There are many answers here detailing programs that will monitor and log internet usage for a pc, but I need that usage to be logged and broken down, detailing which applications consumed that data.

I've noted there are several that give a real-time feed of each application's data usage (NetLimiter, Win7 Resource Monitor), but I can't find one that will log such data.

Anyone know of one? Need to track down which program is using up a friend's bandwidth!

3 Answers 3


There are a variety of programs to suit this purpose.

Fiddler records all communications and even shows you to where/what, and which program was responsible.

NetBalancer shows you a graph of a processes bandwidth usage (i presume this is what you really want to see, rather than a raw text output). It also allows you to limit and block network activity on a per process basis.

  • 5
    NetBalancer does what I need - lists it all out clearly and tells me what I need to know. Doesn't log to file per se, but I can just keep the app running in the background no problem. Thanks!
    – LJW
    Commented Apr 26, 2012 at 19:05
  • 1
    Business users should note the licensing requirement for NetBalancer. Registration (purchase) is required for business users of the software.
    – Mister_Tom
    Commented Sep 13, 2016 at 21:11

If you can't find anything you're happy with application-wise, a heavyweight (but oh-so-satisfying-when-you-work-it-out) solution would be to do some network monitoring with Microsoft Network Monitor (v3.4 right now) which would then give you the ability to slice n dice things as you wanted?

Straight up though - it won't give you precisely what you're after (a per-application level log) but it will give you the ability to slice the data up to get at that information, if you're feeling creative.

(It's also kinda fun seeing where your data goes..)

Introducing: Microsoft Network Monitor 3.4

I'm just performing a capture now while typing out this answer, and to add some variety into the mix - checking for windows updates, and running IE to fetch some files - but as you can see from the screenie here: Network Monitor screenshot It can a bit overwhelming at first, I'll admit, but mainly I'd draw your eye to the left hand side box which will show you all the processes it's captured as generating network traffic. Opening up the application will then break it down into conversations, which you could further go into. It's probably better to just have a quick play rather than me wasting a mountain of words explaining, but in short - it's going to log every little bit of network traffic that it can -- that's what's being displated in the middle pane.

Filtering it all back so you don't go insane...

You can apply filters to the data you've captured in order to trim down what you're looking at like say, knocking out certain IP addresses,protocols, or even particular processes (or even conversations if you wanted..).

The filter language is documented within the help, and it's got some decent canned examples, but just so you can see without downloading the package some examples would be:

Conversation.ProcessName == "iexplore.exe"   // restrict your examination to iexplore.exe
(Conversation.ProcessName == "firefox.exe" and Conversation.ProcessId == 3824) // only look at firefox process 3824
IPv4.Address ==                 // traffic in both directions to superuser.com
IPv4.SourceAddress ==           // traffic coming from superuser.com

...and aggregating it to something a bit more readable (NMTopUsers)

Right. That allows you to filter back to a certain target group, but unless you're feeling particularly masochistic and you enjoy reading frame headers, you want to get the NMTopUsers expert (literally, under the experts menu, go and hit the 'download experts' option)

This expert will process whatever data you throw at it, AFTER it's been filtered (so to do this, you'd open up a capture file, apply your filters to isolate say firefox.exe, and then invoke the expert) and give you an output that looks a bit like this: the result of running NMTopUsers over a block of traffic

Graphs are also available if you've got the relevant package installed (I don't on this machine) and the output will allow you to eyeball, by destination, where your traffic is going to (and coming from), along with the headline figures which will give you, in a roundabout way, what you're looking for.

Someone may have developed an expert to do exactly what you're after, but I'm not aware of one, sorry. I'd offer to build something but I'm kinda out of practice :P

Anyhoo, using this, if you're feeling like having a play, you could approach your 'what the hell is chewing up my bandwidth' problem with some basic logging of your interface using perfmon (which can help you isolate when things are happening or if it's a sustained baseload problem) and in parallel (or after the event) set up a network monitor trace to capture the data you're interested in (the more you can focus capture the better, since you're going to end up with laaaaarge capture files if you do it for any length of time).

Once you've got all of that, you can run NMTopUsers and drill down to see which are your particularly hungry apps, and also, where it's all going in some fashion, and heck, if it's HTTP or something else..

  • Great response, but NetBalancer is a simpler way of getting the data I need. Already checked this out a few days ago and it was my first backup option :)
    – LJW
    Commented Apr 26, 2012 at 19:06
  • 1
    Ah, cool :D I must admit I was a bit uhm/ahh about putting this up since it's not a direct solution, but I figured anyone who stumbles across it might find the info useful (and more people being curious enough to rip into their network traffic is never a bad thing.. right?)
    – tanantish
    Commented Apr 26, 2012 at 19:15
  • 3
    Just for anyone else who stumbles across this 3 year old thread like I did...(Still useful information - just one section out of date!) Microsoft Network Monitor has been superseded by Microsoft Message Analyzer
    – Rus Ti
    Commented Jul 8, 2015 at 4:08
  • @RusTi Which bits out of date? I've got some free time this w/e so I'll fold in the new notes and give it a bit of an update :)
    – tanantish
    Commented Jul 9, 2015 at 13:25

Maybe TCP View from MS Sysinternals will help you. Here's the link http://technet.microsoft.com/en-us/sysinternals/bb897437

  • 6
    That's very close to what I need, but if the user closes a process, or the process finishes with a port, then you lose the stats for that item in the listing. I need it logged out to a file so I can analyse which app is using all the data.
    – LJW
    Commented Apr 23, 2012 at 18:08
  • Old tool (2011) but still the simplest and best tool ! Commented Mar 8, 2021 at 17:30

Not the answer you're looking for? Browse other questions tagged .