What Is bandwhich? The Beginner's Guide to Seeing Which Process Eats Your Bandwidth

CodexFuse Team · 2026-11-04T23:20:53.622Z · 11 min read min read

What is bandwhich, exactly?

What is bandwhich? The project's README defines it in one line: "This is a CLI utility for displaying current network utilization by process, connection and remote IP/hostname." In plain terms, bandwhich is the terminal's answer to "why is my network slow right now" — it shows you, live, which process on your machine is sending and receiving traffic, to whom, and how much. If you have ever stared at a laggy connection and guessed which tab, service, or background updater was responsible, bandwhich replaces the guessing with a live table.

The name is a joke with a history: the tool was originally called "what," but about three weeks before the January 2020 writeup on Linux Uprising, the author renamed it to bandwhich. It is an open-source project by Aram Drevekenin (imsnif on GitHub), written in Rust and released under the MIT license, with the repo created on September 6, 2019 and about 12,047 GitHub stars as of November 4, 2026. That is bandwhich explained: a Rust TUI that names the bandwidth hog on your machine in real time. People running VPS hosting boxes reach for it the moment a server feels slow — one glance tells you whether it is the web server, a stuck backup, or a runaway sync.

How does bandwhich know which process is using the network?

The README's "How does it work?" section states it plainly: "bandwhich sniffs a given network interface and records IP packet size, cross referencing it with the /proc filesystem on linux, lsof on macOS, or using WinApi on windows." Packet capture alone only tells you that bytes moved; cross-referencing the open sockets in /proc (or lsof on macOS) maps each socket back to the process that owns it. That two-step trick — capture plus process lookup — is the whole product.

Two details make the display readable. First, "it will also attempt to resolve ips to their host name in the background using reverse DNS on a best effort basis," so you see a hostname instead of a bare IP when the reverse lookup succeeds. Second, the interface is responsive: "It is responsive to the terminal window size, displaying less info if there is no room for it," and the display refreshes every second (the source sets a 1000 ms display delta).

On interfaces, the default is generous: bandwhich sniffs all active, up interfaces at once, not just one. The source code skips only interfaces that are down or have no IP addresses ("Failed to find any network interface to listen on" is the error when nothing qualifies), and you can narrow it with -i/--interface, e.g. bandwhich -i eth0.

What does the bandwhich screen show? (bandwhich tutorial)

By default, bandwhich runs in interactive mode and, per the January 2020 description, "it has 3 panes that show: network utilization by process name, utilization by connection, and utilization by remote address." The responsive layout matters here: "depending on the window width and/or height, only one or two of these panes may be shown" — a narrow terminal collapses the view gracefully instead of breaking it.

You can also isolate panes with flags: -p/--processes shows the processes table only, -c/--connections the connections table only, -a/--addresses the remote-addresses table only. Keyboard control is minimal — q quits, Space pauses, Tab cycles tables — and since v0.23.0 the process table carries a PID column. Two more display flags worth knowing: -t/--total-utilization ("Show total (cumulative) usages" instead of per-second rates) and -u/--unit-family to pick bin-bytes, bin-bits, si-bytes, or si-bits.

Your first run, as a numbered walkthrough:

1. Launch it with privileges. Run sudo bandwhich (why it needs root is covered below). Give it a few seconds — reverse DNS lookups happen in the background.
2. Read the process pane first. It answers the core question: which program is moving the most bytes up and down right now.
3. Drill into the connection pane. Select a heavy process and its connections show the remote hosts and ports — this is how you tell "a backup sync" from "a video call."
4. Scope it when needed. Watching one interface? Run bandwhich -i eth0 instead of sniffing everything.
5. Quit cleanly. Press q or Ctrl+C.

A word on scope: bandwhich answers "who is using my bandwidth," not "how fast is my connection." For the second question, run our network speed test — measure the pipe's speed there, then use bandwhich to find out which process is filling it.

