bandwhich

bandwhich is a local network monitor for seeing which processes and connections are using bandwidth right now. It sniffs an interface, maps traffic back to local processes, and can show the results in a fullscreen terminal view or a raw text stream.

• See which local processes are uploading or downloading the most data on a given interface.
• Inspect live bandwidth by individual connection or by remote IP or hostname when tracking down unexpected traffic.
• Capture a lightweight text stream of current network activity for local debugging or ad hoc shell-based monitoring.

• Useful when an agent needs to inspect live local network usage and attribute it to processes, sockets, or remote hosts.
• The automation surface is weaker than typical agent-friendly CLIs because --raw is plaintext refresh output rather than JSON, and the default mode is a fullscreen TUI.
• Best fit for short diagnostic loops on a machine the agent already controls, especially when combined with other shell tools for filtering or logging.

• Packet capture needs elevated privileges on Linux, and Windows users may need npcap installed before it works.
• README marks the project as passively maintained, so it is not a fast-moving tool.