36

Such known tools like iftop/iptraf display network I/O per interface and per connection. Is there a way to see network I/O statistics per process?

Flow
  • 958
  • 9
  • 15
Anonymous
  • 1,540
  • 1
  • 14
  • 18
  • http://unix.stackexchange.com/questions/6908/is-there-a-tool-that-can-monitor-bandwidth-usage-of-a-single-process | http://superuser.com/questions/189128/something-that-logs-network-traffic-bandwidth-usage-per-process – Ciro Santilli OurBigBook.com May 26 '16 at 20:05

2 Answers2

38

nethogs looks like it will do what you want.

EDIT: I needed to install ncurses-devel, libpcap and libpcap-devel to build.

yagmoth555
  • 16,300
  • 4
  • 26
  • 48
moshen
  • 1,534
  • 1
  • 9
  • 13
  • @yag there is no need to add "EDIT" to the post. We can already see the history of what changed. – tshepang May 27 '16 at 14:03
  • @Tshepang I reviewed your edit, I kept the updated link you did but I kept the edit text, as for me it added value, like your edit too. – yagmoth555 May 27 '16 at 14:22
  • @yagmoth555 I mean why keep "EDIT" in the post? We have history to show what has been edited, so there is no need to mention that "text that follows is an edit". – tshepang May 27 '16 at 15:36
  • @Tshepang Oh, Check your edit, you removed the entire line surely by error then, that why I re-edited to keep the line – yagmoth555 May 27 '16 at 15:56
  • @yagmoth555 it was deliberate, and I left the Comment that explains why – tshepang May 27 '16 at 22:32
  • nethogs took many seconds to start and froze pretty hard with 100% CPU on our OpenSUSE 15.0 production servers (64GB RAM, 16CPU). Seems buggy on busy servers. – Artem Russakovskii Apr 24 '19 at 23:30
6

To find what connections are associated with each process, use lsof. For example:

lsof | grep TCP

That will give you a list of connections, like this:

bash    10887 luke    3u     IPv4 44638801      0t0      TCP littleyerry.example.com:55212->barista.example.com:ldap (ESTABLISHED)
bash    10913 luke    3u     IPv4 44638905      0t0      TCP littleyerry.example.com:55216->barista.example.com:ldap (ESTABLISHED)
ssh     10935 luke    3u     IPv4 44639001      0t0      TCP littleyerry.example.com:55219->barista.example.com:ldap (ESTABLISHED)
ssh     10935 luke    4u     IPv4 44639008      0t0      TCP littleyerry.example.com:59459->launchpad.example.com:ssh (ESTABLISHED)
bash    10938 luke    3u     IPv4 44639107      0t0      TCP littleyerry.example.com:55221->barista.example.com:ldap (ESTABLISHED)

From there, you should be able to find out about each connection individually using the tools you mentioned (iftop, iptraf). You could build a small script to aggregate the specific data that you're looking for.

lukecyca
  • 2,185
  • 13
  • 20
  • 6
    `lsof -niTCP` is equivalent but way faster, and `lsof -niTCP -sTCP:ESTABLISHED` is showing the current connections. – Meow Dec 05 '16 at 12:57