NetHogs is a Linux network monitoring tool that groups bandwidth usage by process.
NetHogs solves the problem of identifying which processes are consuming network bandwidth by displaying traffic aggregated per process rather than per protocol or subnet. It works by capturing packets at the user level through libpcap without requiring a kernel module, allowing you to start it immediately when unusual network activity occurs and see which process identifier is responsible. The tool relies heavily on the /proc filesystem, so full functionality including process identification is available only on Linux, though it can be built on macOS and FreeBSD where it will show connections but not associated processes.
NetHogs is a mature tool included in most Linux distributions and suits anyone who needs quick visibility into which running processes are generating network traffic. It is particularly useful for identifying runaway applications consuming bandwidth unexpectedly. The tool requires ncurses development libraries for its text-based interface and libpcap development libraries for packet capture. It can be run without root privileges by setting appropriate Linux capabilities on the executable using setcap, specifically cap_net_admin, cap_net_raw, cap_dac_read_search, and cap_sys_ptrace.
The project maintains the master branch as stable at all times. The codebase follows LLVM coding standards with documented exceptions, and contributors are expected to format new code using the provided make format target. Pull requests that fix style issues are welcomed but should not be mixed with functional changes. The project tracks open enhancement ideas and bugs through its issue tracker.
