Charly's Column – Traffic Monitors

On my laptop there is a list of topics I want to write about in the near or distant future. There are tools, tricks, and hacks that I often and gladly use, but which I cannot convert into enough text for a whole column. This explains why three small utilities share this column today.

Dstat

Let's start with Dstat [1]. Last issue, I described how to get details about the installed hardware (especially RAM) from Linux. I was promptly asked how to detect "hogs" as quickly and easily as possible – processes that grab resources (such as CPU, RAM, etc.) without so much as a by your leave. I will keep this short, because I have already written about this topic [2]. My secret weapon looks like this:

# dstat -cdn -D sda -N enp2s0 -C total --top-cpu --top-io --top-mem -f 5

Every second, this displays which processes are generating the highest CPU, memory, and I/O load (Figure 1). This command has saved me from working late dozens of times.

Figure 1: Dstat frequently saves Charly from working late.

NetHogs

Unfortunately, Dstat does not show you which process is generating the most network traffic at the moment. NetHogs [3] fills this gap. On machines with multiple interfaces, it only needs the name of the desired network interface as a parameter. If not specified, it grabs the first interface that is not called localhost.

A list of all processes that send or receive network packets appears (Figure 2). I use the R and S keys to tell Dstat to sort this by incoming and outgoing traffic respectively. NetHogs has a nice graphical add-on, HogWatch [4], that visualizes the data. Unfortunately, HogWatch is no longer actively maintained.

Figure 2: NetHogs adds the traffic information that Dstat lacks.

nload

If you want to see a meaningful net load curve, but don't want to use a graphical tool, nload [5] will do the job. The following command draws the current net load level with cursors on the console:

# nload -t 1000 -o 10000

The -t 1000 parameter specifies the update interval in milliseconds (default: 500ms). -o 10000 tells the tool to cap the graph at 10Mbps, because nload scales it to the interface's maximum speed (Figure 3). If you have a gigabit or faster interface, but a low load, you simply will not see it.

Figure 3: nload provides a meaningful network load graph.