Your internet suddenly becomes slow and you have no idea why. There's nothing obvious downloading, no big browser tab open. But something is chewing through your bandwidth behind the scenes. Could be a cloud sync tool, a game launcher pulling an update, Windows doing its own thing, or something else entirely.

The fastest way to find out is to watch your network while the slowdown is actually happening. Windows has Task Manager and Resource Monitor built in. Linux has ss for checking active sockets and the processes behind them.

Checking on Windows

You don't need to install anything. Windows already has what you need.

Open Task Manager with Ctrl+Shift+Esc. Go to the Processes tab and find the Network column. Sort by it. Task Manager tracks network use right next to CPU, memory, and disk, so it's easy to spot what's pulling data.

If the Network column isn't there, right-click any column header and turn it on. Then trigger the slowdown again and watch which process climbs to the top.

One thing: the top process isn't automatically the problem. A game downloading a patch, a browser streaming video, or OneDrive syncing files can all pull serious bandwidth for perfectly normal reasons.

Getting More Detail with Resource Monitor

Task Manager tells you something is using the network, but sometimes you need more context. That's where Resource Monitor comes in.

Press Win+R and type:

resmon

Go to the Network tab. Network Activity shows processes and how much bandwidth each one is using. TCP Connections shows the remote addresses and ports those processes are talking to.

This is useful when several processes belong to the same app, or when you need to tell the difference between a normal download and a connection that just sits there open.

Here's a simple way to investigate:

  1. Open Resource Monitor before you trigger the problem.
  2. Go to the Network tab.
  3. Watch Network Activity while your connection slows or bandwidth spikes.
  4. Write down the process name and how much it's pulling.
  5. Check TCP Connections for that same process.
  6. Figure out which app or service owns that process before you do anything about it.

That last step matters. Killing whatever process happens to be using bandwidth is how you turn a troubleshooting session into a bigger outage.

Using netstat for a Command-Line View

Windows includes netstat, which shows active TCP connections, listening ports, and related stats.

Open Command Prompt and run:

netstat -ano

The -a flag includes listening and active connections. The -n keeps addresses and ports as numbers. The -o adds the process ID (PID).

That PID is how you match a connection to a running program. Say you see a connection under PID 1234. Look it up in Task Manager, or run this in PowerShell:

Get-Process -Id 1234

You can also make netstat refresh every few seconds:

netstat -ano 5

That's handy when a connection only pops up briefly.

One thing to keep in mind: netstat tells you what's connected and which PID owns it. It doesn't measure how much bandwidth each process is actually using. It answers "what's talking?" better than "what's eating all my speed right now?"

Checking on Linux

Linux has several command-line tools for this. One of the most useful is ss, which inspects sockets.

Run:

ss -tunp

The -t shows TCP, -u shows UDP, -n keeps addresses numeric, and -p shows the processes using those sockets (assuming you have the right permissions).

To look only at established TCP connections:

ss -tnp state established

If process info is missing, try with sudo:

sudo ss -tunp

Output varies depending on your distro, your permissions, and the sockets involved.

Like netstat on Windows, ss is mainly for seeing connections and sockets. It won't replace a proper per-process bandwidth monitor if you need transfer rates over time.

Open Connection vs. Heavy Traffic

Having an open connection doesn't mean a program is using much bandwidth.

Browsers, chat apps, game launchers, and background services can keep idle TCP or UDP connections open for a long time. Seeing a connection in netstat or ss doesn't prove the process is downloading anything big right now.

For bandwidth problems, you need to while the slowdown is happening. If your connection only drags while a launcher is updating a game, that launcher is probably the cause. If it happens while Dropbox is syncing, match the timing to the client's activity.

For longer checks, note the process name, the time, which direction the traffic was going, and roughly how much bandwidth it used. A few observations over time beat a single snapshot.

