Bandwhich (mal)

Bandwhich (originally named mal) is a terminal bandwidth utilization monitoring tool that shows network connections and their real-time upload and download speeds, organized by process and connection. Created by Aram Drevekenin (imsnif), the same developer behind Zellij and diskonaut, bandwhich has over 10,000 stars as of 2026. Written in Rust for performance, bandwhich provides real-time visibility into which processes are consuming network bandwidth, making it invaluable for diagnosing network performance issues, identifying unexpected background downloads, and monitoring application network behavior. Key features include: real-time per-process bandwidth monitoring (showing upload and download rates for each process), connection-level detail (displaying remote IP addresses, ports, protocol, and data transfer rates for each active connection), three display modes (table view showing processes sorted by bandwidth, connections view showing all active connections, and a combined view), DNS resolution (resolving remote IP addresses to hostnames for readability), packet capture using raw sockets or libpcap (no special permissions needed on most systems, though sudo may be required for raw socket access), network interface selection (monitoring specific interfaces or all interfaces), sorting by upload rate, download rate, or total, colorized output for easy identification of high-bandwidth processes, and export to CSV for further analysis. bandwhich is particularly useful on servers and workstations where multiple processes share network bandwidth and identifying bandwidth hogs is critical.