Network Monitoring
When to Use This Skill
| Scenario | Use this skill | Alternative |
|---|---|---|
| Find which process is consuming bandwidth | Yes (bandwhich) | |
| Monitor per-connection bandwidth in real time | Yes (bandwhich) | |
| Visually inspect traffic with protocol filtering | Yes (Sniffnet) | |
| Capture a script-friendly sample of bandwidth data | Yes (bandwhich -r) | |
| Identify unexpected outbound connections | Yes (bandwhich) | |
| Scan for open ports on a remote host | network-discovery (RustScan, nmap) | |
| Trace the route or diagnose packet loss | network-diagnostics (trippy) | |
| Look up DNS records for a domain | dns-tools (dog, dig) | |
| Discover devices on the local L2 segment | layer2-discovery (ARP/LLDP) | |
| Load test an HTTP endpoint | http-load-testing (oha) | |
| Inspect or configure the host's own IPs, links, or routes | interface-state (ip) |
Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.
Core Expertise
Why These Tools
| Tool | Type | Best For |
|---|---|---|
| bandwhich | CLI | Per-process bandwidth, quick diagnostics, scripting |
| Sniffnet | GUI | Visual analysis, long-term monitoring, filtering |
Key Advantages
- Per-process visibility: See which applications consume bandwidth (unlike traditional
iftop) - Connection-level detail: Track individual connections to remote hosts
- Modern Rust performance: Minimal overhead, safe memory handling
- Cross-platform: Works on Linux, macOS, Windows
Privilege Requirements
Both tools require elevated privileges to capture network traffic:
# Run with sudo
sudo bandwhich
# Or grant capabilities (Linux, avoids sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
Essential Commands
bandwhich - CLI Bandwidth Monitor
Basic Usage
# Start monitoring (requires sudo or capabilities)
sudo bandwhich
# Monitor specific interface
sudo bandwhich -i en0
sudo bandwhich -i eth0
# Raw mode (no TUI, machine-readable)
sudo bandwhich -r
# Disable DNS resolution (faster startup)
sudo bandwhich -n
Output Modes
# Default TUI with three panels:
# - Processes (bandwidth by application)
# - Connections (bandwidth by socket)
# - Remote addresses (bandwidth by host)
# Raw output for scripting
sudo bandwhich -r
# Output: <interface>:<process>:<bytes_down>:<bytes_up>
# Combined options
sudo bandwhich -i en0 -n -r
TUI Navigation
| Key | Action |
|---|---|
Tab | Switch between panels |
Up/Down | Navigate rows |
q | Quit |
Sniffnet - GUI Traffic Monitor
Installation
# macOS
brew install sniffnet
# Cargo
cargo install sniffnet
# Or download from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases
Features
- Real-time traffic charts
- Filter by protocol, port, IP
- Domain and provider identification
- Geo-location of remote hosts
- Export reports
Launch
# GUI application (requires sudo or admin)
sudo sniffnet
# On macOS, may need to grant network access in System Preferences
Common Patterns
Diagnose High Bandwidth Usage
# Quick check: which process is using bandwidth?
sudo bandwhich -n
# Watch specific interface during download
sudo bandwhich -i en0
Script-Friendly Monitoring
# Capture 10 seconds of raw data
sudo timeout 10 bandwhich -r > /tmp/bandwidth.log
# Parse raw output
cat /tmp/bandwidth.log | cut -d: -f2 | sort | uniq -c | sort -rn
Compare Interface Traffic
# Monitor WiFi
sudo bandwhich -i en0
# Monitor Ethernet (separate terminal)
sudo bandwhich -i en1
Identify Unexpected Connections
# Raw mode shows all connections
sudo bandwhich -r -n | grep -v "127.0.0.1" | head -20
Agentic Optimizations
| Context | Command |
|---|---|
| Quick bandwidth check | sudo bandwhich -n (no DNS delay) |
| Machine-readable output | sudo bandwhich -r |
| Specific interface | sudo bandwhich -i <iface> -n |
| Capture sample | sudo timeout 5 bandwhich -r > /tmp/bw.log |
| Parse top processes | sudo bandwhich -r | cut -d: -f2 | sort | uniq -c |
Quick Reference
bandwhich Flags
| Flag | Long | Description |
|---|---|---|
-i | --interface | Monitor specific network interface |
-r | --raw | Machine-readable output (no TUI) |
-n | --no-resolve | Skip DNS resolution (faster) |
-h | --help | Show help |
-V | --version | Show version |
Raw Output Format
<interface>:<process_name>:<bytes_downloaded>:<bytes_uploaded>
Example:
en0:firefox:1048576:65536
en0:curl:4096:1024
Installation
bandwhich
# macOS
brew install bandwhich
# Cargo
cargo install bandwhich
# Linux (grant capabilities to avoid sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
Sniffnet
# macOS
brew install sniffnet
# Cargo
cargo install sniffnet
# GitHub releases (pre-built binaries)
# https://github.com/GyulyVGC/sniffnet/releases
Troubleshooting
Permission Denied
# Use sudo
sudo bandwhich
# Or set capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
# Verify capabilities
getcap $(which bandwhich)
Interface Not Found
# List available interfaces
ip link show # Linux
networksetup -listallhardwareports # macOS
ifconfig -l # BSD/macOS
# Then specify
sudo bandwhich -i <interface_name>
DNS Resolution Slow
# Disable DNS lookup
sudo bandwhich -n
Resources
- bandwhich: https://github.com/imsnif/bandwhich
- Sniffnet: https://github.com/GyulyVGC/sniffnet
- Sniffnet Wiki: https://github.com/GyulyVGC/sniffnet/wiki