network-monitoring

created	"2026-01-01T00:00:00.000Z"
modified	"2026-04-25T00:00:00.000Z"
reviewed	"2026-04-25T00:00:00.000Z"
name	network-monitoring
description	Real-time network traffic and per-process bandwidth monitoring. Use when finding which app consumes bandwidth, inspecting active connections, or capturing traffic samples.
user-invocable	false
allowed-tools	Bash(iftop *), Bash(nethogs *), Bash(tcpdump *), Bash(ss *), Bash(netstat *), Read, Grep, Glob, TodoWrite

Network Monitoring

When to Use This Skill

Scenario	Use this skill	Alternative
Find which process is consuming bandwidth	Yes (bandwhich)
Monitor per-connection bandwidth in real time	Yes (bandwhich)
Visually inspect traffic with protocol filtering	Yes (Sniffnet)
Capture a script-friendly sample of bandwidth data	Yes (bandwhich -r)
Identify unexpected outbound connections	Yes (bandwhich)
Scan for open ports on a remote host		network-discovery (RustScan, nmap)
Trace the route or diagnose packet loss		network-diagnostics (trippy)
Look up DNS records for a domain		dns-tools (dog, dig)
Discover devices on the local L2 segment		layer2-discovery (ARP/LLDP)
Load test an HTTP endpoint		http-load-testing (oha)
Inspect or configure the host's own IPs, links, or routes		interface-state (ip)

Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.

Core Expertise

Why These Tools

Tool	Type	Best For
bandwhich	CLI	Per-process bandwidth, quick diagnostics, scripting
Sniffnet	GUI	Visual analysis, long-term monitoring, filtering

Key Advantages

• Per-process visibility: See which applications consume bandwidth (unlike traditional iftop)
• Connection-level detail: Track individual connections to remote hosts
• Modern Rust performance: Minimal overhead, safe memory handling
• Cross-platform: Works on Linux, macOS, Windows

Privilege Requirements

Both tools require elevated privileges to capture network traffic:

# Run with sudo
sudo bandwhich

# Or grant capabilities (Linux, avoids sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Essential Commands

bandwhich - CLI Bandwidth Monitor

Basic Usage

# Start monitoring (requires sudo or capabilities)
sudo bandwhich

# Monitor specific interface
sudo bandwhich -i en0
sudo bandwhich -i eth0

# Raw mode (no TUI, machine-readable)
sudo bandwhich -r

# Disable DNS resolution (faster startup)
sudo bandwhich -n

Output Modes

# Default TUI with three panels:
# - Processes (bandwidth by application)
# - Connections (bandwidth by socket)
# - Remote addresses (bandwidth by host)

# Raw output for scripting
sudo bandwhich -r
# Output: <interface>:<process>:<bytes_down>:<bytes_up>

# Combined options
sudo bandwhich -i en0 -n -r

TUI Navigation

Key	Action
Tab	Switch between panels
Up/Down	Navigate rows
q	Quit

Sniffnet - GUI Traffic Monitor

Installation

# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# Or download from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases

Features

• Real-time traffic charts
• Filter by protocol, port, IP
• Domain and provider identification
• Geo-location of remote hosts
• Export reports

Launch

# GUI application (requires sudo or admin)
sudo sniffnet

# On macOS, may need to grant network access in System Preferences

Common Patterns

Diagnose High Bandwidth Usage

# Quick check: which process is using bandwidth?
sudo bandwhich -n

# Watch specific interface during download
sudo bandwhich -i en0

Script-Friendly Monitoring

# Capture 10 seconds of raw data
sudo timeout 10 bandwhich -r > /tmp/bandwidth.log

# Parse raw output
cat /tmp/bandwidth.log | cut -d: -f2 | sort | uniq -c | sort -rn

Compare Interface Traffic

# Monitor WiFi
sudo bandwhich -i en0

# Monitor Ethernet (separate terminal)
sudo bandwhich -i en1

Identify Unexpected Connections

# Raw mode shows all connections
sudo bandwhich -r -n | grep -v "127.0.0.1" | head -20

Agentic Optimizations

Context	Command
Quick bandwidth check	sudo bandwhich -n (no DNS delay)
Machine-readable output	sudo bandwhich -r
Specific interface	sudo bandwhich -i <iface> -n
Capture sample	sudo timeout 5 bandwhich -r > /tmp/bw.log
Parse top processes	sudo bandwhich -r | cut -d: -f2 | sort | uniq -c

Quick Reference

bandwhich Flags

Flag	Long	Description
-i	--interface	Monitor specific network interface
-r	--raw	Machine-readable output (no TUI)
-n	--no-resolve	Skip DNS resolution (faster)
-h	--help	Show help
-V	--version	Show version

Raw Output Format

<interface>:<process_name>:<bytes_downloaded>:<bytes_uploaded>

Example:

en0:firefox:1048576:65536
en0:curl:4096:1024

Installation

bandwhich

# macOS
brew install bandwhich

# Cargo
cargo install bandwhich

# Linux (grant capabilities to avoid sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Sniffnet

# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# GitHub releases (pre-built binaries)
# https://github.com/GyulyVGC/sniffnet/releases

Troubleshooting

Permission Denied

# Use sudo
sudo bandwhich

# Or set capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

# Verify capabilities
getcap $(which bandwhich)

Interface Not Found

# List available interfaces
ip link show        # Linux
networksetup -listallhardwareports  # macOS
ifconfig -l         # BSD/macOS

# Then specify
sudo bandwhich -i <interface_name>

DNS Resolution Slow

# Disable DNS lookup
sudo bandwhich -n

Resources

• bandwhich: https://github.com/imsnif/bandwhich
• Sniffnet: https://github.com/GyulyVGC/sniffnet
• Sniffnet Wiki: https://github.com/GyulyVGC/sniffnet/wiki