Skill Store 33

Network Monitoring

Real-time network traffic and per-process bandwidth monitoring.

by laurigates · MIT

The skill

Real-time network traffic and per-process bandwidth monitoring. Use when finding which app consumes bandwidth, inspecting active connections, or capturing traffic samples.

Network Monitoring

When to Use This Skill

Scenario Use this skill Alternative
Find which process is consuming bandwidth Yes (bandwhich)
Monitor per-connection bandwidth in real time Yes (bandwhich)
Visually inspect traffic with protocol filtering Yes (Sniffnet)
Capture a script-friendly sample of bandwidth data Yes (bandwhich -r)
Identify unexpected outbound connections Yes (bandwhich)
Scan for open ports on a remote host network-discovery (RustScan, nmap)
Trace the route or diagnose packet loss network-diagnostics (trippy)
Look up DNS records for a domain dns-tools (dog, dig)
Discover devices on the local L2 segment layer2-discovery (ARP/LLDP)
Load test an HTTP endpoint http-load-testing (oha)
Inspect or configure the host's own IPs, links, or routes interface-state (ip)

Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.

Core Expertise

Why These Tools

Tool Type Best For
bandwhich CLI Per-process bandwidth, quick diagnostics, scripting
Sniffnet GUI Visual analysis, long-term monitoring, filtering

Key Advantages

  • Per-process visibility: See which applications consume bandwidth (unlike traditional iftop)
  • Connection-level detail: Track individual connections to remote hosts
  • Modern Rust performance: Minimal overhead, safe memory handling
  • Cross-platform: Works on Linux, macOS, Windows

Privilege Requirements

Both tools require elevated privileges to capture network traffic:

# Run with sudo
sudo bandwhich

# Or grant capabilities (Linux, avoids sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Essential Commands

bandwhich - CLI Bandwidth Monitor

Basic Usage
# Start monitoring (requires sudo or capabilities)
sudo bandwhich

# Monitor specific interface
sudo bandwhich -i en0
sudo bandwhich -i eth0

# Raw mode (no TUI, machine-readable)
sudo bandwhich -r

# Disable DNS resolution (faster startup)
sudo bandwhich -n
Output Modes
# Default TUI with three panels:
# - Processes (bandwidth by application)
# - Connections (bandwidth by socket)
# - Remote addresses (bandwidth by host)

# Raw output for scripting
sudo bandwhich -r
# Output: <interface>:<process>:<bytes_down>:<bytes_up>

# Combined options
sudo bandwhich -i en0 -n -r
TUI Navigation
Key Action
Tab Switch between panels
Up/Down Navigate rows
q Quit

Sniffnet - GUI Traffic Monitor

Installation
# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# Or download from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases
Features
  • Real-time traffic charts
  • Filter by protocol, port, IP
  • Domain and provider identification
  • Geo-location of remote hosts
  • Export reports
Launch
# GUI application (requires sudo or admin)
sudo sniffnet

# On macOS, may need to grant network access in System Preferences

Common Patterns

Diagnose High Bandwidth Usage

# Quick check: which process is using bandwidth?
sudo bandwhich -n

# Watch specific interface during download
sudo bandwhich -i en0

Script-Friendly Monitoring

# Capture 10 seconds of raw data
sudo timeout 10 bandwhich -r > /tmp/bandwidth.log

# Parse raw output
cat /tmp/bandwidth.log | cut -d: -f2 | sort | uniq -c | sort -rn

Compare Interface Traffic

# Monitor WiFi
sudo bandwhich -i en0

# Monitor Ethernet (separate terminal)
sudo bandwhich -i en1

Identify Unexpected Connections

# Raw mode shows all connections
sudo bandwhich -r -n | grep -v "127.0.0.1" | head -20

Agentic Optimizations

Context Command
Quick bandwidth check sudo bandwhich -n (no DNS delay)
Machine-readable output sudo bandwhich -r
Specific interface sudo bandwhich -i <iface> -n
Capture sample sudo timeout 5 bandwhich -r > /tmp/bw.log
Parse top processes sudo bandwhich -r | cut -d: -f2 | sort | uniq -c

Quick Reference

bandwhich Flags

Flag Long Description
-i --interface Monitor specific network interface
-r --raw Machine-readable output (no TUI)
-n --no-resolve Skip DNS resolution (faster)
-h --help Show help
-V --version Show version

Raw Output Format

<interface>:<process_name>:<bytes_downloaded>:<bytes_uploaded>

Example:

en0:firefox:1048576:65536
en0:curl:4096:1024

Installation

bandwhich

# macOS
brew install bandwhich

# Cargo
cargo install bandwhich

# Linux (grant capabilities to avoid sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

Sniffnet

# macOS
brew install sniffnet

# Cargo
cargo install sniffnet

# GitHub releases (pre-built binaries)
# https://github.com/GyulyVGC/sniffnet/releases

Troubleshooting

Permission Denied

# Use sudo
sudo bandwhich

# Or set capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)

# Verify capabilities
getcap $(which bandwhich)

Interface Not Found

# List available interfaces
ip link show        # Linux
networksetup -listallhardwareports  # macOS
ifconfig -l         # BSD/macOS

# Then specify
sudo bandwhich -i <interface_name>

DNS Resolution Slow

# Disable DNS lookup
sudo bandwhich -n

Resources

  • bandwhich: https://github.com/imsnif/bandwhich
  • Sniffnet: https://github.com/GyulyVGC/sniffnet
  • Sniffnet Wiki: https://github.com/GyulyVGC/sniffnet/wiki

Use this skill

Connect your agent to the Skill Store MCP server and ask for it by ref: laurigates/network-monitoring-60435727360.

Download SKILL.md · Markdown version

Details

Publisher
laurigates
Category
Software Development › DevOps & cloud
License
MIT
Updated
2026-10-19

References

More from laurigates

  • Docs Refresh Refresh plugin catalog docs (README, PLUGIN-MAP, d2 diagram) so per-plugin skill/agent counts mat…
  • Plugin Authoring Add, modify, or delete a skill or plugin in this repo — frontmatter shape, the seven metadata fil…
  • Accessibility Implementation WCAG 2.1/2.2 compliance, ARIA patterns, keyboard nav, focus management, a11y testing.
  • Design Tokens Design tokens and CSS custom properties: theme systems, dark mode, component libraries.

Related skills