# What App Is Using My Network on Windows? How to Find It

To see what app is using your network on Windows right now, open Task Manager with `Ctrl + Shift + Esc`, stay on Processes and sort by the Network column, then open Resource Monitor (`resmon`) for per-process send and receive rates. Those two tools answer "who is using bandwidth at this moment", which is a different question from "who used my data this month" and "who is this program talking to".

Keeping the three questions apart saves a lot of guessing. A slow video call needs the live view, a mobile hotspot that ran out of data needs the history, and a program you do not recognise needs its connections and its file location.

## Who is using bandwidth right now

Task Manager is the quickest place to start. Microsoft describes the [Processes tab](https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/support-tools-task-manager) as a list of apps and background processes with the resource usage of each. If you only see a small window, select More details. Click the Network column header so the busiest process sits at the top, then watch it for half a minute. A spike while a page loads means little; a process that stays at the top while you are doing nothing is the one to follow.

Two things make this column less precise than it looks. It shows a rate, not a total, so a program that downloaded 5 GB an hour ago reads zero now. And on a PC with several adapters (Wi-Fi plus a VPN, or a Hyper-V or WSL virtual switch), the figure may not match what your physical connection is carrying. When the numbers look wrong, Resource Monitor gives a finer view.

Open it by typing `resmon` in the Start menu or a Run box:

```cmd
resmon
```

On the Network tab, the first table, Processes with Network Activity, lists every process that sent or received anything recently, with its send, receive and total rates in bytes per second. Sort by the total. Microsoft's [Resource Monitor guide](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd883276(v=ws.10)) explains the part that makes it useful: tick the checkbox next to a process and the lower tables (Network Activity, TCP Connections, Listening Ports) filter down to that process only.

One trap on both tools: several Windows services share a single `svchost.exe` process. A busy `svchost.exe` tells you the traffic comes from a service, not which one. Resource Monitor's CPU tab has a Services table that shows which services a selected `svchost.exe` hosts.

## Who used data over time

The live views forget everything once a transfer ends. For history, Windows keeps per-connection totals in Settings › Network & internet › Advanced network settings › Data usage, the same page Microsoft's [metered connections article](https://support.microsoft.com/en-us/windows/experience/connectivity-networking/metered-connections-in-windows) sends you to when a data limit needs removing. Pick the adapter at the top (Wi-Fi or Ethernet) and the page shows how much that connection has used, with the apps that used it listed underneath.

On the same page you can set a data limit for that connection. A [2023 Windows configuration update](https://support.microsoft.com/en-us/servicing/os/configuration-updates/2023/08/september-26-2023-windows-configuration-update) added daily and weekly limits and shows how far a limit has been exceeded. A limit does not block anything by itself; Windows warns you as you approach it, and on Wi-Fi it also locks the Metered connection switch on, which matters in the next section.

Expect a large "System" or Windows entry in the list. Updates, Delivery Optimization and other built-in components are grouped there, so a big number under System is a pointer toward Windows Update and Delivery Optimization rather than evidence of something hidden.

## Who is connecting where

When the question is "what is this program talking to", look at connections instead of rates. In Resource Monitor, expand TCP Connections and read the Remote Address and Remote Port columns for the process you ticked. From a command prompt, `netstat` gives the same list:

```cmd
netstat -ano
```

The [netstat reference](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) describes the switches: `-a` shows all connections and listening ports, `-n` keeps addresses numeric instead of looking up names, and `-o` adds the process ID (PID). Adding `-b` shows the executable for each connection, but it fails unless you run the prompt as administrator.

To turn a PID into a program name, use [`tasklist`](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist) with a filter. Replace 4120 with the PID from netstat:

```cmd
tasklist /fi "PID eq 4120" /svc
```

The `/svc` switch lists the services inside that process, which is how you tell one `svchost.exe` from another. In PowerShell, [`Get-NetTCPConnection`](https://learn.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection) returns objects you can filter and join to process names in one line:

```powershell
Get-NetTCPConnection -State Established |
  Select-Object LocalPort, RemoteAddress, RemotePort, OwningProcess,
    @{n='Process'; e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
  Sort-Object Process
```

Most apps talk to cloud hosts whose names say nothing about the app, so use the connection list to confirm which process is active, not to judge a destination.

## The usual, legitimate culprits

Most surprise traffic comes from software doing its normal job. These are the ones worth checking first.

| Source | Where it shows up | Where to slow it down |
| --- | --- | --- |
| Windows Update and Delivery Optimization | `svchost.exe` hosting Delivery Optimization, System in Data usage | Settings › Windows Update › Advanced options › Delivery Optimization |
| OneDrive sync | `OneDrive.exe` | OneDrive Settings › Sync and back up › Advanced settings |
| Microsoft Store app updates | Microsoft Store, `svchost.exe` | Metered connection pauses Store downloads |
| Cloud backup apps | The backup app's own process | The app's bandwidth or schedule setting |
| Game launchers | Steam, Epic, Battle.net and similar | The launcher's download limit and update schedule |
| Browsers | Several `msedge.exe` or `chrome.exe` processes | Close the tab or extension; see the browser's own task manager |

Delivery Optimization deserves a closer look because it also uploads. [Microsoft's privacy page](https://support.microsoft.com/en-us/windows/privacy/windows-update-delivery-optimization-and-privacy) explains that your PC can send update and app parts to other PCs on your local network or on the internet, depending on your settings, and never personal content. Under Settings › Windows Update › Advanced options › Delivery Optimization, set Allow downloads from other devices to Devices on my local network, or turn it off; you still get updates from Microsoft either way. The [Delivery Optimization article](https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/delivery-optimization-in-windows) covers the Advanced options page: an absolute or percentage limit for background and foreground downloads, a limit on upload bandwidth, and a Monthly upload limit between 1 and 500 GB. Those limits apply to automatic update downloads only; a download you start yourself ignores them. Its Activity monitor shows this month's downloads by source and your upload totals, which answers "has my PC been seeding updates" directly.

