Help us improve
Share bugs, ideas, or general feedback.
From networking-plugin
Monitors real-time network traffic using bandwhich for per-process bandwidth tracking and Sniffnet for visual connection analysis. Useful for diagnosing high usage or traffic issues.
npx claudepluginhub laurigates/claude-plugins --plugin networking-pluginHow this skill is triggered — by the user, by Claude, or both
Slash command
/networking-plugin:network-monitoringhaikuThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.
Captures and analyzes network packets using Wireshark and tshark to identify malicious traffic, diagnose protocol issues, extract artifacts, and aid incident response investigations.
Analyzes network traffic with Wireshark, including live capture, display filtering, and PCAP examination for security investigations, performance optimization, and troubleshooting.
Kubernetes network root cause analysis using Kubeshark MCP for retrospective traffic analysis, snapshot management, PCAP extraction, and L7 dissection.
Share bugs, ideas, or general feedback.
Expert knowledge for real-time network traffic monitoring using modern Rust-based tools: bandwhich for CLI-based per-process bandwidth analysis and Sniffnet for visual traffic inspection.
| Tool | Type | Best For |
|---|---|---|
| bandwhich | CLI | Per-process bandwidth, quick diagnostics, scripting |
| Sniffnet | GUI | Visual analysis, long-term monitoring, filtering |
iftop)Both tools require elevated privileges to capture network traffic:
# Run with sudo
sudo bandwhich
# Or grant capabilities (Linux, avoids sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
# Start monitoring (requires sudo or capabilities)
sudo bandwhich
# Monitor specific interface
sudo bandwhich -i en0
sudo bandwhich -i eth0
# Raw mode (no TUI, machine-readable)
sudo bandwhich -r
# Disable DNS resolution (faster startup)
sudo bandwhich -n
# Default TUI with three panels:
# - Processes (bandwidth by application)
# - Connections (bandwidth by socket)
# - Remote addresses (bandwidth by host)
# Raw output for scripting
sudo bandwhich -r
# Output: <interface>:<process>:<bytes_down>:<bytes_up>
# Combined options
sudo bandwhich -i en0 -n -r
| Key | Action |
|---|---|
Tab | Switch between panels |
Up/Down | Navigate rows |
q | Quit |
# macOS
brew install sniffnet
# Cargo
cargo install sniffnet
# Or download from GitHub releases
# https://github.com/GyulyVGC/sniffnet/releases
# GUI application (requires sudo or admin)
sudo sniffnet
# On macOS, may need to grant network access in System Preferences
# Quick check: which process is using bandwidth?
sudo bandwhich -n
# Watch specific interface during download
sudo bandwhich -i en0
# Capture 10 seconds of raw data
sudo timeout 10 bandwhich -r > /tmp/bandwidth.log
# Parse raw output
cat /tmp/bandwidth.log | cut -d: -f2 | sort | uniq -c | sort -rn
# Monitor WiFi
sudo bandwhich -i en0
# Monitor Ethernet (separate terminal)
sudo bandwhich -i en1
# Raw mode shows all connections
sudo bandwhich -r -n | grep -v "127.0.0.1" | head -20
| Context | Command |
|---|---|
| Quick bandwidth check | sudo bandwhich -n (no DNS delay) |
| Machine-readable output | sudo bandwhich -r |
| Specific interface | sudo bandwhich -i <iface> -n |
| Capture sample | sudo timeout 5 bandwhich -r > /tmp/bw.log |
| Parse top processes | sudo bandwhich -r | cut -d: -f2 | sort | uniq -c |
| Flag | Long | Description |
|---|---|---|
-i | --interface | Monitor specific network interface |
-r | --raw | Machine-readable output (no TUI) |
-n | --no-resolve | Skip DNS resolution (faster) |
-h | --help | Show help |
-V | --version | Show version |
<interface>:<process_name>:<bytes_downloaded>:<bytes_uploaded>
Example:
en0:firefox:1048576:65536
en0:curl:4096:1024
# macOS
brew install bandwhich
# Cargo
cargo install bandwhich
# Linux (grant capabilities to avoid sudo)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
# macOS
brew install sniffnet
# Cargo
cargo install sniffnet
# GitHub releases (pre-built binaries)
# https://github.com/GyulyVGC/sniffnet/releases
# Use sudo
sudo bandwhich
# Or set capabilities (Linux)
sudo setcap cap_net_raw,cap_net_admin+ep $(which bandwhich)
# Verify capabilities
getcap $(which bandwhich)
# List available interfaces
ip link show # Linux
networksetup -listallhardwareports # macOS
ifconfig -l # BSD/macOS
# Then specify
sudo bandwhich -i <interface_name>
# Disable DNS lookup
sudo bandwhich -n