I'm not sure how it works beyond that it reads /proc, but whatever it does it uses a whole lot more compute than nethogs does (which also displays per process and also uses /proc as the information source). This is fine for most of my machines, but for lower-specced machines I'll probably have to stick with nethogs[1]