bandwhich

bandwhich is a network monitoring CLI tool that displays real-time network utilization broken down by process, connection, and remote IP/hostname. It sniffs network packets on a specified interface and cross-references packet data with system process information using /proc on Linux, lsof on macOS, or WinAPI on Windows. The tool attempts reverse DNS lookups to resolve IP addresses to hostnames on a best-effort basis.

The interface is responsive to terminal window size and provides multiple viewing modes through command-line options. Users can display only processes (-p), connections (-c), or remote addresses (-a), configure DNS resolution settings, and choose different unit families for bandwidth display. Additional features include raw machine-readable output, DNS query visibility, and cumulative usage statistics.

bandwhich requires elevated privileges to capture network packets. On Linux, this can be handled either through setcap to grant permanent capabilities or by running with sudo. The tool supports cross-platform deployment including Linux (x64, aarch64, armv7), macOS (Intel and Apple Silicon), Windows, and Android with prebuilt binaries available for each platform.

Installation

# via Cargo
cargo install --git https://github.com/imsnif/bandwhich.git

# via Build from source
git clone https://github.com/imsnif/bandwhich.git && cd bandwhich && cargo build --release