Linux – On Linux, how can I tell which process is sending Ethernet packets

debianlinuxnetwork-monitoring

I'm running gkrellm which shows that some process on my Debian Linux system is writing approx 500KB/s to eth0. I'd like to find out which process it is. I know a little bit about netstat, but it shows a gazillion open TCP connections and I can't seem to make it produce any information about traffic.

Does anybody know how I can get a list of processes that are actually using the eth0 interface so that I can track down the offender?


FOLLOWUP: The Debian Linux distribution contains a nethogs package which solves this problem definitively. Related tools that are not quite on the mark include iftop, netstat, and lsof.

Best Answer

I prefer nethogs. It's a small ncurses-based console program that displays per-process network traffic status in a convenient way.