bandwhich Shows What`s Taking Up Your Network Bandwidth On Linux And macOS

bandwhich is a relatively new terminal bandwidth utilization tool for Linux, *BSD and macOS, written in Rust. It shows the current network utilization by process, connection and remote IP/hostname.

This tool's main purpose is to show what is taking up your bandwidth. It was originally called "what", but its name was changed to bandwhich about 3 weeks ago.

bandwhich is able to show the current network utilization by process, connection and remote IP/hostname by sniffing a given network interface and recording the IP packet size, cross-referencing it with the /proc filesystem on Linux and lsof on macOS. Also, the tool attempts to resolve the IP addresses to their host names in the background, using reverse DNS "on a best effort basis"; this can be disabled using the -n / --no-resolve option.

By default, bandwhich runs in interactive mode and it has 3 panes that show: network utilization by process name, utilization by connection, and utilization by remote address. Because bandwhich has a responsive terminal user interface, the terminal window in which you run bandwhich must be large enough for these 3 panes to be displayed - depending on the window width and/or height, only one or two of these panes may be shown.

bandwhich has a responsive terminal user interface

If you only want to display one of these panes, bandwhich has an option for that - run it with -a / --addresses to only show the addresses table, -c / connections to only show the network connections table, or run it using -p / --processes to only show the processes table.

The feature that allows selecting which panes / tables to show from the command line was added very recently, along with support for IPv6, and VPN traffic sniffing on Mac. Support for WireGuard interfaces was also added fairly recently, as well as a small but useful feature that allows pausing the UI from updating by pressing the SPACE key (this is only for the interactive mode - it doesn't work with the raw mode).

bandwhich running in raw mode, filtering results for "rclone" (bandwhich --raw | grep rclone)

Besides the interactive mode, bandwhich also has a raw mode (to use it run bandwhich with the -r / --raw option) that produces machine friendly output. This mode automatically scrolls the raw output without removing any previous lines. It would be useful if this would show a regular timestamp in the form of %H:%M:%S, but maybe such a feature will be added in a future release.

Related: Analyze Network Traffic With Termshark, A Terminal UI For TShark (Wireshark)

It's also worth noting that by default, bandwhich shows the bandwidth utilization for all available (active) network interfaces. In case you want to specify a particular network interface to listen on, use the -i / --interface option followed by the network interface name, e.g. eth0, enp4s0, or whatever the interface is called.

There are quite a few tools that can show the network bandwidth utilization on the command line, including iftop, nethogs, and others. bandwhich is similar in some aspects, but it also does things differently.

For example iftop, which displays bandwidth usage on an interface by host, doesn't show the process that's utilizing the bandwidth. nethogs on the other hand, a command line tool that groups bandwidth per process (it shows the PID, user, program, interface and the sent/received per PID), is a lot more similar in what information it shows compared to bandwhich, but nethogs lacks a raw output mode which can be useful in various cases. Also, nethogs doesn't show individual connections. The way the information is presented also differs, and I personally quite like the bandwhich terminal user interface.

Anyway, I'm not here to preach but only to inform. Use the tool that you like the most and that's best suited for what you need.

Install bandwhich

The bandwhich project page linked above has installation instructions for Arch Linux, Nix/NixOS, Void Linux, Fedora (Copr), and macOS. There are also instructions for installing bandwhich using Cargo, the Rust package manager, that should work on any Linux distribution. The application does not work on Microsoft Windows, at least for now.

The easiest way to install bandwhich on a Linux distribution for which there are no packages available, is to download the precompiled binary from the bandwhich releases tab, and then extract the archive so you have the bandwhich executable ready to use. You'll probably want to install this somewhere in your $PATH, for example /usr/local/bin - you can install it there using (run this command in the folder where you have extracted the bandwhich binary):

sudo install bandwhich /usr/local/bin

It's important to note that since bandwhich sniffs network packets, it requires root privileges. Run it with sudo on both MacOS and Linux, or for Linux only you can give the bandwhich binary the required privileges so it doesn't require running with sudo, by using:

sudo setcap cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep `which bandwhich`