A reasonably reliable traffic per application monitor using BPF. Receive notifications whenever a new program connects to the network, or when it's modified. Monitors your bandwidth, breaking down traffic by executable, hash, parent, domain, port, or user over time. Uses BPF for accurate, low overhead bandwidth monitoring and fanotify to watch executables for modification.