My current tool of choice for on-demand console traffic monitoring is tcptrack.[0] Uses libpcap so accepts the same filtering syntax as tcpdump.

It can be pretty CPU intensive, so I would recommend against running it on production perimeter systems. Also, the 2 second default retention period is a bit short.

But all in all very handy.

0: https://tracker.debian.org/pkg/tcptrack

Thanks, I'll give this a try.

Hogwatch uses Nethogs too: "Hogwatch uses a light python webserver(bottle) feeding nethogs trace mode output to the frontend (Vue.js) using websockets."

I'm not sure why a straightforward graphing project is getting so many votes.

Because it keeps other people from having to write a straightforward graphing project that does the same thing?

Utility isn't always linked to complexity.

When you upgrade to Xenial, nethogs 0.8.1 is there in the universe repo. Works fine here.

hogswatch needs nethogs 0.8.2+. I'll try to build it from source.

Edit: built from source but stuck with other people in the installation of hogswatch https://github.com/akshayKMR/hogwatch/issues/3

I haven't tried hogswatch; judging by the screenshots, it doesn't bring anything more, information-wise, than what's already present in nethogs' terminal UI.

But 0.8.1 fixes the problem described on the askubuntu page the grand-grandparent linked to.