How to Check Which Programs Are Using the Internet on Windows

Your internet feels slow, your data usage is higher than expected, or you simply want to know what your PC is sending and receiving in the background. Windows has several built-in ways to see per-app network usage — and free tools that give you even more detail, including exactly where each connection is going.

Method 1: Windows Task Manager — Quickest Overview

Windows Task Manager shows network usage per process in its main Processes tab. It's always available, requires no download, and is the fastest first step.

1. Press Ctrl+Shift+Esc to open Task Manager
2. Go to the Processes tab
3. Look at the Network column (rightmost by default) — it shows MB/s being sent or received per process in real time
4. Click the Network column header to sort by usage — highest consumers move to the top

This quickly identifies which application is responsible for high network activity. The limitation: it shows bandwidth throughput numbers only — not where the connection is going, what IP it's talking to, or on which port.

On Windows 11, the same information is available in the updated Task Manager — look for the Network column in the Processes view.

Method 2: Resource Monitor — Built-In with More Detail

Resource Monitor is a built-in Windows tool that provides more network detail than Task Manager, including send and receive rates broken out separately per process.

1. Press Windows + R, type resmon, and press Enter
2. Click the Network tab at the top
3. The Processes with Network Activity section at the top shows each process with total, send, and receive bytes/second
4. The Network Activity section below shows individual connections per process — with remote address and port
5. The TCP Connections section shows connection state (ESTABLISHED, LISTENING, etc.)

Resource Monitor is significantly more informative than Task Manager's basic network column. It shows the remote addresses for active connections, making it useful for investigating what a process is communicating with — without any additional software.

Method 3: SterJo NetStalker — Full Connection-Level Detail with Blocking

SterJo NetStalker is a free dedicated network monitor that shows every active TCP/UDP connection in real time — updated every second — with the full executable path of the owning process, remote IP, port, protocol, and connection state. It also lets you block any process from the internet with a right-click.

Compared to Resource Monitor, NetStalker adds:

• The full executable path per connection — critical for spotting malware impersonating legitimate process names
• Right-click to block any process from the internet permanently
• Right-click to search Google for any process or remote IP
• Interactive alerts when a new (uncached) program first connects — allow or block on the spot
• Policy rules — permanent allow/block rules by executable path, IP, or port
• Portable — runs from USB, no installation required

Method 4: SterJo Task Manager — Process + Network in One View

SterJo Task Manager (free) gives you a combined view: the main Processes tab shows CPU, RAM, disk, and network usage per process — and a dedicated Network tab shows active connections with remote IPs and ports, similar to NetStalker but within the same tool you're already using for process management.

This makes it convenient if you're already using SterJo Task Manager to manage processes or startup programs and want to check network connections without switching to a separate tool.

Method Comparison Table

📚 Related Guides