1NETHOGS(8)                  System Manager's Manual                 NETHOGS(8)
2
3
4

NAME

6       nethogs - Net top tool grouping bandwidth per process
7

SYNOPSIS

9       nethogs [-V] [-h] [-x] [-d seconds] [-v mode] [-c count] [-t] [-p] [-s]
10       [-a] [-l] [-f filter] [-C] [-b] [-g period] [-P pid] [device(s)]
11

DESCRIPTION

13       NetHogs is a small 'net top' tool. Instead of breaking the traffic down
14       per  protocol  or  per subnet, like most such tools do, it groups band‐
15       width by process - and does not rely on a special kernel module  to  be
16       loaded.  So  if there's suddenly a lot of network traffic, you can fire
17       up NetHogs and immediately see which PID is causing this, and  if  it's
18       some kind of spinning process, kill it.
19
20
21   Options
22       -V     prints version.
23
24       -h     prints available commands usage.
25
26       -x     bughunt mode - implies tracemode.
27
28       -d     delay for update refresh rate in seconds. default is 1.
29
30       -v     view  mode (0 = KB/s, 1 = total KB, 2 = total B, 3 = total MB, 4
31              = MB/s, 5 = GB/s). default is 0.
32
33       -c     number of updates. default is 0 (unlimited).
34
35       -t     tracemode.
36
37       -p     sniff in promiscuous mode (not recommended).
38
39       -s     sort output by sent column.
40
41       -l     display command line.
42
43       -a     monitor all devices, even loopback/stopped ones.
44
45       -C     capture TCP and UDP.
46
47       -b     Display the program basename.
48
49       -g     garbage collection period in number of refresh. default is 50.
50
51       -P     Show only processes with the specified pid(s).
52
53       -f     EXPERIMENTAL: specify string pcap filter  (like  tcpdump).  This
54              may be removed or changed in a future version.
55
56
57              device(s)
58              to  monitor.  default is all interfaces up and running excluding
59              loopback
60
61

INTERACTIVE CONTROL

63       q      quit
64
65       s      sort by SENT traffic
66
67       r      sort by RECEIVED traffic
68
69       l      display command line
70
71       b      display the program basename
72
73       m      switch between total (KB, B, MB)  and  throughput  (KB/s,  MB/s,
74              GB/s) mode
75
76

RUNNING WITHOUT ROOT

78       In  order  to  be  run  by  an  unprivileged  user,  nethogs  needs the
79       cap_net_admin and cap_net_raw capabilities. These can be set on the ex‐
80       ecutable by using the setcap(8) command, as follows:
81
82           sudo setcap "cap_net_admin,cap_net_raw+pe" /usr/local/sbin/nethogs
83

Notes

85       1.  When  using  the  -P <pid> option, in a case where a process exited
86       (normally or abruptly), Nethogs does not track that it exited. So,  the
87       operating  system might create a new process (for another program) with
88       the same pid. In this case, this new process will be shown by Nethogs.
89

SEE ALSO

91       netstat(8) tcpdump(1) pcap(3)
92

AUTHOR

94       Written by Arnout Engelen <arnouten@bzzt.net>.
95
96
97
98                               14 February 2004                     NETHOGS(8)
Impressum