ConfigsApr 14, 2026·3 min read

bandwhich — Terminal Bandwidth Utilization by Process and Connection

bandwhich is a CLI tool that shows which process, connection, or remote host is using your bandwidth in real time. Finally answer "what is eating my network?" without opening Wireshark.

AI Open Source
AI Open Source · Community
TL;DR
bandwhich displays per-process, per-connection, and per-host bandwidth usage in your terminal.
§01

What it is

bandwhich is a CLI tool that answers the question: which process is using my network right now. It displays real-time bandwidth utilization broken down by process, connection, and remote host. Think of it as a lightweight, terminal-native alternative to opening Wireshark just to find out what is hogging your connection.

bandwhich targets developers, sysadmins, and anyone troubleshooting unexpected network usage on Linux or macOS.

§02

How it saves time or tokens

Without bandwhich, diagnosing bandwidth issues requires combining nethogs, iftop, and lsof output. bandwhich shows all three views (process, connection, remote host) in a single TUI. One command replaces a multi-tool debugging session.

For AI agents managing infrastructure, bandwhich output can be piped or parsed to identify runaway processes automatically.

§03

How to use

  1. Install via package manager: brew install bandwhich (macOS) or sudo apt install bandwhich (Debian)
  2. Run with sudo for process resolution: sudo bandwhich
  3. Press tab to switch between process, connection, and remote host views
  4. Press q to quit
§04

Example

# Install on macOS
brew install bandwhich

# Run with elevated privileges for process name resolution
sudo bandwhich

# Output shows something like:
# Process          Upload    Download
# firefox          12 KB/s   1.2 MB/s
# docker           340 B/s   15 KB/s
# slack            1.1 KB/s  800 B/s

# Filter by network interface
sudo bandwhich -i en0

# Raw mode for scripting
sudo bandwhich --raw
§05

Related on TokRepo

§06

Common pitfalls

  • bandwhich requires root/sudo to resolve process names; without it you only see connections without process attribution
  • On macOS, you may need to grant Full Disk Access or use sudo explicitly for the binary
  • bandwhich captures live traffic only; it does not store historical data or produce reports for later analysis

Frequently Asked Questions

Does bandwhich work without sudo?+

It runs without sudo but cannot resolve which process owns each connection. You see bandwidth by connection and remote host, but the process column is empty. For full functionality, run with sudo.

How does bandwhich compare to nethogs?+

nethogs shows per-process bandwidth but not per-connection or per-remote-host breakdowns. bandwhich provides all three views in a single tool. bandwhich is written in Rust and generally uses less CPU than nethogs.

Can bandwhich monitor a specific network interface?+

Yes. Use the -i flag followed by the interface name, such as 'sudo bandwhich -i eth0'. This filters traffic to only that interface, useful on machines with multiple network connections.

Does bandwhich support Windows?+

bandwhich has experimental Windows support but it is less mature than Linux and macOS. Process resolution on Windows may not work correctly. For Windows, consider using Resource Monitor or Glasswire instead.

Can I export bandwhich output for logging?+

Use the --raw flag to output machine-readable data. You can pipe this to a file or processing script. The raw output includes timestamps, process names, and byte counts suitable for log analysis.

Citations (3)
  • bandwhich GitHub— bandwhich displays bandwidth utilization by process, connection, and remote host
  • bandwhich README— Rust-based CLI tool for real-time network monitoring
  • nethogs GitHub— nethogs is a per-process network bandwidth monitor
Related on TokRepo
Monitoring toolsDevOps toolsFeatured workflows

Discussion

Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.

Related Assets

Cucumber.js — BDD Testing with Plain Language Scenarios

Cucumber.js is a JavaScript implementation of Cucumber that runs automated tests written in Gherkin plain language.

AI Open Source

WireMock — Flexible API Mocking for Java and Beyond

WireMock is an HTTP mock server for stubbing and verifying API calls in integration tests and development.

AI Open Source

Google Benchmark — Microbenchmark Library for C++

Google Benchmark is a library for measuring and reporting the performance of C++ code with statistical rigor.

AI Open Source
◈Home🔍Search👤Me