top-like tools on Linux for network

Linux gives you top and htop to monitor CPU and memory by process, but network traffic is different. You need specific tools designed to show which processes are consuming bandwidth. Here are the practical options.

nethogs

nethogs remains the most straightforward tool for real-time network usage per process:

sudo nethogs

It displays incoming and outgoing traffic grouped by process name, updating in real-time. The interface shows:

• Process name/PID
• Sent (out) bandwidth
• Received (in) bandwidth
• Cumulative bandwidth

You can sort by columns, watch specific interfaces, or monitor particular programs. Install it via your package manager:

# Debian/Ubuntu
sudo apt install nethogs

# RHEL/CentOS/Fedora
sudo dnf install nethogs

# Arch
sudo pacman -S nethogs

Run it on a specific interface if needed:

sudo nethogs eth0

iftop

iftop shows bandwidth usage between local and remote hosts in a top-like interface:

sudo iftop -i eth0

This is excellent when you need to see which remote IPs/hosts are consuming traffic rather than which processes. It’s useful for identifying external network behavior without caring about the local process.

# Install
sudo apt install iftop  # Debian/Ubuntu
sudo dnf install iftop  # RHEL/CentOS

ss and netstat

For a one-time snapshot without a live dashboard, use ss to list socket statistics:

ss -tunap | grep ESTAB

This shows established connections per process. It’s faster than netstat and preferred on modern systems. Use it for auditing or scripting rather than real-time monitoring.

nettop (systemd-based)

On systems using systemd, systemd-nettop provides process-based network stats:

sudo systemd-nettop

It integrates with systemd cgroups for accurate per-service accounting rather than per-process.

tc (traffic control) with process attachment

For deeper inspection, Linux traffic control tools can attach to specific processes, though the setup is more complex:

# View qdisc rules
tc qdisc show

This is overkill for simple monitoring but necessary when you need to enforce bandwidth limits per process or container.

Practical workflow

For daily network troubleshooting:

1. Quick check: sudo nethogs — see which processes are using bandwidth right now
2. Remote host analysis: sudo iftop — understand traffic patterns between hosts
3. Connection audit: ss -tunap — list all listening sockets and their owners
4. Scripted monitoring: Parse /proc/net/dev or use vnstat for historical traffic without live overhead

nethogs handles most use cases. It’s lightweight, doesn’t require deep kernel knowledge, and mirrors the experience of using top for CPU/memory. If you need to see remote host traffic instead of process ownership, switch to iftop. For automation or scripting, combine ss output with standard Unix tools.