Figuring out what process is eating bandwidth?

Byron Clark byron at
Sat Jan 28 11:58:30 MST 2006

On Sat, Jan 28, 2006 at 11:47:26AM -0700, Ross Werner wrote:
> On Sat, 28 Jan 2006, Justin Findlay wrote:
> >I agree.  In vain I've searched for a utility that will tell me
> >network usage per process on the local machine rather than per network
> >connection.  Inline on top would be perfect.  Perhaps that's the
> >charge given unto us, Ross.  We need to write such a utility.
> I'm up for the challenge ... but is it even possible to get such 
> information? Ethereal and the like just listen on a network device for 
> packets going in and out, but the network device itself doesn't have 
> information about what processes sent those packets, does it? So that 
> information would have to come from somewhere else. Netstat has 
> information about what processes are connected to which ports, but it 
> doesn't have any information about what packets are sent across those 
> ports.
> Would it be possible to tie the two together in user-space?

It looks like atop[1] will show bandwidth usage by process, but requires
a kernel patch for the functionality.  You could probably tie together
pcap and netstat output in userspace if you are willing to deal with not
being able to always correlate the output, but it may just be easier to
apply the atop kernel patch.


Byron Clark
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : 

More information about the PLUG mailing list