Windows – How to track bandwidth usage of a single machine?

Verizon just called and said you’ve gone over your bandwidth limit for the month. Now you owe them $2500 for overages and don’t understand why.

Forensic discovery is likely out of the question, but perhaps you can identify what processes are consuming your bandwidth and try to prevent this from happening again. To these ends, there are a few tools available to you.

If you need to know what’s going on with your node right now, then on Windows 7, Windows 8, Windows Server 2008 or Windows Server 2012 there is a native tool that is somewhat nifty:


Windows Resource Monitor

Resource Monitor (resmon.exe) greatly expands upon the capabilities of the default Task Manager. Through it you can monitor CPU usage, memory usage, disk I/O and network utilization. To use it, just type resmon.exe in the Start > Run box (or whatever Windows 8 uses these days).

Unfortunately it does not provide any kind of mechanism for logging so you can’t see how much bandwidth a particular process used (nor can you track how much bandwidth has been used over a period of time), but it’s a great tool for monitoring traffic from a single server or host in real-time to see how much it’s currently using. If nothing else it’s a better replacement for the stock Task Manager.

Windows Resource Monitor



What you’re probably most interested in, however, is NetBalancer. This is a commercial third-party tool (with a subset of tools available to unpaid users) that will allow you to run it in the background, collect data about bandwidth use, and later on, see pretty graphs of what processes consumed what bandwidth over time.

It also has some sophisticated rate-limiting tools which are worth exploring. Implementing these may help you curtail those Verizon bills in the future once you’ve identified your rogue process(es). In the example above, I might single out BitTorrent or excessive FTP usage as a culprit since I can sort by total amount up- or down-loaded.

Block traffic once it exceeds your limits

Suppose qBitTorrent is our troublemaker. Someone left it running and seeding for days on end, on a metered bandwidth plan. Let’s punish them by blocking all their qBitTorrent traffic.

Right click on qBitTorrent and select “Create Rule.”

Blocking qBitTorrent
On the next screen, you want to set the download and upload priorities to “Blocked” (this traffic will only be blocked once we set conditions).

Towards the bottom, set it to apply this priority only when the total amount of traffic exceeds the threshold you specify. In my case, I want to block it completely, so I’m going to set a ridiculously low threshold.

Blocking qBitTorrent
Hit OK and you should see qBitTorrent traffic greatly reduced.

Do test things out before putting them into production, as the results may not be what you expect.

For example, I tried to rate limit Firefox the same way but some (tiny) requests go through and are completed, while others do not. The best analogy for NetBalancer is that it’s like a running faucet that still leaks when shut off– you can greatly cut down your water usage, but there may still be a residual drip, and some traffic can escape during these drips. Drips, over time, can overflow their bucket.

Torrent traffic is not eliminated entirely, but it is limited so greatly that no connections and/or data transfer can be established– though if you watch NetBalancer you’ll certainly see qBitTorrent try to do so despite the rate limits.

Also worth noting– if the culprit switches to a different BitTorrent client, they would be able to circumvent the limits. This setup is mostly ideal for servers.

So, if you’re looking to prevent bandwidth overconsumption, it would be prudent to set the threshold lower than the actual ISP-instituted ceiling. Those “drips” can still add up over time.

Leave a Reply