/proc

lsof

-n / --no-resolve

bandwhich has a responsive terminal user interface

-a / --addresses

-c / connections

-p / --processes

SPACE

bandwhich running in raw mode, filtering results for "rclone" ( bandwhich --raw | grep rclone )

-r / --raw

-i / --interface

Install bandwhich

$PATH

/usr/local/bin

sudo install bandwhich /usr/local/bin

sudo

sudo setcap cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep `which bandwhich`

This tool's main purpose is to show what is taking up your bandwidth. It was originally called "what", but its name was changed to bandwhich about 3 weeks ago.bandwhich is able to show the current network utilization by process, connection and remote IP/hostname by sniffing a given network interface and recording the IP packet size, cross-referencing it with thefilesystem on Linux andon macOS. Also, the tool attempts to resolve the IP addresses to their host names in the background, using reverse DNS "on a best effort basis"; this can be disabled using theoption.By default, bandwhich runs in interactive mode and it has 3 panes that show: network utilization by process name, utilization by connection, and utilization by remote address. Because bandwhich has a responsive terminal user interface, the terminal window in which you run bandwhich must be large enough for these 3 panes to be displayed - depending on the window width and/or height, only one or two of these panes may be shown.If you only want to display one of these panes, bandwhich has an option for that - run it withto only show the addresses table,to only show the network connections table, or run it usingto only show the processes table.The feature that allows selecting which panes / tables to show from the command line was added very recently, along with support for IPv6, and VPN traffic sniffing on Mac. Support for WireGuard interfaces was also added fairly recently, as well as a small but useful feature that allows pausing the UI from updating by pressing thekey (this is only for the interactive mode - it doesn't work with the raw mode).Besides the interactive mode, bandwhich also has a raw mode (to use it run bandwhich with theoption) that produces machine friendly output. This mode automatically scrolls the raw output without removing any previous lines. It would be useful if this would show a regular timestamp in the form of %H:%M:%S, but maybe such a feature will be added in a future release.It's also worth noting that by default, bandwhich shows the bandwidth utilization for all available (active) network interfaces. In case you want to specify a particular network interface to listen on, use theoption followed by the network interface name, e.g. eth0, enp4s0, or whatever the interface is called.There are quite a few tools that can show the network bandwidth utilization on the command line, including iftop, nethogs, and others. bandwhich is similar in some aspects, but it also does things differently.For example iftop, which displays bandwidth usage on an interface by host, doesn't show the process that's utilizing the bandwidth. nethogs on the other hand, a command line tool that groups bandwidth per process (it shows the PID, user, program, interface and the sent/received per PID), is a lot more similar in what information it shows compared to bandwhich, but nethogs lacks a raw output mode which can be useful in various cases. Also, nethogs doesn't show individual connections. The way the information is presented also differs, and I personally quite like the bandwhich terminal user interface.Anyway, I'm not here to preach but only to inform. Use the tool that you like the most and that's best suited for what you need.The bandwhich project page linked above has installation instructions for Arch Linux, Nix/NixOS, Void Linux, Fedora (Copr), and macOS. There are also instructions for installing bandwhich using Cargo, the Rust package manager, that should work on any Linux distribution. The application does not work on Microsoft Windows, at least for now.The easiest way to install bandwhich on a Linux distribution for which there are no packages available, is to download the precompiled binary from the bandwhich releases tab , and then extract the archive so you have the bandwhich executable ready to use. You'll probably want to install this somewhere in your, for example- you can install it there using (run this command in the folder where you have extracted the bandwhich binary):It's important to note that since bandwhich sniffs network packets, it requires root privileges. Run it withon both MacOS and Linux, or for Linux only you can give the bandwhich binary the required privileges so it doesn't require running with sudo, by using: