raboof/nethogs

NetHogs is a command-line monitoring tool for Linux that answers a specific question: which running program is eating your network bandwidth right now? Most network monitoring tools break traffic down by protocol or by which machines are talking to each other. NetHogs takes a different approach and groups all network activity by the process that caused it, so you can immediately spot a program that has suddenly started sending or receiving unusually large amounts of data. The tool reads process information directly from the Linux kernel via the /proc filesystem. Because of this dependency, the full feature set is only available on Linux. You can build it on Mac OS X and FreeBSD, but on those systems it will only show raw connections without linking them to specific programs. Using it is straightforward. You install a couple of standard development libraries (ncurses for the terminal display and libpcap for packet capture), compile the code with a single make command, and run the resulting binary with administrator privileges. Most major Linux distributions already package it, so you can often just install it directly through apt, yum, or pacman rather than building from source. If you prefer not to run it as root every time, you can grant the binary specific capabilities using the setcap command. This allows a regular user to run NetHogs with just the permissions it actually needs, rather than full root access. The codebase also builds as a library called libnethogs, which lets other programs tap into the per-process bandwidth data. The README notes this is experimental and the interface is likely to change. There is also a list of related tools for users who want to monitor traffic from different angles, such as by host, by connection type, or with a graphical interface.