Learn how to identify which applications, services, and background daemons are consuming upload and download bandwidth using native CLI tools and lightweight network inspection.
When your internet connection stutters, ping spikes in gaming, or upload bandwidth is maxed out, you need to identify the exact Process ID (PID) responsible.
Get-NetTCPConnection | Where-Object State -eq "Established" | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess | Sort-Object OwningProcess
sudo ss -tupn state established
---
Resource Monitor (resmon.exe) is Windows' built-in diagnostic tool for tracking active socket throughput.
Ctrl + Shift + Esc $\rightarrow$ Performance tab $\rightarrow$ click Open Resource Monitor (or run resmon.exe).---
To correlate established connections with actual process names in a single script:
Get-NetTCPConnection -State Established |
ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
[PSCustomObject]@{
ProcessName = $proc.ProcessName
PID = $_.OwningProcess
RemoteIP = $_.RemoteAddress
RemotePort = $_.RemotePort
}
} | Format-Table -AutoSize
This returns an actionable table showing every process currently holding an open TCP socket.
---
On Linux systems, socket ownership is maintained in /proc/net/ and kernel socket tables.
sudo nethogs eth0
This displays an interactive terminal UI ranking processes by sent and received KB/s.
sudo ss -tunp
Flags explained:
* -t: TCP sockets
* -u: UDP sockets
* -n: Numeric ports/IPs (avoids DNS resolution delays)
* -p: Show process name and PID
---
Many packet sniffers and firewall managers install custom NDIS filter drivers, inject packet hooks into every network packet, and consume hundreds of megabytes of RAM.
NetSniffer takes a clean, local-first approach:
* Interrogates the OS TCP/IP stack via native kernel APIs (GetExtendedTcpTable on Windows, netlink on Linux).
* Zero packet injection, zero background services.
* Shows process name, bandwidth rate, remote IP, and geographic routing in an instant, bloat-free window.
Network Security & Protocols Engineer
Focuses on local packet capture, socket lifecycle analysis, telemetry auditing, and privacy-preserving networking tools.
Unexplained port bindings and TIME_WAIT socket accumulation can degrade performance and expose attack surfaces. Learn how to audit network sockets down to the exact owning PID.
Learn how modern desktop software bundles analytics SDKs, how to capture background telemetry requests locally, and how to verify software privacy without running shady de-bloat scripts.
From excessive RAM consumption to bundled telemetry and kernel-level instability, monolithic software suites slow down the very machines they claim to optimize. Here is the engineering case for the anti-bloat micro-utility model.