@movq@www.uninformativ.de You could always keep it running in a detached tmux session and attach it when you see the spike. Processes that were recently using the netwotk stay in the list for 10 or 15 seconds after they’re finished so you don’t have to catch it in the act.