I'm looking for a network monitor running on Linux, showing me in real-time

  • open connections
  • the process owning them
  • the target IP (and optionally port)
  • allow me to "freeze" the output (i.e. pause updating, so I can investigate details before they disappear)

Preferably for the command-line (strong preference), alternatively with GUI. I don't want a background service I have to visit with a different frontend, also not in the browser.

I'm aware of

  • iftop: doesn't show me the application behind a connection
  • ifstat: doesn't update real time
  • iptraf: again lacks the application part (unless I've missed that), and also forces me to chose between showing the IP and the resolved host name (I'd prefer seeing both together)

iptraf-ng comes closest to what I'm after, but lacks the details I've pointed out and need.

The software should be open-source and free, as well as preferably being available as a .deb in the repositories (Linux Mint 18.1 here; PPAs definitely acceptable).

No need for package capturing etc. Main purpose is to find out which application connects where to and when :)

For a work-around, I just figured I can use iftop, watching its output, hit P to freeze it, pick the "suspicious IP address", and then (in another terminal window) run lsof -i in a loop – canceling it via Ctrl-C as soon as it spit out the details needed:

while true; do
   line="$(lsof -i|grep"
   [[ -n "$line" ]] && echo "$line"
   sleep 1;

But of course this would only work for repeating appearances (or connections staying open long enough).

  • what does "sudo netstat -tapn" do for you? I think that will provide most of the info, if not teh actual bandwidth use.... – ivanivan Jan 24 '17 at 19:50
  • @ivanivan looking like a "cleaner variant" of my lsof -i, but lacking the process owner :) – Izzy Jan 24 '17 at 20:20
  • Add an "e" to those flags - tapne adds 2 columns, shows the UID (not name, sorry, that may be overriden if you skip the n flag though) and what inode - see superuser.com/questions/719649/… – ivanivan Jan 24 '17 at 20:55
  • @ivanivan Yes, that gives more details (e.g. the UID). But it's not what I'm looking for. E.g. it's not updating in real-time. Thanks anyway! – Izzy Jan 24 '17 at 21:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.