laurigates/network-monitoring

Network Monitoring

When to Use This Skill

| Scenario | Use this skill | Alternative | |----------|---------------|-------------| | Find which process is consuming bandwidth | Yes (bandwhich) | | | Monitor per-connection bandwidth in real time | Yes (bandwhich) | | | Visually inspect traffic with protocol filtering | Yes (Sniffnet) | | | Capture a script-friendly sample of bandwidth data | Yes (bandwhich -r) | | | Identify unexpected outbound connections | Yes (bandwhich) | | | Scan for open ports on a remote host | | network-discovery (RustScan, nmap) | | Trace the route or diagnose packet loss | | network-diagnostics (trippy) | | Look up DNS records for a domain | | dns-tools (dog, dig) | | Discover devices on the local L2 segment | | layer2-discovery (ARP/LLDP) | | Load test an HTTP endpoint | | http-load-testing (oha) |

Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.

Core Expertise

Why These Tools

| Tool | Type | Best For | |------|------|----------| | bandwhich | CLI | Per-process bandwidth, quick diagnostics, scripting | | Sniffnet | GUI | Visual analysis, long-term monitoring, filtering |

Key Advantages

• Per-process visibility: See which applications consume bandwidth (unlike traditional iftop)
• Connection-level detail: Track individual connections to remote hosts
• Modern Rust performance: Minimal overhead, safe memory handling
• Cross-platform: Works on Linux, macOS, Windows

Privilege Requirements

Both tools require elevated privileges to capture network traffic:

# Run with sudo
sudo bandwhich

# Or grant capabilities (Linux, avoids sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Essential Commands

bandwhich - CLI Bandwidth Monitor

Basic Usage

# Start monitoring (requires sudo or capabilities)
sudo bandwhich

# Monitor specific interface
sudo bandwhich -i en0
sudo bandwhich -i eth0

# Raw mode (no TUI, machine-readable)
sudo bandwhich -r

# Disable DNS resolution (faster startup)
sudo bandwhich -n

Output Modes

# Default TUI with three panels:
# - Processes (bandwidth by application)
# - Connections (bandwidth by socket)
# - Remote addresses (bandwidth by host)

# Raw output for scripting
sudo bandwhich -r
# Output: <interface>:<process>:<bytes_down>:<bytes_up>

# Combined options
sudo bandwhich -i en0 -n -r

TUI Navigation

| Key | Action | |-----|--------| | Tab | Switch between panels | | Up/Down | Navigate rows | | q | Quit |

Sniffnet - GUI Traffic Monitor

Installation

# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# Or download from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases

Features

• Real-time traffic charts
• Filter by protocol, port, IP
• Domain and provider identification
• Geo-location of remote hosts
• Export reports

Launch

# GUI application (requires sudo or admin)
sudo sniffnet

# On macOS, may need to grant network access in System Preferences

Common Patterns

Diagnose High Bandwidth Usage

# Quick check: which process is using bandwidth?
sudo bandwhich -n

# Watch specific interface during download
sudo bandwhich -i en0

Script-Friendly Monitoring

# Capture 10 seconds of raw data
sudo timeout 10 bandwhich -r > /tmp/bandwidth.log

# Parse raw output
cat /tmp/bandwidth.log | cut -d: -f2 | sort | uniq -c | sort -rn

Compare Interface Traffic

# Monitor WiFi
sudo bandwhich -i en0

# Monitor Ethernet (separate terminal)
sudo bandwhich -i en1

Identify Unexpected Connections

# Raw mode shows all connections
sudo bandwhich -r -n | grep -v "127.0.0.1" | head -20

Agentic Optimizations

| Context | Command | |---------|---------| | Quick bandwidth check | sudo bandwhich -n (no DNS delay) | | Machine-readable output | sudo bandwhich -r | | Specific interface | sudo bandwhich -i <iface> -n | | Capture sample | sudo timeout 5 bandwhich -r > /tmp/bw.log | | Parse top processes | sudo bandwhich -r \| cut -d: -f2 \| sort \| uniq -c |

Quick Reference

bandwhich Flags

| Flag | Long | Description | |------|------|-------------| | -i | --interface | Monitor specific network interface | | -r | --raw | Machine-readable output (no TUI) | | -n | --no-resolve | Skip DNS resolution (faster) | | -h | --help | Show help | | -V | --version | Show version |

Raw Output Format

<interface>:<process_name>:<bytes_downloaded>:<bytes_uploaded>

Example:

en0:firefox:1048576:65536
en0:curl:4096:1024

Installation

bandwhich

# macOS
brew install bandwhich

# Cargo
cargo install bandwhich

# Linux (grant capabilities to avoid sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Sniffnet

# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# GitHub releases (pre-built binaries)
# https://github.com/GyulyVGC/sniffnet/releases

Troubleshooting

Permission Denied

# Use sudo
sudo bandwhich

# Or set capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

# Verify capabilities
getcap $(which bandwhich)

Interface Not Found

# List available interfaces
ip link show        # Linux
networksetup -listallhardwareports  # macOS
ifconfig -l         # BSD/macOS

# Then specify
sudo bandwhich -i <interface_name>

DNS Resolution Slow

# Disable DNS lookup
sudo bandwhich -n

Resources

• bandwhich: https://github.com/imsnif/bandwhich
• Sniffnet: https://github.com/GyulyVGC/sniffnet
• Sniffnet Wiki: https://github.com/GyulyVGC/sniffnet/wiki