bandwhich

bandwhich is a terminal program that shows you which processes and connections on your computer are using network bandwidth right now. Instead of seeing total network traffic as one big number, you get a live-updating table that breaks it down by individual program, by active connection, and by the remote address on the other end.

It works by listening directly on a network interface and inspecting the packets passing through it. On Linux it cross-references that data with the process filesystem to figure out which program owns which connection. On macOS it uses a system tool called lsof to do the same thing. On Windows it uses the Windows API. If a remote IP address can be resolved to a readable hostname, it attempts to do that in the background.

Because the tool reads raw network packets, it needs elevated permissions to run. On Linux you can either grant it permanent capabilities with a one-time setup command, or run it with sudo each time. On Windows you may need to install npcap, a packet capture library, before the tool will work. On macOS no extra steps are needed.

Pre-built binaries are available for Linux, macOS, and Windows across common processor architectures, so most people do not need to compile it. Those who want to build it themselves can do so with the standard Rust build tool, cargo. Cross-compiling for ARM and Android is also supported.

The project is written in Rust and released under the MIT license. It is currently in passive maintenance: critical fixes are applied, but no new features are being added due to limited contributor availability. The maintainers have noted they are open to co-maintainers joining.