Member Avatar for Ritesh_4

Hello
I have Networx installed on my PC, and bizarrely enough, since this morning I can see from its traffic monitor that something/s is being downloaded, but I did not launch any specific downloads, and using Networx NetStat revealed very little info. I want to know where the downloads are coming from etc, how to monitor this in Windows? Any specific tool or option? I've looked for my updates as well, which are automatic, but I scheduled it to run every Friday

  • 3 Contributors
  • 4 Replies
  • 149 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by JolinG

Dani AI

Generated

Networx is useful for totals, but the quickest way to find "what is pulling bytes" is to map sockets back to the owning process, and only use packet capture when you need to inspect the actual traffic contents. This builds on what and pointed out about captures, but prioritizes fast triage steps so you can identify the process responsible without drowning in packets.

Use a live connection viewer that shows process names (no capture required). Run TCPView or Process Explorer as administrator, sort by remote address or bytes, and note the process path and publisher. If you prefer the CLI, map sockets to PIDs and then to processes:

netstat -ano | findstr ESTABLISHED
tasklist /fi "PID eq 1234"

(See the netstat docs for options: netstat documentation.)

If the process looks suspicious or ambiguous, capture only that traffic for content-level analysis with Wireshark. Use targeted capture filters (for example host x.x.x.x or port 443) or capture into a ring buffer with file-size limits to avoid huge files. After capture, use "Statistics → Endpoints/Conversations" to find top talkers and "Follow TCP Stream" to view transferred files or HTTP requests.

Also check Autoruns and Scheduled Tasks for updaters or P2P apps (Autoruns), verify digital signatures of culprit executables, and scan the binary on VirusTotal if needed. On Windows XP, be especially cautious: system updates stopped long ago, so unknown background downloads can indicate legitimate updaters or unwanted software/malware — map the PID first, then dig deeper.

Recommended Answers

All 4 Replies

Member Avatar for gerbil

Wireshark. Every byte. Every connection. Every IP.

commented: + +10
Member Avatar for Ritesh_4

Wireshark. Every byte. Every connection. Every IP.

any other tool which I can add to it to make it more user-friendly? am getting a lot of info in the grid and keeps on adding, and am unable to track them properly

Member Avatar for gerbil

Well, wireshark is a packet capture tool, and that's what it does. If you are trying to learn the gist of captures then one suggestion is to turn off all but one traffic source application. Next is to construct useful display filters so you see only the traffic you are interested in; once you have that set then to reduce the capture file size you can set a capture filter that accords with what you wish to display. eg... you could ignore a running bit torrent download and concentrate on email packets, say. Take note, too, of the colouring rules - they identify the type of packet.
Packets are not very human-friendly, in general.... you are seeing computer chit-chat.

Member Avatar for JolinG

As the above said, wireshark is the best choice.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.