[root@wallet01 ~]# yum install -y gcc-c++ libpcap-devel.x86_64 libpcap.x86_64 "ncurses*"
[root@wallet01 ~]# git clone https://github.com/raboof/nethogs
Cloning into 'nethogs'...
remote: Enumerating objects: 18, done.
remote: Counting objects: 100% (18/18), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 1540 (delta 3), reused 8 (delta 1), pack-reused 1522
Receiving objects: 100% (1540/1540), 1.31 MiB | 210.00 KiB/s, done.
Resolving deltas: 100% (1007/1007), done.
[root@wallet01 ~]# cd nethogs
[root@wallet01 nethogs]# make install
[root@wallet01 ~]# nethogs -h
usage: nethogs [-V] [-h] [-b] [-d seconds] [-v mode] [-c count] [-t] [-p] [-s] [-a] [-l] [-f filter] [-C][device [device [device ...]]]
-V : prints version.
-h : prints this help.
-b : bughunt mode - implies tracemode.
-d : delay for update refresh rate in seconds. default is 1.
-v : view mode (0 = KB/s, 1 = total KB, 2 = total B, 3 = total MB, 4 = MB/s, 5 = GB/s). default is 0.
-c : number of updates. default is 0 (unlimited).
-t : tracemode.
-p : sniff in promiscious mode (not recommended).
-s : sort output by sent column.
-l : display command line.
-a : monitor all devices, even loopback/stopped ones.
-C : capture TCP and UDP.
-f : EXPERIMENTAL: specify string pcap filter (like tcpdump). This may be removed or changed in a future version.
device : device(s) to monitor. default is all interfaces up and running excluding loopback
When nethogs is running, press:
q: quit
s: sort by SENT traffic
r: sort by RECEIVE traffic
l: display command line
m: switch between total (KB, B, MB) and throughput (KB/s, MB/s, GB/s) mode
[root@wallet01 ~]# nethogs em1