# How can I tell which application is using my bandwidth?
Source: https://vpsdime.com/knowledgebase/technical-questions/per-app-bandwidth
Last reviewed: 2026-07-02
Summary: Finding the process behind the traffic, nethogs for the per-process live view (the actual answer), iftop for per-connection, ss for who's talking to whom, and vnstat for history, plus tying the finding back to the monthly allowance and the usual suspects.

## What this is

The [Graphs](https://vpsdime.com/knowledgebase/client-area/services/graphs) tab (or a [bandwidth warning email](https://vpsdime.com/knowledgebase/acceptable-use/bandwidth-overage)) tells you traffic is flowing, but not **which process** is sending it. These tools answer that, ordered by how directly they answer the question.

## nethogs: bandwidth per process (the answer)

The one tool that groups traffic **by process**, which is almost always the question being asked:

```
apt install nethogs
nethogs
```

A live table of processes with their sent/received rates. A backup shipping off-site, a busy web server, a [miner you didn't install](https://vpsdime.com/knowledgebase/troubleshooting/compromised-vps-recovery), each shows up with its name and PID. Watch it while the [traffic graph](https://vpsdime.com/knowledgebase/client-area/services/graphs) climbs and the culprit names itself.

## iftop: bandwidth per connection

When the question is "talking to **whom**" rather than "which process": `apt install iftop`, run `iftop -P`, and you get a live top-list of connections with rates, remote hosts, and ports. Great for spotting one remote endpoint dominating (a scraper, a replication peer, one client downloading in a loop).

## ss: the socket census

No install needed, [`ss` from the port guides](https://vpsdime.com/knowledgebase/getting-started/securing-public-services) also shows established connections: `ss -tp` lists who's connected and **which process owns each socket**, the static complement to iftop's live rates.

## vnstat: the history

nethogs and iftop show *now*; **vnstat** (`apt install vnstat`) keeps per-interface daily/monthly totals from the moment it's installed, `vnstat -d` for the daily ledger. It can't attribute per-process retroactively, but it answers "which *day* did the traffic spike" so you know when to watch. (For full per-process history, an agent like [Netdata](https://vpsdime.com/knowledgebase/troubleshooting/slow-vps) records it continuously.)

## The usual findings

Backups/sync jobs on the wrong schedule, a [bot-hammered website](https://vpsdime.com/knowledgebase/troubleshooting/bot-traffic), [VPN traffic counting twice](https://vpsdime.com/knowledgebase/technical-questions/wireguard-vpn), a compromised process exfiltrating or attacking, or Docker containers (nethogs sees them as their process; `docker stats` shows per-container network too). Found it and want to cap it rather than kill it? [Limiting an application's bandwidth](https://vpsdime.com/knowledgebase/technical-questions/limit-bandwidth-usage) is the sibling guide.

## Still need help?

You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning:

- the VPS hostname or IP,
- what the traffic Graphs show,
- what nethogs or iftop found (or didn't).

## Related questions

- "What is using my VPS's bandwidth?"
- "How do I see network usage per process on Linux?"
- "How do I see which IPs my server is talking to?"
- "How do I track daily bandwidth usage on my VPS?"