Is there tool or a command that helps capture the bandwidth consumption of specific process (PID), just like the System Monitor does, but for a single specific process, as shows the following screenshot enter image description here

I will be happy with a command line tool that at least exports such history to files. (I'm on Ubuntu 16.04)

Update 1

I want at least a tool like Nethogs that can output into files (Nethogs captures only TCP connexions) a similar tool that targets both TCP and UDP would be great

Update 2

Any script, combination of other tools (like wireshark) would help too.


5 Answers 5


Have you looked at the tool atop? According to the man page for it:

"Network load is shown per process if the kernel module `netatop' has been installed."

  • I could not install netatop on ubuntu 20.04. Do you have any instructions?
    – SaTa
    Commented Oct 2, 2020 at 20:25

So since I didn't find any easy/clear/"hit the ground running" solution, I had to made a modest one, fixes, refactoring and more options to come.

-> https://github.com/AymenDaoudi/NeTraf


Nethogs might be what you want.


apt-get install nethogs

or rhel/cent/etc

yum install nethogs

You run it on the network interface, e.g.

nethogs eth0

However, its output is bandwidth per process, sent and received. You can also monitor multiple interfaces.

DESCRIPTION NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most such tools do, it groups band‐ width by process - and does not rely on a special kernel module to be loaded. So if there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this, and if it's some kind of spinning process, kill it.

UPDATE: OP asked for output to file. You can do it with nethogs:

nethogs -d 1 eth0 > output.txt

-d specifies the time interval in between writes... so you could do the above command and get the desired result.

UPDATE2 OP says TCP and UDP is a requirement. Then attempt to use jnettop. A bit older, but does TCP and UDP. It is available in deb/ubuntu and I think RHEL derivatives. example:

jnettop --display text -t 5 --format CSV

This should be pipe-able to a file.

  • I clearly state in the question that Nethogs supports TCP connexions only and I aim to do profiling on an application that uses both TCP and UDP Commented Jan 10, 2017 at 4:47
  • You clearly stated "TCP and UDP would be great". Sorry for my mis-interpretation. I will update my response.
    – number9
    Commented Jan 10, 2017 at 13:42
  • @number9 jnettop seems to be interesting, how ever outputing to a file is not continues, is there a way to log the data continuously as long as I'm using my profiled Application, just like the data is displayed continuously on the screen ? Commented Jan 10, 2017 at 20:01
  • 1
    @number9 the jnettop command doesn't show PIDs too Commented Jan 10, 2017 at 20:06

How about using iftop, to analyze the amount of traffic on certain ports, and then using lsof to determine which process is using which port?

  • can iftop report KB/s for UPs and Downs can it output that to an external file ? Commented Jan 7, 2017 at 21:04

nethogs tool will help to monitor network traffic per process. you can use nethogs -t. here -t is for traverse.

to display total Send and Recv use below command. nethogs -t -v3

you can redirect output into file for further process filtering.

  • Does not show PID. Commented Nov 14, 2020 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .