Skip to content
Get packs

Guide · Open source

How to use bandwhich: see which program uses your bandwidth

Updated · written with AI from the project's own documentation and checked against our catalogue data

bandwhich is a free, open-source command-line tool that shows how much network bandwidth is being used right now, broken down by process, connection and remote IP or hostname. This guide explains what it does, how to build it from source, how to give it the privileges it needs, and which options to use. By the end you will be able to run it and read its output.

bandwhichimsnif/bandwhich · ★ 12k · MIT

Quick start

  1. 1Get the source. Clone the repository from GitHub using git clone https://github.com/imsnif/bandwhich.git and enter the folder with cd bandwhich.
  2. 2Install prerequisites. Make sure you have a Rust toolchain with cargo that meets the minimum version in Cargo.toml. On Windows, install npcap.
  3. 3Build a release binary. Run cargo build --release inside the project directory.
  4. 4Grant privileges. On Linux, either run setcap with the four listed capabilities or run bandwhich with sudo.
  5. 5Pick an interface. Run bandwhich with -i followed by your interface name, such as eth0.
  6. 6Read the output. Use -p, -c or -a to show a single table, and -n to skip hostname lookups.

What bandwhich does and how it works

bandwhich sniffs a given network interface and records IP packet size. It cross-references that traffic with the /proc filesystem on Linux, lsof on macOS, or the WinApi on Windows, so each connection can be matched to the program that owns it.

It resizes its display to the terminal window, showing less information when there is no room. It also tries to resolve IP addresses to hostnames in the background using reverse DNS, on a best-effort basis.

Build bandwhich from source

The project's README describes building from source as clone-and-build. You need a Rust toolchain with cargo. The minimum supported Rust version is set in the rust-version field of Cargo.toml, so check that file if your toolchain is old.

Run these three commands from a terminal. The release binary is built with the last command.

  • On Windows, install npcap first so packets can be captured.
git clone https://github.com/imsnif/bandwhich.git cd bandwhich cargo build --release

Give bandwhich the privileges it needs

bandwhich sniffs network packets, so it needs elevated privileges. On Linux there are two main options. The first is setcap, which permanently grants the binary its capabilities. The README recommends this for single-user machines or when all users are trusted, and does not recommend it if you want to stop users from seeing each other's traffic.

The second option is to run it with sudo every time. The README suggests this for administrators of multi-user environments.

If bandwhich was installed inside your home directory, sudo may not find it because many distributions do not keep your PATH under sudo. You can make sudo preserve your PATH, set PATH explicitly, or pass the full path to sudo.

  • cap_sys_ptrace and cap_dac_read_search allow access to /proc/<pid>/fd/, so bandwhich can match open ports to processes.
  • cap_net_raw and cap_net_admin allow capturing packets on your system.
sudo setcap cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep $(command -v bandwhich) bandwhich

Run bandwhich and choose an interface

Use -i to pick the network interface to listen on, such as eth0. Without the sudo option, the simplest run is shown below. Add -n to skip hostname lookups, and -r for machine-friendlier output.

Use -u to choose a unit family. The default is bin-bytes, and the other values are bin-bits, si-bytes and si-bits. Use -t to show cumulative totals instead of current rates.

  • -p shows the processes table only.
  • -c shows the connections table only.
  • -a shows the remote addresses table only.
  • -s shows DNS queries.
  • -d sets a DNS server to use instead of the system default.
  • --log-to writes debug logging to a file.
sudo bandwhich -i eth0

Troubleshoot common problems

If you see a command not found error after using sudo, the cause is most likely the PATH issue described above. Pass the full path to sudo, as in sudo $(command -v bandwhich), or preserve your PATH.

On Windows, if packets are not captured, check that npcap is installed, since the README says you might need it for capturing packets. If hostnames do not appear, remember that resolution is best-effort and runs in the background; use -n to turn it off.

What people use it for

  • Finding which program is consuming your connection at a given moment.
  • Checking which remote IPs or hostnames a machine is talking to from a terminal.
  • Monitoring traffic on a small router or server running a supported Linux architecture.
  • Viewing live usage on a Linux, macOS or Windows machine over SSH, since it is a terminal tool.

Frequently asked questions

Is bandwhich free and open source?

Yes. bandwhich is released under the MIT licence and its source code is on GitHub at imsnif/bandwhich.

What do I need to install bandwhich?

You need a Rust toolchain with cargo to build it from source. The minimum Rust version is listed in the rust-version field of Cargo.toml. On Windows, you also need npcap.

Why does bandwhich need sudo?

It sniffs network packets, which requires elevated privileges. On Linux you can avoid sudo each time by using setcap with the capabilities listed in the README, but only if you trust the other users on the machine.

Why does sudo say bandwhich is command not found?

If bandwhich is installed in your home directory, many distributions do not keep your user PATH under sudo. Pass the full path with sudo $(command -v bandwhich), or use sudo env "PATH=$PATH" bandwhich.

Does bandwhich keep history or send alerts?

The README describes only live monitoring. It does not describe long-term history or alerting, so use another tool if you need those.

Is bandwhich still maintained?

The project is in passive maintenance. Critical issues will be addressed, but no new features are being worked on. Pull requests are welcome.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use bandwhich if you want a quick, live view of which program and remote address is using your bandwidth from a terminal, and you can grant it elevated privileges. Pick a different tool if you need traffic history, alerts, a graphical interface, or new features, since the project is in passive maintenance.

Install options & downloads