Monitoring Packet Usage: A Guide For Windows 10 Users

Windows 10 includes built-in tools to monitor network usage and prevent you from exceeding your data cap. There are two ways to check network usage: using the Task Manager or the Settings app. The Task Manager offers a brief overview of UWP apps and their data usage, while the Settings app allows you to view data usage for both UWP apps and traditional desktop applications. To monitor packet usage, you can use the Windows 10 Packet Monitor (PKTMON), a command-line tool that helps debug network issues involving network virtualization.

Using Windows Task Manager

The Windows Task Manager can be used to monitor your network usage in Windows 10. Here's how:

• Open the Task Manager by right-clicking on the taskbar and selecting "Task Manager" or by using the keyboard shortcut Ctrl+Shift+Esc.
• In the Task Manager, click on the "App history" tab.
• Here, you will find two columns related to data consumption: "Network" and "Metered network". The "Metered network" column was introduced in Windows 8.1 to help manage data use on capped or paid data connections.
• Note that the Task Manager may not display data usage for regular Windows applications and will only show data for core Windows apps and Windows Store apps. For a more comprehensive view of your data usage, you may need to check the network settings section (see below).
• To sort the apps in the Task Manager by data usage, click on the "Network" heading to sort the list of running processes by network usage. This will allow you to see which applications are using your network along with how much bandwidth they are using.
• If you don't see the "Network" heading, click on "More Details" first.

In addition to using the Task Manager, you can also check your network usage in the network settings menu:

• Go to Settings -> Network & Internet.
• Select "Data usage" from the left-hand navigation pane.
• Here, you will see a general overview of your data usage over the last 30 days. The circular graph will show you the data used over different connections (e.g., Ethernet, Wi-Fi).
• To get a more detailed view, click on "Usage details" under the graph. This will provide a granular overview of your data usage, including data for apps from outside the Windows Store.

Using Windows Settings

There are two ways to monitor packet usage in Windows 10 using the Windows Settings. The first method is to use the Task Manager, and the second is to use the Settings app.

Task Manager

To check your packet usage via the Task Manager, right-click on the taskbar and select Task Manager. If you see the smaller version of the Task Manager, click the More details button on the bottom left corner. Then, click on the App history tab. Here, you will see the date since Windows 10 began monitoring the data usage on your apps, as well as two columns related to data consumption: "Network" and "Metered network". The Network column shows the data usage figures for each app in megabytes (MB) or gigabytes (GB). The Metered network column shows data usage for metered connections. You can also click the Delete usage history link to reset the data usage counter, which resets automatically every 30 days.

However, the Task Manager method only tracks Universal Windows Platform (UWP) apps and does not show data usage for desktop applications such as Chrome or the desktop version of Office apps.

Settings App

To check your packet usage via the Settings app, use the Windows key + I keyboard shortcut to open the Settings app. Then, click on Network & Internet > Data Usage. Here, you will see the total data usage from the last 30 days for Wi-Fi and Ethernet connections. You can click on the Usage details link to view network data usage for all your applications installed on your computer.

The advantage of the Settings app is that you can view data usage for both Universal Windows Platform (UWP) apps and traditional desktop applications. However, the Usage details page only shows total network data usage and does not provide metered network usage, tile updates, or CPU time information.

While both methods have their pros and cons, using them together can give you a complete overview of your packet usage. Additionally, if you need more advanced features, you can find different software solutions online or configure your router to monitor your data usage.

Using Windows 10 Packet Monitor (PKTMON)

Windows 10 Packet Monitor (PKTMON) is a command-line tool that was introduced in the Windows 10 October 2018 update. It is a packet sniffer or packet monitor that helps debug network issues, specifically those involving network virtualization.

PKTMON can intercept packets at all the different layers of the network stack, allowing you to trace the packet route. It also reports when a packet is dropped by a supported network component and provides additional information, such as the reason for the packet drop. This helps IT professionals determine whether a packet was dropped, where it was dropped, or if it reached its intended destination.

