# bandwhich

> CLI utility that displays current network utilization by process, connection and remote IP/hostname

Stars: 12.0k · Language: Rust · License: MIT · Categories: Network

- Repository: https://github.com/imsnif/bandwhich
- Page: https://www.trmn.sh/tools/bandwhich

## Install

- Cargo: `cargo install --git https://github.com/cross-rs/cross.git cross`

## Overview

bandwhich is a network monitoring CLI tool that displays real-time network utilization organized by process, connection, and remote IP/hostname. It sniffs network packets on a specified interface and cross-references IP packet sizes with system process information using `/proc` filesystem on Linux, `lsof` on macOS, or WinAPI on Windows.

The tool provides a terminal-based interface that adapts to window size, showing detailed network activity with reverse DNS resolution for hostnames on a best-effort basis. It can display data in various formats including machine-friendly raw output, and offers filtering options to show only processes, connections, or addresses tables. Users can configure DNS servers, control hostname resolution, and choose different unit families for bandwidth display.

Since bandwhich requires packet sniffing capabilities, it needs elevated privileges to run. On Linux, users can either run it with sudo or assign specific capabilities (cap_sys_ptrace, cap_dac_read_search, cap_net_raw, cap_net_admin) to the binary for unprivileged access. The tool supports multiple architectures including x64, ARM, and Android, making it suitable for servers, desktops, and embedded systems.

### Installation

```bash
# via Cargo
cargo install --git https://github.com/cross-rs/cross.git cross
```

![bandwhich demo showing network utilization by process](https://media.trmn.sh/cached/b903dd13cf7ff521109dd35186d300d91a20e46399b492a0609a5074790376c7.gif)

## Alternatives

- [gping](https://www.trmn.sh/tools/gping.md): Ping utility with real-time graphical display of response times and command execution times (Rust, 12.7k stars)
- [oha](https://www.trmn.sh/tools/oha.md): HTTP load generator written in Rust that sends requests to a web application and shows live results in a terminal UI, inspired by rakyll/hey. (Rust, 10.7k stars)
- [websocat](https://www.trmn.sh/tools/websocat.md): Command-line WebSocket client and server, like netcat, curl and socat for ws:// and wss://, with TCP/UNIX socket proxying and program execution. (Rust, 8.7k stars)
- [monolith](https://www.trmn.sh/tools/monolith.md): CLI tool that bundles web pages into single HTML files with all CSS, images, and JavaScript embedded inline (Rust, 15.6k stars)
- [xh](https://www.trmn.sh/tools/xh.md): HTTP client that reimplements HTTPie's syntax with focus on improved performance and speed. (Rust, 8.2k stars)

---

Canonical: https://www.trmn.sh/tools/bandwhich