How to find out what is using your bandwidth

Start with what is free

Windows: Settings → Network & Internet → Data usage gives thirty days per application. Resource Monitor’s Network tab shows live per-process activity, and — more usefully — the TCP connections each one holds, with the remote addresses.

macOS: Activity Monitor’s Network tab gives bytes in and out per process since boot. nettop is the live version.

Both answer “which program”. Neither answers “talking to what”, which is the question when the program is a browser or a sync client.

Per-host is the useful cut

“Chrome used 40 GB this month” tells you nothing you did not know. “38 of those went to one video host” tells you what to change.

The way to get that without touching the router is a local forwarding proxy: point the browser or the application at localhost, let everything pass through, and count the bytes per hostname on the way past. No configuration on the network, no special privileges, and nothing to install on other devices.

You get, per host: bytes out, bytes in, share of the total, request count. That is enough to identify the thing you did not know was running.

For HTTPS the proxy sees the CONNECT target — the hostname — and the byte counts, and not the contents. Which is exactly the right amount: the hostname is what you wanted, and the contents are none of the tool’s business.

The usual suspects

When people go looking, it is generally one of these:

• Cloud sync re-uploading everything after a folder move, a re-index, or a client that lost its state. This is the single most common surprise, and it is often tens of gigabytes.
• Automatic updates, particularly game clients, which download whole builds rather than deltas.
• Backup software doing a full rather than an incremental, for the same class of reason.
• Video autoplay on a page left open in a background tab for a day.
• Another device. Per-machine tools will never find this one; a router’s own statistics will.

Is it the bandwidth or the connection?

These are different problems with different fixes, and it is worth knowing which you have before you buy more of anything.

Throughput is how much you can move per second. A speed test measures it.

Latency is how long a round trip takes, and it is what makes a call bad or a remote session feel like treacle. It is not improved by a faster package.

Loss and jitter are the ones that ruin calls while the speed test looks perfect. A speed test runs for ten seconds; a connection that drops for two seconds every twenty minutes passes it every time and is unusable for meetings.

That last one needs a long measurement, not a fast one. Probe on a schedule for a week and record the transitions, and you can hand somebody four lines that describe what actually happens rather than an anecdote.

The programs for this

• TrafficPilot is the per-host meter: a local forward proxy that counts exactly how many bytes crossed the wire per site, with a report of bytes, share of total and averages, and a live tail while it runs.
• NetLens does the immediate checks: TCP port scanning and TCP-connect latency to a host, with no admin rights needed. Its ping measures TCP connect time rather than ICMP, and it says so.
• LinkGuard is the long measurement: probe targets on a schedule, append every up-and-down transition to a ledger, and compute availability statistics from it. A month of that is the evidence an internet provider will actually respond to.
• RouteWatch does the same across sites: each office measures latency to every target and writes a report, and the reports merge into one grid that shows whether the problem is one office, one target, or the path between.

Free while we are in preview, one file each, Windows and Mac.

Where a per-machine tool stops

Everything above measures the machine it runs on. If the usage is a games console, a television, a phone or somebody else’s laptop, no amount of measuring your own computer will find it, and the router’s own traffic statistics are the only place that answer lives.

Check there first if your own machine comes back innocent.