How do you install bandwhich? (bandwhile install)

Install is easy, but note one thing first: the README itself documents zero install commands — it defers to an INSTALL.md that lists per-platform routes, and the universal fallback is Cargo. Follow these steps in order:

1. Use Cargo as the universal fallback. "Regardless of OS, you can always fallback to the Rust package manager, cargo." Run cargo install bandwhich — it works on any OS with a Rust toolchain.
2. Or use your distro's package manager. The documented routes: pacman -S bandwhich (Arch), brew install bandwhich (macOS/Linux via Homebrew), nix-env -iA nixpkgs.bandwhich (Nix/NixOS), xbps-install -S bandwhich (Void), Fedora via the atim/bandwhich COPR, FreeBSD via pkg install bandwhich, and MacPorts via sudo port install bandwhich. Per Repology, 77 distro packages exist and 0.23.1 is the current version in Arch, Debian (as rust-bandwhich), Fedora Terra, Homebrew, MacPorts, nixpkgs, Void, Alpine, FreeBSD Ports, Scoop, and Chocolatey — but the repo docs give no apt one-liner, so Debian/Ubuntu users should go the Cargo route.
3. Or grab a prebuilt binary. "We offer several generic binaries in releases for various OSes": Linux (aarch64, armv7, x64), macOS (aarch64, x64), Windows (x64), and Android aarch64 (best effort). Alan Pope also packaged v0.21.0 as a snap in 2023 for easy installs across Linux distributions and architectures.
4. Handle the privilege question. On Linux you will run it with sudo bandwhich, or set up the setcap wrapper described in the next section — decide before your first real troubleshooting session.
5. Confirm the install. Run bandwhich -V. As of November 4, 2026 the current release is v0.23.1 (2024-10-09), a maintenance release with a broken-pipe fix; v0.23.0 added the PID column to the process table.

If you run workloads in containers, remember bandwhich watches the host's interfaces — container traffic crossing the host shows up too, which makes it a handy complement to a Docker host's own monitoring.

Why does bandwhich need root?

Say it once, because every "bandwhile shows nothing" debugging story starts here: "Since bandwhile sniffs network packets, it requires elevated privileges." Raw packet capture is a privileged operation on Linux — the binary itself refuses politely when permissions are missing, printing "Insufficient permissions to listen on network interface(s)" with the exact workaround options.

You have two routes on Linux. The simple one: sudo bandwhile. The permanent one: a setcap wrapper — "sudo setcap cap_sys_ptrace,cap_dac_read_search,cap_net_raw,cap_net_admin+ep $(command -v bandwhile)". The README explains the two capability pairs: "cap_sys_ptrace,cap_dac_read_search: allow access to /proc/<pid>/fd/, so that bandwhile can determine which open port belongs to which process," and "cap_net_raw,cap_net_admin: allow capturing packets on your system." The setcap route is "the recommended setup for single user machines, or if all users are trusted."

How do you use bandwhich raw mode? (bandwhile raw mode)

Besides the interactive TUI, bandwhich has a raw mode: "run bandwhile with the -r / --raw option" and it "produces machine friendly output." The flag's own help text calls it "Machine friendlier output," and it is the mode scripts want — the binary even detects when you pipe it and prints "if you are trying to pipe 'bandwhile' you should use the --raw flag."

Raw mode pairs with two more script-friendly flags. -n/--no-resolve skips the background reverse-DNS lookups ("Do not attempt to resolve IPs to their hostnames") — faster and deterministic output. -s/--show-dns goes the other way and logs the DNS queries themselves, with -d/--dns-server letting you point at a specific DNS server instead of the system default.

A typical scripted use: bandwhile -r | grep -i firefox — stream the machine-friendly rows and filter for one process. Combine -r with -n when you need stable, parseable columns without DNS latency.

bandwhile vs iftop vs nethogs: which one should you use?

The three tools answer three different questions, and the January 2020 comparison still frames them correctly. "For example iftop, which displays bandwidth usage on an interface by host, doesn't show the process that's utilizing the bandwidth." And "nethogs on the other hand, a command line tool that groups bandwidth per process (it shows the PID, user, program, interface and the sent/received per PID), is a lot more similar in what information it shows compared to bandwhile, but nethogs lacks a raw output mode which can be useful in various cases. Also, nethogs doesn't show individual connections."

The decision rule: if your question is "which host on this interface is loud," iftop answers it. The bandwhich vs nethogs matchup is the closer one — both name the process, but only bandwhich shows individual connections and ships a raw output mode for scripts. If your question is "which program is eating my bandwidth," bandwhich and nethogs both answer, and the connection-level view is what makes bandwhich the debugger's pick: the process pane names the culprit, the connection pane shows exactly who it is talking to.

