Nethogs 是一个终端下的网络流量监控工具，它的特别之处在于可以显示每个进程的带宽占用情况，这样可以更直观获取网络使用情况。它支持 IPv4 和 IPv6 协议、支持本地网卡及 PPP 链接。

有些时候服务器莫名其妙的向外发送大量的包，占用大量带宽，导致其他服务器受到影响。那么在流量异常的情况下，如何查看每个进程使用的带宽呢？可以使用nethogs工具来查看。

当然还有一些其他宽带分析工具，需要的同学可以多了解了解，有个帖子 http://os.51cto.com/art/201404/435279.htm 做了介绍。按应用分析还是比较常见，所以我一般使用nethogs，关于nethogs的安装下面做下说明：

1、下载 
地址： http://sourceforge.net/projects/nethogs/files/nethogs/ 
下载安装包：nethogs-0.8.0.tar.gz (38.0 kB)

2、安装

yum install ncurses* 
tar -zxvf nethogs-0.8.0.tar.gz 
cd nethogs 
make && make install

如果报错如下：

[root@localhost nethogs]# make && make install 
g++ -g -Wall -Wextra -c packet.cpp 
g++ -g -Wall -Wextra -c connection.cpp 
g++ -g -Wall -Wextra -c process.cpp 
g++ -g -Wall -Wextra -c refresh.cpp 
refresh.cpp:9: warning: unused parameter ‘i’ 
cc -g -Wall -Wextra -c decpcap.c 
decpcap.c:7:18: error: pcap.h: No such file or directory 
In file included from decpcap.c:8: 
decpcap.h:34: error: expected specifier-qualifier-list before ‘pcap_t’ 
decpcap.c:14: error: expected ‘)’ before ‘*’ token 
decpcap.c: In function ‘dp_open_offline’: 
decpcap.c:48: error: ‘pcap_t’ undeclared (first use in this function) 
decpcap.c:48: error: (Each undeclared identifier is reported only once 
decpcap.c:48: error: for each function it appears in.) 
decpcap.c:48: error: ‘temp’ undeclared (first use in this function) 
decpcap.c:48: warning: implicit declaration of function ‘pcap_open_offline’ 
decpcap.c:55: warning: implicit declaration of function ‘dp_fillhandle’ 
decpcap.c: In function ‘dp_open_live’: 
decpcap.c:60: error: ‘pcap_t’ undeclared (first use in this function) 
decpcap.c:60: error: ‘temp’ undeclared (first use in this function) 
decpcap.c:60: warning: implicit declaration of function ‘pcap_open_live’ 
decpcap.c: In function ‘dp_addcb’: 
decpcap.c:74: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c: In function ‘dp_parse_tcp’: 
decpcap.c:84: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:86: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:87: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_parse_ip’: 
decpcap.c:99: error: dereferencing pointer to incomplete type 
decpcap.c:103: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:105: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:106: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_parse_ip6’: 
decpcap.c:126: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:128: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:129: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_parse_ethernet’: 
decpcap.c:150: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:152: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:153: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_parse_ppp’: 
decpcap.c:196: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:198: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:199: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_parse_linux_cooked’: 
decpcap.c:238: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:240: error: ‘struct dp_handle’ has no member named ‘callback’ 
decpcap.c:241: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c: In function ‘dp_pcap_callback’: 
decpcap.c:270: error: ‘struct dp_handle’ has no member named ‘userdata_size’ 
decpcap.c:271: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c:271: error: ‘struct dp_handle’ has no member named ‘userdata_size’ 
decpcap.c:273: error: ‘struct dp_handle’ has no member named ‘linktype’ 
decpcap.c:274: error: ‘DLT_EN10MB’ undeclared (first use in this function) 
decpcap.c:277: error: ‘DLT_PPP’ undeclared (first use in this function) 
decpcap.c:280: error: ‘DLT_LINUX_SLL’ undeclared (first use in this function) 
decpcap.c:283: error: ‘DLT_RAW’ undeclared (first use in this function) 
decpcap.c:284: error: ‘DLT_NULL’ undeclared (first use in this function) 
decpcap.c:289: error: ‘struct dp_handle’ has no member named ‘linktype’ 
decpcap.c: In function ‘dp_dispatch’: 
decpcap.c:296: error: ‘struct dp_handle’ has no member named ‘userdata’ 
decpcap.c:297: error: ‘struct dp_handle’ has no member named ‘userdata_size’ 
decpcap.c:298: warning: implicit declaration of function ‘pcap_dispatch’ 
decpcap.c:298: error: ‘struct dp_handle’ has no member named ‘pcap_handle’ 
decpcap.c: In function ‘dp_setnonblock’: 
decpcap.c:302: warning: implicit declaration of function ‘pcap_setnonblock’ 
decpcap.c:302: error: ‘struct dp_handle’ has no member named ‘pcap_handle’ 
decpcap.c: In function ‘dp_geterr’: 
decpcap.c:307: warning: implicit declaration of function ‘pcap_geterr’ 
decpcap.c:307: error: ‘struct dp_handle’ has no member named ‘pcap_handle’ 
make: * [decpcap.o] Error 1

执行命令

yum install libpcap-dev* libncurses5-dev*

然后再重新编译安装，如下：

[root@localhost nethogs]# make && make install 
cc -g -Wall -Wextra -c decpcap.c 
decpcap.c: In function ‘dp_open_live’: 
decpcap.c:60: warning: passing argument 5 of ‘pcap_open_live’ discards qualifiers from pointer 
/usr/include/pcap/pcap.h:349: note: expected ‘char ’ but argument is of type ‘const char ’ 
g++ -g -Wall -Wextra -c cui.cpp -DVERSION=\”0\” -DSUBVERSION=\”8\” -DMINORVERSION=\”0\” 
g++ -g -Wall -Wextra -c inode2prog.cpp 
g++ -g -Wall -Wextra -c conninode.cpp 
g++ -c -o devices.o devices.cpp 
g++ -g -Wall -Wextra nethogs.cpp packet.o connection.o process.o refresh.o decpcap.o cui.o inodee.o devices.o -o nethogs -lpcap -lm -lncurses -DVERSION=\”0\” -DSUBVERSION=\”8\” -DMINORVERSION= 
g++ -g -Wall -Wextra decpcap_test.cpp decpcap.o -o decpcap_test -lpcap -lm 
install -d -m 755 /usr/local/sbin 
install -m 755 nethogs /usr/local/sbin 
install -d -m 755 /usr/local/share/man/man8/ 
install -m 644 nethogs.8 /usr/local/share/man/man8/

这样已经算是成功安装完成，输入命令 nethogs 即可查看应用的宽带占用情况。 
下图是我开启了2个命令窗口做的测试：