5

I'm looking for a utility to continuously monitor network traffic by process.

Something like top but instead of focusing on CPU/memory, I would like to see TCP and UDP ports and throughput for the most network-active processes. I imagine a regularly updated screen with headers like:

PID   USER  PROTO  PORTNO   Kbps   STARTTIME  COMMAND...

The closest I could find are atop and lsof -i. atop shows aggregate network activity in the main screen (not by process). Hitting N for a network focused view gives:

Kernel module 'netatop' not active or no root privs; request ignored!
# When run under sudo, so how do I install the 'netatop' kernel module ?

lsof -i shows the processes holding the ports, but no throughput/activity.

Any tips appreciated.

5

You can use nethogs a small 'net top' tool to continuously monitor network traffic by process.

It has PID, USER, PROGRAM, DEV, SENT and RECEIVE column.

  • Thanks! nethogs seems the closest to what I'm looking for. I wasn't aware of it. Wish it would have displayed a PROTO, PORT and process STARTTIME too. This is especially needed for the unknown TCP entries... – arielf Aug 19 '14 at 19:42
  • It is very useful command. I am looking for something similar. A command having the same output in addition to the CPU and Mem details ?! any recommendations ?! – McLan Sep 1 '16 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.