machine. And included that here.

| improve this answer | |
1

Here's one I like, it tells you what's reading from the network the most, anyway (doesn't seem to work for which one is "writing to" the network, so...you get half).

$ sudo apt install dstat
then
$ dstat --net --top-io-adv
-net/total- -------most-expensive-i/o-process-------
 recv  send|process              pid  read write cpu
   0     0 |chrome               1885   19k  17k0.4%
 504B  734B|chrome               1923    0   66k0.2%
 651k   18k|chrome               1923  597k 593k2.0%
  19k   26k|gnome-terminal-      25834 429B  59k0.8%

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.