Is bandwhich still maintained?

Honestly, and from the project's own mouth: "This project is in passive maintenance. Critical issues will be addressed, but no new features are being worked on. However, this is due to a lack of funding and/or manpower more than anything else, so pull requests are more than welcome. In addition, if you are able and willing to contribute to this project long-term, we would like to invite you to apply for co-maintainership." The history fits: v0.21.0 (2023-09-19) was "the first release of bandwhich after nearly 3 years of hiatus," and it was also the new primary maintainer's (@cyqsimon's) first release after the handover from the original author.

Alan Pope's 2023 snap packaging notes the same moment from the outside: "The upstream bandwidth developers are currently having a bit of a reorg, after the lead developer no longer has the … bandwidth … to maintain the application." Read that as feature-frozen, not dead — v0.23.1 shipped in October 2024, the tool does one job, and it does it. Just do not expect new panes or platforms; Windows users already have x64 prebuilt binaries (native Windows support landed in 0.18.0), and on Windows you may first need to install Npcap for packet capture.

Sources

• bandwhich GitHub README — github.com/imsnif/bandwhich (definition, how-it-works, root-privileges, flags, install routes, project-status "passive maintenance"; repo created 2019-09-06; ~12,047 stars as of 2026-11-04; MIT license)
• bandwhile INSTALL.md — per-platform install commands (Arch, Exherbo, Nix/NixOS, Void, Fedora COPR, Homebrew, MacPorts, FreeBSD, Cargo fallback; no apt one-liner)
• bandwhich GitHub releases + CHANGELOG.md — v0.23.1 (2024-10-09, maintenance release, broken-pipe fix #429); v0.23.0 (PID column #379); v0.21.0 (2023-09-19, first release after ~3-year hiatus, @cyqsimon becomes primary maintainer)
• lib.rs bandwhile crate page — 538 downloads/month, #5 in #utilization, 120KB, 2.5K SLoC (crawled 2026-10-22, opened 2026-11-04)
• Linux Uprising, January 2020 — three panes, all-active-interfaces default, pane flags, raw mode, iftop/nethogs comparison, root requirement
• Alan Pope's blog, September 20, 2023 — snap packaging of v0.21.0, upstream reorg note
• Repology bandwhich versions — 77 known packages, 0.23.1 across Arch, Debian, Fedora Terra, Homebrew, MacPorts, nixpkgs, Void, Alpine, FreeBSD Ports, Scoop, Chocolatey (Manjaro Stable lags at 0.20.0)
• bandwhich source code (src/os/shared.rs, src/main.rs) — interface filtering (down/IP-less interfaces skipped), key bindings (q/Space/Tab), 1-second display delta, permission-error text, raw-mode pipe hint

Frequently Asked Questions

Do I need sudo to run bandwhich?

On Linux, yes — "since bandwhile sniffs network packets, it requires elevated privileges." Run sudo bandwhile, or install the documented setcap wrapper (cap_sys_ptrace, cap_dac_read_search, cap_net_raw, cap_net_admin) so the binary captures packets without sudo. On macOS the OS prompts for permission on first run instead.

Does bandwhich work on macOS and Windows?

Yes, both. On macOS it cross-references lsof instead of /proc. Windows support landed in 0.18.0 with x64 prebuilt binaries, and you may first need to install Npcap for packet capture on Windows.

Can I use bandwhich in scripts?

Yes — that is what raw mode is for. bandwhile -r emits "machine friendlier output" instead of the interactive TUI, and piping the normal mode prints a hint telling you to use --raw. Add -n to skip reverse-DNS lookups for deterministic columns.

What is the difference between bandwhile and iftop?

iftop "displays bandwidth usage on an interface by host" but "doesn't show the process that's utilizing the bandwidth." bandwhich adds the process dimension: per-process, per-connection, and per-remote-IP tables with a PID column, so you can name the program behind the traffic.

Is bandwhich still being developed?

It is in passive maintenance: "Critical issues will be addressed, but no new features are being worked on," for lack of funding and manpower rather than lack of interest — the project invites long-term contributors to apply for co-maintainership. The tool is stable and usable; just expect maintenance releases, not new features.