Do I monitor network activity in Windows? Hi, everyone.
Leo Notenboom here for Askleo.com.
This is actually a pretty common question in that there's something going
on with your network and you're not really sure why or what, and you'd really like
to understand what program it is that is potentially
hogging your internet connection or doing something you don't quite expect.
While we can't necessarily
answer those questions here, what I want to do is show you a tool
that you can use to begin the investigation yourself.
Let's head over to Windows 11.
Click on the Start button and start typing Resource Monitor.
You'll see that it'll come up fairly quickly.
That's what we want to click on, Resource Monitor.
Now, yours may come up in a different size and that's fine.
I'm going to go ahead and rearrange
the size on this one so that we can see more of what's going on.
The tab that I'm going to click on is this network tab.
There's a lot of things that Resource Monitor will look at.
Today, we're going to focus specifically on the network tab.
Now, you can see up above here,
there are a list of processes that have network activity.
First of all, realize that you could click
and drag these column dividers to make them smaller or larger,
and you can click on the column header to sort the list by that column.
So for example, right now,
if I clicked by receive, it's sorted by the number
of bytes per second being received by this specific tool, in this case, background
transfer host, which I'm not even sure what that is.
You can click by the image, so you'll get them in alphabetical order.
You can click on send, so you'll get them in the order of who's
sending the most data as compared to who's receiving the most data.
Now, one of the things that's worth pointing out here real quick,
and I'm going to again click and drag this divider to make this a little bit
bigger is this network activity graph over here.
This can be somewhat misleading.
It's very important to understand the scale.
The scale right now is 100 kilobits per second.
That will change automatically.
In other words, if all of a sudden there's
a lot of network activity, in fact, it just changed in the opposite direction.
It now is 10 kilobits per second.
That's because there wasn't enough
activity to make it worthwhile showing it at 100 kilobits per second.
It will scale automatically to megabits per second,
gigabits per second, whatever is appropriate for your system.
But it will show you
exactly how much traffic in total is happening on your network connection.
This next one down here is TCP connections.
This is the number of connections that are being made out.
We'll get to that in just a moment.
But this is perhaps the single most interesting item on the screen.
And since I changed the position of this
divider, I actually hit a couple of these columns.
So what we can do is we can scroll over
and now make this column smaller to make everything fit back in.
Once again, we can now see everything that is here.
Again, the total bytes per second might be the most useful thing to sort by,
but this will show you which of your processes is actually responsible
for the majority of the traffic you see over here in the network traffic graph.
Now, the next interesting item here is network activity.
This actually breaks down, and once again, I can change the divider between these
panes by clicking and dragging the divider.
And once again, since we changed the size of things, I need to change this or resize
this back to be being something a little bit more useful.
Now, what we're looking at is the programs, that's the image that's
listed here, and the address to which they are connected.
This is the internet address to which they
are connected and how much data is being transferred.
Now you can see right away that by sorting by total bytes per second being
transferred, that it's the Dropbox Updater that is currently in the process
of downloading, apparently, a new version of Dropbox on this machine.
It's responsible for the majority
of the traffic on the machine as we're looking at it right now.
What's neat about this is that it's showing you now all of the programs
that are connecting on the internet and where they are connecting to.
In many cases, it will show you just the IP address and you may need to go
and figure out what service that IP address is associated with.
Let's take one of these IP addresses
that's over here and figure out who it belongs to.
Who is this program, in this case, Dropbox.
E xc, actually connecting to?
I've opened up in a separate window here, who is.
Domain tools.
Com, and I'm simply going to type in the IP address that I'm interested in.
In this case, that's
162.125.1.17. Of course, it'll probably make sure that I'm not a robot.
We'll click on Go,
and here's the information about that IP address.
And sure enough, that IP address is actually owned by Dropbox.
Imagine that.
But that's how you can go through some
of these IP addresses that don't actually resolve to a domain name that you
recognize and see where they're connected to.
Now, one of the things that is actually easy to overlook here is that we've got
a lot of programs up on top here that are running
and a whole bunch of network activity down below.
If we click on the checkbox in front
of a program like, say, MS Edge, what's happened now is that in this lower
box, we're only seeing the activity associated with MS Edge.
And as you can imagine, MS Edge.
E xy is in fact the Edge browser.
If we wanted to just look at Dropbox,
I could click on that and unclick on MS Edge.
And there are the items that are related to Dropbox.exe.
These are the places to which it is
reaching out and doing whatever Dropbox is doing online.
It's a very quick way to focus in.
You can quickly see here's my total bytes received, and I want to focus
in on whoever's using the most so I can quickly filter that lower list
to show you exactly where it's connecting to.
But wait, there's more.
If we now take a look at TCP
connections just by clicking on that to expose it,
in this case now we're also seeing exactly where it's connecting to.
Once again, I'm going to make these
columns a little bit smaller so that they'll fit.
You can see that here, Dropbox.
Exe local address.
That's actually not very important for much of what we're doing.
It's the remote access and the remote port that we care about.
In this case, we can see that 134 and
136 are being connected to by 443 using port 443.
Well, that happens to be the HPTPS port.
But that gives you a little bit more
concept of exactly what the program might be doing.
This is another way of looking at where all these programs are
connecting to out on the internet to hopefully give you a little bit
of a clue as to who's doing it and potentially why.
Like I said, understanding, for example,
that yeah, the internet connection is really slow right now because Dropbox.
Exe is in the process of updating itself, great.
That tells us we have nothing to worry about.
On the other hand,
if we find a program that we don't recognize, that we don't understand,
that we maybe want to do a little bit more research on because, again,
one of the things that can start using your internet bandwidth, malware.
And this is another way of potentially identifying what those programs might be.
Hopefully this gives you some help, some clues, some ideas on things to look
into when you're wondering what's going on with your internet connection.
For comments, for updates, for related links and more, visit
Askleo.com/5047.
I'm Leo Notenboom and this is Askleo.com
Thanks for watching.