This should all be fairly straightforward -- PID, username, process, and network interface, followed by the bandwidth consumed in both the outgoing and incoming directions. The summary line gives you an easy view of how the outgoing and incoming data flows compare.
As you can see, the name of the process that is running is truncated). The network interface may also be truncated (as it is in the example above where the interface is actually enp0s25).
Looking more closely, you will also likely notice that two of the lines in the output above show a truncated rendition of the IP addresses and ports for two of the connections. Were the PROGRAM column wider, we might see something like "192.168.0.26:46186-220.127.116.11:80".
You can also use trace mode with the -t option to watch network connections as they occur.
shs@stinkbug:~$ sudo nethogs -t [sudo] password for shs: Adding local address: 192.168.0.26 Adding local address: fe80::5408:90e7:c23d:6bae Ethernet link detected Waiting for first packet to arrive (see sourceforge.net bug 1019381) Refreshing: unknown TCP/0/0 0 0 Refreshing: sshd: shs@pts/0/8130/1000 0.114063 0.0234375 unknown TCP/0/0 0 0 Refreshing: sshd: shs@pts/0/8130/1000 0.185156 0.0351562 unknown TCP/0/0 0 0
The nethogs output above shows fairly modest network usage. The system is working, but not working up a sweat. If the total bandwidth is considerably higher, you might want to look more deeply into what's going on. But, as I've said before, knowing how your system normally works is key to understanding when it's under unusually high demand. The data below would indicate a considerably busier system with respect to its network usage.
NetHogs version 0.8.5-2 PID USER PROGRAM DEV SENT RECEIVED ? root 192.168.0.11:2049-192.168.0.2:67 406.888 559.587 KB/sec 2861 jdoe /usr/bin/gnome-shell eth1 0.264 2.196 KB/sec ? root unknown TCP 0.000 0.000 KB/sec TOTAL 407.196 561.816 KB/sec
Sign up for Computerworld eNewsletters.