Having issues with some app apparently trying to do huge automatic updates and repeatedly failing (and retrying). Keeps sucking up large quantities of bandwidth, and I'd like to put a stop to it. Problem being, I have no idea which app (of several that have "silent" background updates) it is.

9 Answers 9


Open Command Prompt (cmd.exe), execute

netstat -b

and look for 'ESTABLISHED' connections. Add -n to disable name resolution.

  • Several people offered very good suggestions, but ultimately "netstat -b" plus looking for 'ESTABLISHED' was the "most correct" answer for me! Thanks all! Oct 3, 2009 at 1:45

The question is for Windows XP, but I arrived here through google looking for info on later Windows versions. If you're running Windows 7 or later:

  1. Start Task manager (right click taskbar and choose Task manager)
  2. Switch to the "Performance" tab
  3. Click "Open Resource Monitor" at the bottom.


    Press Win+R and type resmon

  4. Expand the "Network" section and wait for it to update.

    enter image description here
    click to enlarge

I'm guessing this would be similar to sgmoore's Process monitor answer, but we can now do this with a built in tool in windows 8.

netstat -ab

That will give you all TCP and UDP ports along with the respective executables involved in the communication.

For a more visual indication indication of your current connections you may want to search for netowrk monitoring tools, or probably have one available already if you are using a personal firewall the likes of Comodo.

Here's two such tools:
A Visual Netstat (Thaddy's Netstat)
Net Tools 5.0 (a suit of monitoring and information tools)

  • There's no such thing as UDP connection. -a shows listening ports which is pointless in this case.
    – Bender
    Oct 2, 2009 at 15:21
  • -a displays all active connections on which the compyuter is listening. Check your sources. This includes active and idel connections. And yes, there's no UDP connections. But could you not understand what it was meant was UDP ports? Or could you not have said it instead of letting go a one-liner that gives no information whatsoever? If you have anything to add (and you could have done so) do it. Otherwise don't pollute
    – A Dwarf
    Oct 2, 2009 at 16:37
  • When listening there's by definition no connection yet. And open UDP port is not a sign of any traffic. So -a is useless.
    – Bender
    Oct 2, 2009 at 17:41
  • 1
    Oh, I have been paying attention. But you haven't noticed the actual initial question. Neither you made an effort to actually answer it. Just nag. The fact that -a allows you to see both listening and active TCP connections allows you to more completely map running applications in position to be the culprit here. This is particularly useful because the application is behaving intermittently. At least however you finally realized the -a switch doesn't show only listening application. Well done.
    – A Dwarf
    Oct 2, 2009 at 18:32
  • 1
    You are wrong on all points: I did answer the question, I know what netstat does, I didn't say anything that's not true. Sugar-coating your attack with reasonable arguments doesn't change the fact that you've lied several times.
    – Bender
    Oct 4, 2009 at 11:49

Another handy method if you do not have huge network traffic is Sysinternals Process monitor which can be configured to monitor network traffic. It can be left running and should show what applications are accessing the network and the address/ipsite they are calling.

  • Does anyone know exactly what you need to configure to get this functionality in Process Monitor? It isn't readily apparent when I look through the configuration options...
    – Tim
    Jun 26, 2012 at 14:50
  • Nevermind...I was using Sysinternals Process Explorer, which is different than Sysinternals Process Monitor.
    – Tim
    Jun 26, 2012 at 14:55

AnVir Task Manager will monitor your network traffic (amongst many other features) and provide all information you're looking for. it will also allow you to quarantine processes (without killing them) to eliminate the culprit.

(beats Sysinternals PE hands down, even in the free version)


This is a very useful tool: MS Network Monitor.

there is also: TCPView can help you see active connections.

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.


I'm a big fan of http://www.wireshark.org/ for packet capture or other network analysis tasks.


If you're using linux, you can use IPTRaf, which is a real-time monitoring application. Checks all connections on all protocols, by port, etc.

If you're using Windows, you might want to check out Ethereal which is a GUI driven monitoring app.

The things I like about IPTraf and Ethereal (as opposed to netstat, which is pretty awesome) is that you can run them for a period of time to see what the hell is going on.

  • 1
    The question clearly states Windows. Even on Linux there are better tools to achieve the task in one step. nethogs, for example.
    – geek
    Oct 2, 2009 at 15:26

Your question is a big part of the reason that I tend to seek and destroy auto-update processes, and prefer to rely on performing a periodic check for updates myself. I'm capable of running updates once a week or more, without using up RAM forever and ever. :)

So, having said that, one method you might use for nailing down the culprit would be to determine which apps you have installed that are performing background updates (Firefox, iTunes, Notepad++, uTorrent, Google Update, Real Player, Java, etc) and try to use their manual "check for updates" facility and see which of them fails to complete successfully.

However, if you believe that the problem is specific to the actual background update process you might track it down by disabling them one at a time until the problem disappears. I use WinPatrol, but the "msconfig" utility (Start | Run | msconfig) will also allow you to disable those processes. (And more, so use it wisely.)

  • Seems popular these days to make apps that auto-update/get virus signatures by opening multiple connections that blow away the usefulness of network connections for other people. "Check for updates" seems to be a thing of the past unfortunately. The people writing these apps must only test from their local Gib/s network. Very annoying. Apr 25, 2014 at 11:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .