@Max,

I get your frustration on Linux network monitoring, which can definitely feel like a mess compared to what people expect it should do out of the box. But to be fair, what you’re describing is possible, just not always obvious.

Tools like nethogs, iftop, bmon, or bpftrace can show you per-process bandwidth usage in real time. If you want historical data (like “what uploaded 4GB yesterday”), you need something like vnstat combined with iptables/nftables logging or even sysdig with capture filters.

The reason Linux doesn’t “just tell you” is that applications often spawn subprocesses, share sockets, and communicate through libraries — so it’s harder to neatly label “this exact program uploaded X GB” without deeper inspection. But the kernel and tools absolutely give you enough hooks to track it down if you configure them.

So yeah, it’s not perfect out of the box — but saying Linux and security shouldn’t be in the same sentence is a stretch. Most security pros rely on Linux because of the visibility and control it offers. It just has a steeper learning curve.

For example, Linux can’t tell you which specific application uploaded 4GB of data yesterday (or a few days ago). Instead, it breaks things down by process, floods you with inter-process chatter, and makes it look like your own browser is uploading gigabytes every day.

Something as basic (and critical) as identifying which program is responsible for network uploads — especially unauthorized ones — is completely missing from this so-called ‘secure’ OS.

The truth? There’s nothing in Linux that truly performs this function. ‘Linux’ and ‘security’ should never be used in the same sentence.

I had a backlog of browser crash reports, but I’m sure they aren’t as much as the nearly 300Mb that’s been uploaded in my current session. Among other things, nobody wants their files being hacked, and nobody wants their bandwidth stolen by an unauthorized user or rogue process.

its me Prettyboydean29@gmail.com