Common Background Bandwidth Hogs

A lot of ordinary apps generate network traffic even when you're not actively using them. Game launchers like Steam or Epic Games download patches or check for updates on their own schedule. Cloud storage apps like OneDrive, Dropbox, or Google Drive upload and download files in the background. Browsers keep tabs, extensions, and background services running. Chat apps like Slack or Discord maintain connections and sync messages. Security software downloads definition updates. Windows itself reaches out for updates and telemetry.

None of that means something is wrong. The real question is whether the traffic matches what the program is supposed to do. A big spike right after you open Steam is normal. An unknown executable repeatedly connecting to servers you don't recognize is a different story.

When the Process Name Looks Weird

Don't kill an unfamiliar process just because the name looks strange.

First, find the executable and where it lives on disk. In Windows, right-click the process in Task Manager and choose "Open file location." Check whether it belongs to software you installed and whether it's sitting in the expected folder for that software.

If you want to go deeper on Windows, Microsoft's Sysinternals tools go further than Task Manager. Process Monitor is built for watching system activity closely.

On Linux, look at the command line and the executable path. If it came from a package, check which package installed it before you assume a weird name means malware.

Figure out what it is first. Kill it second.

Stopping the Traffic

What you do depends on what the program is actually doing.

If you recognize the app, close it normally or pause its download, sync, or update feature. Most game launchers and cloud clients have controls for this built in.

If you don't need it running at all, turn off its auto-start or background activity in its own settings.

If the traffic comes from Windows services or updates, be more careful. Windows has metered connection settings that can cut some background data use, though that also changes how updates and app sync behave.

Don't randomly disable Windows services just to make the network graph look quiet. That quiets the graph without fixing the underlying problem.

When Task Manager Shows Nothing but Your Internet Is Still Busy

A common trap is assuming every network problem will show up as one obvious app hogging bandwidth.

Some traffic is short-lived. Multiple processes can be involved. A process can make repeated small requests without the kind of sustained transfer that's easy to spot in a basic graph.

If the simple tools don't explain it, you might need to move from process monitoring to packet-level analysis. Windows has deeper network tracing and packet capture tools for cases where ordinary monitoring falls short. Packet captures can be filtered by address, port, protocol, and more, but they're a lot more involved than checking Task Manager.

For a typical home PC, start with process-level tools. Packet capture is for traffic that's unexplained, intermittent, or hard to pin down.

A Practical Workflow

Start simple. Only add complexity when you need it.

On Windows:

  1. Open Task Manager.
  2. Sort processes by Network.
  3. Reproduce the bandwidth problem.
  4. Note the process causing the spike.
  5. Open Resource Monitor if you need connection and remote-address details.
  6. Use netstat -ano when you need to map connections to PIDs.
  7. Investigate the executable if the process is unfamiliar.
  8. Go deeper only if the simpler tools can't explain the traffic.

On Linux:

  1. Reproduce the network problem.
  2. Run ss -tunp.
  3. Identify the process tied to the relevant sockets.
  4. Check the process command and executable path.
  5. Use a dedicated traffic monitor when you need actual transfer rates or history.

This keeps you from jumping straight to packet captures when a quick look at Task Manager would have answered the question in thirty seconds.

Check Local Programs Before Blaming Your ISP

When your connection suddenly feels slow, check whether a local program is eating the bandwidth first. Task Manager and Resource Monitor are usually enough for a first pass on Windows. On Linux, ss gives a solid socket-level view.

If you find a legitimate app using the connection, change that app's download, sync, or update behavior instead of disabling unrelated system services. If the process is unfamiliar, identify the executable and who owns it before you terminate anything.

An open connection isn't the same as heavy traffic, and heavy traffic isn't necessarily malicious. Watch the activity while the problem is happening, identify the process, and then decide what needs to change.

For related troubleshooting, see How to Reduce High Ping in Roblox, which covers background traffic, packet loss, Wi-Fi, routing, server choice, and other common causes of high latency.

Sources