NetHogs

Run NetHogs on the machine whose traffic you want to investigate and inspect the per-process bandwidth list. It groups by PID rather than just protocol or subnet, but unassigned traffic appears in an “unknown TCP” bucket, for example when a process exits before attribution. Most features rely on Linux’s /proc filesystem; macOS and FreeBSD builds show connections without process names. The source build uses libpcap and ncurses. Its documented launch uses elevated access; non-root operation requires capture capabilities, with additional capabilities for reading process names. This view concerns traffic to or from that machine, rather than an inventory of every device’s activity.