Opens in a new tab

How to monitor network traffic and find what is using your bandwidth

The internet feels slow and nobody can say why. Here is how to see which devices and which apps are actually using the connection, and how to tell a bandwidth problem from the other things that look like one.

Back to the blog
How to monitor network traffic and find what is using your bandwidth

Someone says the internet is slow. Someone else says it was fine yesterday. A third person has already rung the internet provider, who has run a test and told them the line is fine.

That is the usual shape of it. In the twelve months to 18 August 2026 our service desk handled 43 tickets about internet, Wi-Fi or wireless problems across 31 client businesses, about 40 hours of work. A decent share of those turned out not to be a bandwidth problem at all. The only way to know which kind you have is to look at the traffic.

Here is how to do that with what you already own, starting broad and then narrowing to one machine.

Start at the router, because it sees everything

Your router or modem is the one device every connection passes through, so it is the only place you can see the whole picture at once.

  1. Find the router’s address. On Windows, open Command Prompt and run ipconfig. The Default Gateway line is your router’s address on the local network.
  2. Open it in a browser. Type that address into the address bar. You will be asked for a username and password. If nobody knows it, your internet provider or IT provider set it, and on a business connection it is often not the label on the bottom of the unit.
  3. Find the device list. The wording differs by brand. Look under Status, Device Info, Device List, Attached Devices or Client List. You want the table of connected devices, their addresses and, on better units, how much each has sent and received.

What you are looking for is one device well ahead of the rest, or a device nobody recognises. Both are useful answers. A machine pulling ten times what its neighbours pull is usually running a cloud backup, syncing a large folder, updating an operating system, or streaming something nobody has owned up to yet.

Two warnings. Plenty of consumer routers show you connected devices but not per-device data totals, and some internet providers lock the configuration page on supplied hardware so you only get a status screen. If either applies, skip to the per-machine checks below and push the question to whoever manages the line.

Check one Windows machine

Once you suspect a particular computer, move to it.

Task Manager is the fastest look. Microsoft’s guidance is to right-click Start and choose Task Manager, or press Ctrl+Shift+Esc, and it lets you “view and manage running applications, assess CPU load, memory usage, disk activity, and network usage”. Sort the Processes list by Network and you have your answer in about five seconds.

Resource Monitor is the better tool when Task Manager is not specific enough. Press Windows key + R, type perfmon /res and press Enter. Microsoft documents /res as the parameter that starts the Resource View. Open the Network tab and you get four panels: processes with network activity, current TCP connections, which addresses each process is talking to, and listening ports. That last detail matters. Task Manager tells you an app is busy. Resource Monitor tells you who it is busy with.

Windows Settings answers the different question of what has been used over time rather than right now. Go to Settings, then Network & internet. Microsoft’s network settings guidance also covers setting a data limit on a Wi-Fi network, which is worth doing on any machine that tethers to a phone or sits on a metered service.

Check a Mac

On macOS, open Activity Monitor from Applications, then Utilities. Apple’s guide confirms Activity Monitor displays network activity alongside CPU, memory, disk, energy and GPU. Choose the Network tab and sort by data received or data sent.

The same rule applies as on Windows. One process well clear of the field is your candidate. Sync clients, backup agents and video calls are the usual three.

How to tell a bandwidth problem from the other three

This is the part most guides skip, and it is the part that saves you money.

Bandwidth. The line is genuinely full. Traffic is high on the router, files download slowly, and everything degrades together. Fixing this means a faster service, or moving something big off the daytime.

Latency. The line is not full at all, but calls stutter and remote desktop feels sticky. High traffic is not the cause here, so a faster plan will not fix it. Look at the path instead, and at anything doing packet inspection on the way through.

Wi-Fi. The connection is fine at the wall and poor in the air. The giveaway is that one area of the office suffers and a cabled machine in the same room does not. Channel overlap, too few access points, or one badly placed one.

The application. The network is healthy and one particular program is slow, which usually means the problem is at the other end, in the vendor’s service. A quick test: does a large file download at full speed while the slow app is misbehaving? If yes, stop looking at the network.

Run the router check and the per-machine check together and you can usually separate these four in about twenty minutes.

What to monitor continuously once you are past the crisis

Spot checks find today’s culprit. They do not tell you that your connection has been running at 90 per cent every afternoon for a month.

For a business network worth monitoring properly, you want three things running all the time: throughput on the internet connection recorded over weeks rather than minutes, per-device usage so a single machine cannot quietly saturate the line, and alerting when the connection drops rather than when somebody notices. Most business-grade network equipment can do all three, and it is usually already sitting in the cupboard with the feature switched off.

The other benefit is security. Traffic that nobody can account for, at hours when nobody is in, is one of the cheapest early warnings you will ever get. You cannot spot it if you have never looked at what normal is.

One thing to do today

Open Resource Monitor on the machine that complains most, sort the Network tab by send and receive, and watch it for five minutes during a busy part of the day. Write down the top three processes. That single list answers more questions than a speed test will.

If your line has been slow for months and nobody has ever shown you a usage graph, get in touch and we will look at the actual numbers with you.

Michael Kriewaldt

Michael Kriewaldt is the founder of Bastion IT, the managed IT and cybersecurity provider formed when Time Out! Computers and Gray Area Consulting came together. Bastion is SMB1001 Gold certified.

Published October 21, 2026

Want a second opinion on your IT?