How to monitor process network activity on Linux

Approach 1. Through LSOF

For example, to figure out which process emit DNS queries you can use below command:

sudo lsof -PniUDP:53 -r 1 | grep :53

Approach 2. Via ATOP / NETATOP

Seek and install the required kernel module and userspace utility (example for Arch Linux):

yaourt -Ssq netatop

I prefer to use a more flexible variant (if it possible) with DKMS support:

yaourt -S netatop-dkms

Load module:

sudo modprobe -v netatop

Let’s get started monitor network activity according to processes:

sudo atop -n