There are a lot of reasons why systems slow down.
Some process might be bogging down the CPU, you may be seeing a lot of disk contention, or maybe memory is in high demand and a lot of swapping is going on. Then again, the system may be slowed down because of network bandwidth contention.
Like a busy door with too many people wanting to enter and exit at the same time, a system's network connection can represent a serious limiting factor in how well it performs. That said, if you're looking for good, real-time insights on how a system is using its network bandwidth -- in particular which processes may be using far more than their fair share -- you're going to have a hard time beating nethogs.
What is nethogs?
Different than commands such as iftop (for checking bandwidth usage), netstat (for looking at interface statistics), and top (for examining process resource usage as well as CPU and memory usage), the nethogs command provides real-time bandwidth per process statistics that can help you nail down and resolve network interface contention problems.
This open source, command-line tool lets you spot right away what process is responsible when you notice that your network interface is bogged down and you want to pin down what's going on.
The nethogs tool is very likely already installed on your system. It's included in most Linux distributions today. A quick which nethogs command will let you know for sure. If it isn't installed, a sudo yum install nethogs of sudo apt install nethogs command will quickly set it up for you. As with tools like top, nethogs runs on the command line, but it requires that you use sudo or run as root.
Using nethogs is easy, but there are some options worth looking into.
For one thing, you can have the stats updated less frequently than the default once/second with -d option if you'd like to slow things down a bit.Example:
Example: nethogs -d 5
The -r and -s options allow you to sort by the sent or received values instead of overall bandwidth.
If you have multiple network interfaces and just want to examine one of them, use a command such as nethogs eth0. You can specify more than one interface with this option if you like (e.g., nethogs eth0 eth1). The default is to look at all of them.
The output from nethogs will look something like this:
NetHogs version 0.8.5-2 PID USER PROGRAM DEV SENT RECEIVED 6245 _apt ..sr/lib/apt/methods/http enp0s2 0.977 36.629 KB/sec 6244 _apt ..sr/lib/apt/methods/http enp0s2 0.786 18.305 KB/sec 6243 _apt ..sr/lib/apt/methods/http enp0s2 1.507 3.018 KB/sec 2837 shs /usr/lib/firefox/firefox enp0s2 0.403 0.711 KB/sec 5949 shs sshd: shs@pts/2 enp0s2 3.368 0.627 KB/sec 6183 root dirmngr enp0s2 0.000 0.000 KB/sec ? root ..188.8.131.52:46186-91.189 0.000 0.000 KB/sec ? root ..184.108.40.206:48030-91.189 0.000 0.000 KB/sec 6169 root /usr/bin/python3 enp0s2 0.000 0.000 KB/sec ? root unknown TCP 0.000 0.000 KB/sec TOTAL 7.040 59.290 KB/sec
Sign up for Computerworld eNewsletters.