How to see which apps are using your internet on Windows 11

Windows 11 has three built-in ways to see which apps are using the internet: Task Manager's Network column for who is busy right now, Resource Monitor's Network tab for where each app connects, and netstat -abno for a text list of every connection and the program behind it. None of them keeps a history, or tells you which company or country is behind an address. A per-app network monitor such as NetSecWall does both.

Task Manager: who is using the network right now

The fastest check, and often enough:

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Stay on the Processes page.
3. Find the Network column. If it isn't there, right-click any column header and tick Network.
4. Click the Network header to sort the busiest programs to the top.

Windows services are grouped as Service Host: … entries; expand one to see which service it is. The Network column adds sending and receiving together, and it doesn't show where the traffic goes. It answers "who is busy", not "who is talking to what".

Resource Monitor: where each app connects

Resource Monitor shows destinations as well as rates:

1. Press Win+R, type resmon, and press Enter.
2. Open the Network tab.
3. In Processes with Network Activity, sort by Send (B/sec), Receive (B/sec) or Total (B/sec).
4. Tick the checkbox next to a program. The Network Activity and TCP Connections panes now show only that program: its remote addresses, ports, rates and latency.
5. Listening Ports lists programs waiting for incoming connections.

It's a good tool with two gaps: it only shows what happens while it's open, and a bare IP address doesn't tell you who owns it.

netstat -abno: the command-line list

For a text list you can copy or save:

1. Right-click Start and choose Terminal (Admin).
2. Run:

netstat -abno

-a lists all connections and listening ports, -b shows the program behind each one, -n keeps addresses as numbers instead of slowly resolving names, and -o adds the process ID. Put a number at the end, such as netstat -abno 5, to repeat it every five seconds. The -b switch only works in an elevated terminal.

In PowerShell, Get-NetTCPConnection -State Established gives the same connections as objects, with an OwningProcess column you can match against Get-Process.

Data usage: 30 days of totals

Settings ▸ Network & internet ▸ Advanced network settings ▸ Data usage lists how much data each app used over the last 30 days, per network adapter. It's the only built-in view with any history, and it has no destinations, no times, and no split between upload and download.

What the built-in tools don't tell you

Put together, Windows' tools answer "who is busy now" and "which addresses right now". They don't answer:

• What happened while you weren't watching, hour by hour.
• Which domain, company or country is behind an address.
• Whether a program is signed, and by whom, without extra digging.
• When a new program starts connecting for the first time.
• How to block one from the same screen.

See which apps are using the internet with NetSecWall

NetSecWall reads Windows' own network events and connection tables and turns them into one live view, plus a history on your PC. It needs administrator rights to read the kernel's network events, which is why Windows asks for permission when you start it.

1. Open the Live tab and set View to Apps. There's one row per program, and one per Windows service inside svchost.exe, sorted by download rate.
2. Expand a row to see its connections: local and remote address and port, protocol, state, and remote host name.
3. Read across for Rate, Total and Peak in both directions, plus First seen: when that program was first seen online.
4. Select a row. The details pane shows whether it's signed and by whom, its install date, a graph of its traffic, and its Recent DNS queries.

To narrow the list, use the filter bar. Type a program name, port or IP address, or choose from Proto, State, Activity (for example Uploading), Trust (for example Unsigned) and Min rate. The Threats checkbox shows only connections to addresses on threat-intelligence lists. Filtering the Live tab goes through every option.

The View selector also groups live traffic By IP, By Domain, By Country or By Category, which is handy when the question is "who is talking to this company" rather than "what is this app doing". For anything in the past, the History tab keeps per-minute totals per app and destination. Reading the Live tab covers each column.

Making sense of what you see

A first look at every connection on a PC is usually busier than people expect. Most of it is normal:

• Browsers open dozens of connections, because each page pulls from many domains.
• svchost.exe rows are Windows services such as Windows Update and time sync. Read the Service column; what svchost.exe is doing on your network explains the common ones.
• CDN addresses from Cloudflare, Akamai, Amazon and others appear for nearly every app; see why every app connects to CDNs.
• Updaters and sync clients run in the background whether or not you opened them today.

What deserves a second look: an unsigned program running from a temp or downloads folder, an app you're not using that keeps a steady connection to one server, or anything in the Threats filter. How to spot malware by its network traffic covers those patterns.

The short version

For a quick check, Task Manager. For destinations, Resource Monitor or netstat -abno. For names, owners, countries, history and one-click blocking in one place, download NetSecWall and try every feature free for 7 days, no card and no account.