Find what's eating your bandwidth in the background

If you're asking what is using my bandwidth, start with Task Manager: sort the Processes tab by the Network column and the busiest program rises to the top. Resource Monitor shows the same thing with addresses and separate send and receive figures. Both only show the present, so a hog that ran for twenty minutes and stopped needs a tool that keeps history.

Signs that something is using your connection

A background bandwidth hog rarely announces itself. You notice the side effects:

• Video buffers or drops to low quality on a connection that is usually fine.
• Voice and video calls stutter, or people say you sound robotic.
• Online games lag, even though nothing else seems to be running.
• Web pages hesitate before they start loading.
• A capped plan or a hotspot runs out sooner than it should.

Uploads cause more trouble than people expect. Home connections usually have far less upload than download capacity, and when the upload side is full, everything that needs a quick reply slows down, including calls, games and ordinary browsing.

The usual suspects

Most bandwidth hogs are legitimate programs doing their job at an inconvenient time:

• Windows Update, and Delivery Optimization, which can also share update files with other PCs. Its settings, including bandwidth limits, are in Windows Update's advanced options.
• Cloud sync and backup. Add a folder of photos to a sync client and it may upload for hours.
• Game launchers and app stores downloading updates, sometimes tens of gigabytes.
• Browsers. A background tab playing video, or a site that keeps refreshing media, is easy to forget.
• Something you don't recognize. Usually harmless, but steady uploads from an unknown program deserve a closer look. Spotting malware by its network traffic explains what to look for.

Find what is using your bandwidth with Windows tools

1. Press Ctrl+Shift+Esc to open Task Manager.
2. On Processes, click the Network column header to sort by current network use.
3. Expand the top entry to see which of its processes is busy.
4. For more detail, type resmon in the Start menu, open the Network tab, and sort Network Activity by Total (B/sec). Each row shows the program, the address it's talking to, and bytes sent and received per second.

Two gaps show up quickly. First, both tools are live only: if the upload finished before you opened them, there's nothing to see. Second, Windows services share svchost.exe, so the busy row may not say which service it is. What svchost.exe is doing on your network helps decode it.

Catch it with NetSecWall

NetSecWall watches every program's traffic all the time and keeps a local history, so you can see what's busy now and what was busy while you were away.

Right now: the Live tab, sorted by rate

The Live tab sorts programs by download rate (Rate ▼) by default, so the heaviest downloader is already at the top. Click Rate ▲ to sort by upload instead. The graph above the list shows total throughput for the last two minutes; widen the Window to 5 or 10 minutes to see a longer stretch.

Two filters narrow a busy list: Min rate (for example, ≥ 100 KB/s) hides everything quiet, and Activity ▸ Uploading shows only programs that are sending. For svchost.exe, the Service column names the Windows service responsible.

Afterwards: History totals

Open the History tab, set Group by to Apps and Range to Today or Yesterday. The list is sorted by total traffic, so the answer to "what used it all" is at the top. The timeline above shows when the traffic happened; click a busy bar to zoom into that hour.

Double-click an app to open its dashboard, with daily download and upload bars and the hosts it used most. That usually tells you whether it's a one-off update or a daily habit. History, search and reports covers the rest.

Next time: get a warning

• Tools ▸ Set session data cap… sets a total for the current NetSecWall session. You get a tray alert at 80% and again at 100%.
• Security ▸ Alerts & detection… has two per-app alerts: App exceeds its per-session data budget (500 MB by default) and App uploads more than the threshold (100 MB by default).

These alerts warn; they don't block. Nothing is cut off until you decide.

Then: pause it or stop it

Once you know the culprit, fix it at the source if you can: pause the sync client, schedule updates for the night, or lower the launcher's download speed. If you just need the connection back for a while, right-click the program in Live and choose Block this app (firewall) ▸ Block for 10 minutes or Block for 1 hour. The block lifts itself when the time is up, and NetSecWall closes the program's open IPv4 TCP connections straight away rather than waiting for them to end.

For a permanent block, see how to block an app from the internet, or keep the app and cut only its internet.

What NetSecWall can't do here

• It doesn't limit bandwidth. It can block a program or let it through, but it can't cap it at, say, 1 MB/s. Some programs have their own speed limit settings; use those.
• It only sees this PC. If the PC is quiet and the connection is still slow, the hog is another device on your network, such as a phone, a console or a TV. Your router's device list is the place to look.
• It needs administrator rights, and blocking is part of the Family and Pro plans.

To find your own background hog, download the 7-day trial. If you're on a hotspot, stopping background apps from burning data goes further.