For OneDrive, Microsoft's [upload and download rate article](https://support.microsoft.com/en-us/onedrive/change-the-onedrive-sync-app-upload-or-download-rate) lets you set a fixed limit between 50 and 100,000 KB/sec or choose Adjust automatically for uploads. If you only need the line for an hour, Pause syncing from the OneDrive icon is simpler and resumes on its own. If OneDrive is also filling your disk, the [OneDrive storage guide](/windows/blog/onedrive-free-up-space-windows) covers Files On-Demand.

A browser that keeps showing traffic after you close its windows is often still running in the background. [Why Edge keeps running in the background](/windows/blog/edge-running-in-background) walks through that setting.

## Slow background downloads with a metered connection

If you are on a hotspot or a capped plan, marking the connection as metered is the broadest switch Windows offers. Go to Settings › Network & internet › Wi-Fi, select the network you are connected to and turn on Metered connection (for Ethernet, the same switch is under Network & internet › Ethernet). According to [Microsoft](https://support.microsoft.com/en-us/windows/experience/connectivity-networking/metered-connections-in-windows), Windows Update then downloads only priority updates, Microsoft Store downloads might pause, and offline files might not sync automatically. Delivery Optimization also stops uploading to PCs on the internet over a metered connection.

The trade-off is that updates you need also wait. Turn the switch off again once you are back on an unlimited connection. If the switch is greyed out and stuck on, a data limit is usually the reason: remove it under Advanced network settings › Data usage. If it is still locked, your organisation manages the setting.

## Blocking an app with the firewall, carefully

Windows Firewall can stop an app from communicating, but it is the wrong first move for bandwidth. Blocking an updater stops its updates, including security fixes, and blocking a sync app can leave files half uploaded. Prefer the app's own bandwidth or pause setting.

If you do need to remove an app's permission, open Windows Security › Firewall & network protection › Allow an app through firewall, select Change settings, clear the check box next to the app and select OK. Microsoft's [firewall guidance](https://support.microsoft.com/en-us/windows/security/firewall/risks-of-allowing-apps-through-windows-firewall) asks you to allow apps only when you need to and never to allow one you do not recognise. Write down what you changed, so you can tick it again when the app stops working in a way you did not expect.

## When to be suspicious

A busy process is usually fine. It deserves a closer look when it has no publisher, a name that imitates a system file with a small spelling difference, or a location that does not fit. In Task Manager, right-click the process and choose Open file location: a system file in `C:\Windows\System32` is expected, while the same name running from `AppData\Local\Temp` or a Downloads folder is not. Persistent uploads while the PC is idle, from a program you never installed, are the pattern to take seriously.

In that case, open Windows Security › Virus & threat protection and run a quick scan. If you still have doubts, choose Scan options › Microsoft Defender Antivirus (offline scan); [Microsoft notes](https://support.microsoft.com/en-us/windows/security/threat-malware-protection/virus-and-threat-protection-in-the-windows-security-app) that it restarts the PC and scans before Windows loads, so save your work first, and the results appear in Protection history. Do not end every unfamiliar process along the way; many of them belong to Windows, and the [CPU usage guide](/windows/blog/windows-high-cpu-usage) explains how to trace a process before stopping it.

## Where Mole fits

Mole's Status page shows network activity alongside CPU, memory and disk: the current download rate on the Network tile, the upload rate under it, a short history of both, and whether you are on Wi-Fi, Ethernet or VPN. The counters come from your physical adapters, so they show the PC's total traffic. Mole does not split network traffic by process, and its process list sorts by name, PID, CPU or memory rather than by network.

What the process list does help with is the next step. Search it by app name, process name or PID (for example a PID you copied from `netstat -ano`) to see which app a process belongs to, and open the process to check its parent, services, startup source and listening ports. For the per-app bandwidth number itself, Task Manager and Resource Monitor remain the tools. The [Status section of the help](/windows/help) describes the page in more detail.

## FAQ

### Why does Task Manager show 0 Mbps for every app while my connection is busy?

The Network column is a live rate, and it may reflect a different adapter than the one carrying traffic when a VPN or virtual switch is present. Check Resource Monitor's Network tab, which lists every process with recent send and receive activity.

### What is using my data when Data usage only says System?

System groups Windows components such as Windows Update and Delivery Optimization. Open Delivery Optimization's Activity monitor to see this month's downloads and uploads, and limit or turn off sharing with other devices if uploads are high.

### Can Windows limit data for a single app?

The data limit in Settings applies to a whole connection. For a single app, use its own bandwidth setting, as OneDrive and most game launchers offer, or pause it while you need the connection.

### Does marking a connection as metered stop all background traffic?

No. It reduces Windows Update, Microsoft Store and Delivery Optimization activity, and some apps reduce their own use, but other programs can keep downloading at full speed.


Canonical: https://mole.fit/windows/blog/what-app-is-using-network-windows