A pretty easy thing to do so it seems but i'm struggling with it. I got some (Windows XP) clients connected via OpenVPN using bridged mode. Now suddenly I started to see higher traffic load from those clients and was wondering what process is generating the traffic.

So i grabbed Process Explorer and NetLimiter to find that openvpn.exe is causing the traffic, directed to the VPN endpoint on port 443. Once I turn OpenVPN off the traffic is gone of course.

The issue is that I'm not sure if OpenVPN.exe is generating the traffic - I doubt it - or any other process and that to Windows it just looks like OpenVPN.exe would generate the traffic because it's the last process that touches the traffic before sending it on the physical interface. I guess the same can be observed when using a software firewall.

Is there any way to find the "real" process that is generating the traffic?


Glasswire Free or other network packet sniffer should do the job.

  • Dosn't work with Windows XP. Other tools like Wireshark sniff packages. Kinda hard to find a process that's communicateing alot only looking at single packages - but maybe you got some working Wireshark filter that will sort the result to something that helps? – omni Jun 30 '15 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.