title: How can I capture network packets per PID?
body: <p>Anyone know an easy way to ask Linux to "display every internet packet to/from google chrome" or "display every internet packet to/from telnet process with PID 10275"?</p>
  
  <p>The telnet example is not too useful, since I can just use wireshark or tcpdump to see all TCP conversations involving port 23. That and nobody uses telnet anymore. But sniffing all packets to/from complex applications which use many ports seems like a useful thing.</p>
  
  <p>I found some related answers exploring different ways to corroborate ports and PIDs (or programs names) and such, but nothing about packets </p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/838317/how-to-tie-a-network-connection-to-a-pid-without-using-lsof-or-netstat">How to tie a network connection to a PID without using lsof or netstat?</a></li>
  <li><a href="https://stackoverflow.com/questions/3306138/how-i-can-get-ports-assosiated-to-aplication-that-oppened-them/3308198">How I can get ports associated to the application that opened them?</a></li>
  <li><a href="https://stackoverflow.com/questions/4056850/how-to-do-like-netstat-p-but-faster/4057150">How to do like &quot;netstat -p&quot;, but faster?</a></li>
  </ul>
  
  <p>Looks like someone might have been willing to pay for this answer a while back:</p>
  
  <ul>
  <li><a href="http://www.freelancer.com/projects/Perl-CGI-C-C/tcpdump-PID-relation.html" rel="noreferrer">http://www.freelancer.com/projects/Perl-CGI-C-C/tcpdump-PID-relation.html</a></li>
  </ul>
  
  <p><a href="http://nethogs.sourceforge.net/" rel="noreferrer">NetHogs</a> is useful for quickly seeing what programs are creating traffic over an interface, but it doesn't have a way to capture packets.</p>