Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Who's hogging the network? Bandwidth usage on a Linux system

Sandra Henry-Stocker | June 16, 2017
How to get a clear view of network bandwidth usage on a Linux system.

This should all be fairly straightforward -- PID, username, process, and network interface, followed by the bandwidth consumed in both the outgoing and incoming directions. The summary line gives you an easy view of how the outgoing and incoming data flows compare.

As you can see, the name of the process that is running is truncated). The network interface may also be truncated (as it is in the example above where the interface is actually enp0s25).

Looking more closely, you will also likely notice that two of the lines in the output above show a truncated rendition of the IP addresses and ports for two of the connections. Were the PROGRAM column wider, we might see something like "192.168.0.26:46186-91.189.11.12:80".

You can also use trace mode with the -t option to watch network connections as they occur.

shs@stinkbug:~$ sudo nethogs -t
[sudo] password for shs:
Adding local address: 192.168.0.26
Adding local address: fe80::5408:90e7:c23d:6bae
Ethernet link detected
Waiting for first packet to arrive (see sourceforge.net bug 1019381)

Refreshing:
unknown TCP/0/0 0       0

Refreshing:
sshd: shs@pts/0/8130/1000       0.114063        0.0234375
unknown TCP/0/0 0       0

Refreshing:
sshd: shs@pts/0/8130/1000       0.185156        0.0351562
unknown TCP/0/0 0       0

The nethogs output above shows fairly modest network usage. The system is working, but not working up a sweat. If the total bandwidth is considerably higher, you might want to look more deeply into what's going on. But, as I've said before, knowing how your system normally works is key to understanding when it's under unusually high demand. The data below would indicate a considerably busier system with respect to its network usage.

NetHogs version 0.8.5-2
  PID USER   PROGRAM                          DEV      SENT    RECEIVED       
?     root   192.168.0.11:2049-192.168.0.2:67        406.888  559.587 KB/sec
2861  jdoe   /usr/bin/gnome-shell             eth1     0.264    2.196 KB/sec
?     root   unknown TCP                               0.000    0.000 KB/sec

  TOTAL                                              407.196  561.816 KB/sec 

 

Previous Page  1  2  3  Next Page 

Sign up for Computerworld eNewsletters.