Such known tools like iftop/iptraf display network I/O per interface and per connection. Is there a way to see network I/O statistics per process?


nethogs looks like it will do what you want.

EDIT: I needed to install ncurses-devel, libpcap and libpcap-devel to build.

  • @yag there is no need to add "EDIT" to the post. We can already see the history of what changed. – tshepang May 27 '16 at 14:03
  • @Tshepang I reviewed your edit, I kept the updated link you did but I kept the edit text, as for me it added value, like your edit too. – yagmoth555 May 27 '16 at 14:22
  • @yagmoth555 I mean why keep "EDIT" in the post? We have history to show what has been edited, so there is no need to mention that "text that follows is an edit". – tshepang May 27 '16 at 15:36
  • @Tshepang Oh, Check your edit, you removed the entire line surely by error then, that why I re-edited to keep the line – yagmoth555 May 27 '16 at 15:56
  • @yagmoth555 it was deliberate, and I left the Comment that explains why – tshepang May 27 '16 at 22:32

To find what connections are associated with each process, use lsof. For example:

lsof | grep TCP

That will give you a list of connections, like this:

bash    10887 luke    3u     IPv4 44638801      0t0      TCP littleyerry.example.com:55212->barista.example.com:ldap (ESTABLISHED)
bash    10913 luke    3u     IPv4 44638905      0t0      TCP littleyerry.example.com:55216->barista.example.com:ldap (ESTABLISHED)
ssh     10935 luke    3u     IPv4 44639001      0t0      TCP littleyerry.example.com:55219->barista.example.com:ldap (ESTABLISHED)
ssh     10935 luke    4u     IPv4 44639008      0t0      TCP littleyerry.example.com:59459->launchpad.example.com:ssh (ESTABLISHED)
bash    10938 luke    3u     IPv4 44639107      0t0      TCP littleyerry.example.com:55221->barista.example.com:ldap (ESTABLISHED)

From there, you should be able to find out about each connection individually using the tools you mentioned (iftop, iptraf). You could build a small script to aggregate the specific data that you're looking for.

  • 5
    lsof -niTCP is equivalent but way faster, and lsof -niTCP -sTCP:ESTABLISHED is showing the current connections. – Meow Dec 5 '16 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.