Tink vs nethogs
nethogs is a Linux net top that groups bandwidth by process. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
nethogs names the PID. Tink answers “why is this VPS sick?”
Accidental sysadmins land on nethogs because iftop shows connections and they want the process instead. Then disk is at 91%, nginx dies, and nobody is in the TUI — no sentence that says what to run. A filling /var is a Tink warning; it is not a nethogs SENT column.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using nethogs if you already want live per-process bandwidth on an SSH session. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | nethogs |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | apt/yum install nethogs, then sudo nethogs eth0 every time the NIC looks busy |
| What you get | Working monitoring, diagnosis, and approved fixes | A curses net top grouped by PID — you still decide if that process should be killed |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source. You still pay the person who SSH'd in after customers already noticed the lag |
| Hidden costs | None — fully managed | Root on every box, a spare SSH session, and no pager unless you wrap the TUI yourself |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Interactive TUI on one interface. nethogs does not parse auth.log or propose a command |
| Configuration | None after install — heuristics and AI | Which NIC, delay, and whether you even have a terminal open when the flood starts |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read SENT/RECEIVED columns and guess which PID is the backup job |
| Fix execution | Proposes and executes approved commands with an audit trail | Monitoring only — nethogs cannot stop the process, restart nginx, or rotate a cert |
| Alerting | Built-in across 8 channels | None by default — nethogs is a live TUI; paging is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live rates only — nethogs does not forecast fill time or a quiet NIC going bad later |
| SSH brute-force detection | Built-in — parses auth.log every scan | Not included — nethogs does not read host auth.log or journald |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down you cannot SSH into nethogs either |
| Public status page | Shareable URL with 90-day history | Not included — nethogs has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a TUI on one NIC is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + a curses TUI. No mechanic you text when a backup saturates eth0 |
| Learning curve | None — works after install | Low to launch; higher to map a PID to the job that should not be running at noon |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators already SSH'd in who want per-process bandwidth on that host right now |
When nethogs is the right choice
Keep using nethogs when you already want that exact job:
- Live per-process bandwidth — you are already SSH'd in and need SENT/RECEIVED by PID on this NIC right now.
- Not connection-oriented — iftop shows sockets; nethogs groups the same traffic under the program name.
- No extra service — a package on the box, not a hub, SaaS, or Telegram bot.
- No conversation layer wanted — some operators prefer a TUI and will never use a mechanic.
The real cost of “just run nethogs”
The package is easy to install. A working ops loop for five Linux boxes is not:
- A healthy TUI still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and SSH brute-force never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — nethogs stays a bandwidth counter until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another curses session
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens nethogs after the outage, and every scan includes a diagnosis a quiet TUI will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs nmon · Tink vs htop · Tink vs Glances