--- title: Finding bandwidth hogs on Linux | daily.dev description: Discussion about "Finding bandwidth hogs on Linux" on daily.dev - join the developer community canonical: https://daily.dev/posts/finding-bandwidth-hogs-on-linux-tyykop5gk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Finding bandwidth hogs on Linux | daily.dev og:description: Discussion about "Finding bandwidth hogs on Linux" on daily.dev - join the developer community og:url: https://daily.dev/posts/finding-bandwidth-hogs-on-linux-tyykop5gk og:image: https://api.daily.dev/og/posts/TYyKoP5gK.png og:image:alt: Finding bandwidth hogs on Linux og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Finding bandwidth hogs on Linux **[Pink Pixel](https://daily.dev/sources/j54tds4tcxzzyo9funnch)** · [@sizzlebop](https://daily.dev/sizzlebop) · 0 upvotes · 0 comments ## Content When a Linux server starts feeling slow, uploads stall, or network costs climb, `top` and `htop` can only tell part of the story. They show CPU and memory use, not which process is moving data. For that, start with `nethogs`, then use `iftop` or `ss` to confirm what the process is connected to. If you are working in a stripped-down environment, `/proc` is still there as a fallback. ## Install the tools These packages are available on most Linux distributions: ``` # Ubuntu or Debian sudo apt install nethogs iftop -y # RHEL or Rocky Linux, with EPEL enabled sudo dnf install nethogs iftop -y # Arch Linux sudo pacman -S nethogs iftop -y ``` `net-tools` is not needed for any command in this guide. `ip` and `ss` are normally provided by the already-installed `iproute2` package. On RHEL-family systems, `nethogs` and `iftop` may not be enabled in the default repositories, so enable an appropriate repository first. ## Start with `nethogs` `nethogs` groups current network traffic by process and shows the PID when it can associate traffic with a local socket. It is the fastest way to find the program responsible for a spike. ``` sudo nethogs ``` Replace `` with the network interface you want to inspect, such as `eth0`. Run `ip link show` if you need to find its name. Use this first. Once you have the PID or process name, you can investigate the connection behind it. ## Check destinations with `iftop` `iftop` shows bandwidth by pairs of hosts and their remote IP addresses. It does not identify the owning process, but it answers the next question: which hosts are involved? ``` sudo iftop -i ``` Run `iftop` beside `nethogs` when possible. One shows the process; the other shows busy host pairs and the direction of the data flow. ## Verify sockets with `ss` When you need to confirm a process's active TCP connections, use `ss`. It maps sockets to process names and PIDs. ``` sudo ss -tnp ``` - `-t` shows TCP connections. - `-n` keeps addresses as raw IPs instead of looking up hostnames. - `-p` includes the process name and PID. This is useful when `nethogs` points to a PID and you need to inspect its socket connections or send queue (`Send-Q`). ## Use `/proc` on minimal systems Containers, rescue shells, and stripped-down VMs may not have the monitoring tools installed. In that case, inspect the process's open file descriptors through `/proc`: ``` sudo ls -la /proc//fd | grep socket ``` Entries such as `socket:[123456]` contain a socket inode number. Look for that inode in `/proc//net/tcp` for IPv4 TCP or `/proc//net/tcp6` for IPv6 TCP. Use `/proc//net/udp*` for UDP sockets. These paths inspect the target process's network namespace, which matters when it runs in a container. ## Quick reference | Tool | What it shows | Use it for | | --- | --- | --- | | `nethogs` | Bandwidth per program | Finding the process using traffic | | `iftop` | Bandwidth by host pair | Identifying hosts and traffic flow | | `ss -tnp` | Established TCP sockets | Mapping connections to PIDs | | `/proc` | Socket inodes and protocol tables | Diagnosing minimal systems | ## A practical workflow 1. Run `nethogs` and identify the PID using the bandwidth. 2. Use `ss -tnp` to see that process's TCP connections; use `iftop` to identify busy host pairs on the same interface. 3. Confirm whether the traffic is expected before stopping anything. Routine jobs such as `cron` tasks and `rsync` backups often explain a network spike. A backup that overlaps with another job can look suspicious until you match the PID to the process. Confirm the process identity before killing it. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/finding-bandwidth-hogs-on-linux-tyykop5gk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/finding-bandwidth-hogs-on-linux-tyykop5gk","headline":"Finding bandwidth hogs on Linux","text":"Discussion about \"Finding bandwidth hogs on Linux\" on daily.dev - join the developer community","url":"https://daily.dev/posts/finding-bandwidth-hogs-on-linux-tyykop5gk","datePublished":"2026-07-25T22:23:41.670Z","dateModified":"2026-07-25T22:23:41.670Z","author":{"@type":"Person","name":"Pink Pixel","url":"https://daily.dev/sizzlebop","image":"https://media.daily.dev/image/upload/s--eHrmTnkb--/f_auto/v1785103953/avatars/avatar_J54Tds4tCXZZYo9fUnnch?_a=BAMAMicg0","description":"Open source developer, experimenter, student","worksFor":{"@type":"Organization","name":"Pink Pixel","logo":"https://media.daily.dev/image/upload/s--nTLLDJmi--/f_auto/v1771311286/companies/pinkpixel"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":220}},"image":"https://media.daily.dev/image/upload/s--7mNk_8OP--/f_auto/v1785018222/posts/TYyKoP5gK?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/j54tds4tcxzzyo9funnch","name":"Pink Pixel"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Pink Pixel","item":"https://daily.dev/sources/j54tds4tcxzzyo9funnch"},{"@type":"ListItem","position":3,"name":"Finding bandwidth hogs on Linux"}]} ```