How can I tell which application is using my bandwidth?

What this is#

The Graphs tab (or a bandwidth warning email) tells you traffic is flowing, but not which process is sending it. These tools answer that, ordered by how directly they answer the question.

nethogs: bandwidth per process (the answer)#

The one tool that groups traffic by process, which is almost always the question being asked:

apt install nethogs
nethogs

A live table of processes with their sent/received rates. A backup shipping off-site, a busy web server, a miner you didn't install, each shows up with its name and PID. Watch it while the traffic graph climbs and the culprit names itself.

iftop: bandwidth per connection#

When the question is "talking to whom" rather than "which process": apt install iftop, run iftop -P, and you get a live top-list of connections with rates, remote hosts, and ports. Great for spotting one remote endpoint dominating (a scraper, a replication peer, one client downloading in a loop).

ss: the socket census#

No install needed, ss from the port guides also shows established connections: ss -tp lists who's connected and which process owns each socket, the static complement to iftop's live rates.

vnstat: the history#

nethogs and iftop show now; vnstat (apt install vnstat) keeps per-interface daily/monthly totals from the moment it's installed, vnstat -d for the daily ledger. It can't attribute per-process retroactively, but it answers "which day did the traffic spike" so you know when to watch. (For full per-process history, an agent like Netdata records it continuously.)

The usual findings#

Backups/sync jobs on the wrong schedule, a bot-hammered website, VPN traffic counting twice, a compromised process exfiltrating or attacking, or Docker containers (nethogs sees them as their process; docker stats shows per-container network too). Found it and want to cap it rather than kill it? Limiting an application's bandwidth is the sibling guide.

Still need help?#

You can open a support ticket. So we can help on the first reply, it's worth mentioning:

• the VPS hostname or IP,
• what the traffic Graphs show,
• what nethogs or iftop found (or didn't).

Related questions#

• "What is using my VPS's bandwidth?"
• "How do I see network usage per process on Linux?"
• "How do I see which IPs my server is talking to?"
• "How do I track daily bandwidth usage on my VPS?"