To use PKTMON, you need to open an elevated command-line prompt and run the program with administrator privileges. You can then use the "pktmon help" command to get instructions on using the program. For further help with a specific command, you can type "pktmon [command] help".

Before you start monitoring packets, you need to create filters using the "pktmon filter add" command. This command specifies the traffic you want to monitor. For example, to monitor all network traffic on your network, you can use the command "pktmon filter add -i 192.168.1.0/24". Once you have created your filters, you can list them to ensure they were successfully added.

To start monitoring on all network ports and capture the first 128 bytes of each packet, you can use the following command:

> pktmon start --etw -p 128

The resulting log file (PktMon.etl) will be stored in C:WINDOWSsystem32.

If you want to capture entire packets instead of just the first 128 bytes, you can use the following command:

> pktmon start --etw -p 0

When you are done monitoring, remember to stop the monitoring process and unload the PKTMON driver.

Using Command Prompt

To monitor packet usage in Windows 10 using the Command Prompt, you can use the following methods:

Netstat

The `netstat` command displays network statistics and information. To monitor network activity, you can use the following commands:

• `netstat -n 5 > scan.txt`—Saves the output to a text file.
• `netstat -b 5 > scan.txt`—Displays the executable involved in creating each connection.
• `netstat -nao 5 > scan.txt`—Includes the process ID (PID) associated with each connection.

After running one of these commands, press Ctrl + C to stop monitoring, then open the text file to view the log results.

Typeperf

The `typeperf` command monitors performance counters. To monitor network utilisation, you can use the following command:

Typeperf "\Network Interface(*)\Current Bandwidth"

Typeperf "\Network Interface(*)\Bytes Total/sec"

To specify the number of samples to collect, you can use the -sc flag. To specify the output file, you can use the -o flag.

PowerShell

You can also use PowerShell to monitor network utilisation without installing any additional tools. First, use the following command to see the total speed and name of each adapter:

Get-NetAdapterStat

Then, to see the amount of incoming traffic for a specific adapter, use the following command, replacing `` with the name of the adapter:

Get-Counter "\Network Interface()\Bytes Received/sec"

You can also monitor outgoing or total traffic by replacing `Received` with `Sent` or `Total` in the above command.

Packet Monitor (PacketMon)

Packet Monitor is a command-line tool that intercepts packets at different layers of the network stack. To use Packet Monitor, open an elevated command prompt and add filters for the ports you want to monitor. For example, to add filters for ports 80 and 443:

Pktmon filter add -p 80

Pktmon filter add -p 443

Then, to start monitoring on all network ports and capture the first 128 bytes of each packet, run the following command:

Pktmon start --etw -p 128

The resulting log file (`PktMon.etl`) will be stored in `C:WINDOWSsystem32`. To stop monitoring, run:

Pktmon stop

To format the log file and save it in a readable format, use the following command:

Pktmon format C:WINDOWSsystem32PktMon.etl -o C:templog.txt

This will create a new file (`log.txt`) in the `c:temp` directory that you can open and read.

NirSoft’s NetworkUsageView

NirSoft’s NetworkUsageView is a popular network monitoring tool that provides a detailed breakdown of network usage for every process on your PC. It doesn't require any installation; simply download and extract the .exe application from the official page. When you run the application, you'll see all network usage records based on App Name and Timestamp. Double-clicking on a Record ID will show the Bytes Sent and Bytes Received.

Using Resource Monitor (Resmon)

Resource Monitor (Resmon) is a built-in Windows tool that allows you to monitor and analyze your computer's resource usage. It provides detailed insights into the central processing unit (CPU), memory, disk, and network performance of your system. Here's a guide on using Resmon in Windows 10:

Accessing Resmon:

To access Resmon on a Windows 10 computer, press the Windows key + R to open the Run dialog box. Type "Resmon" (without quotes) and press Enter. The Resource Monitor window will open, displaying real-time performance data.

Understanding the Overview Tab:

When you first launch Resmon, the 'Overview' tab is displayed. This tab provides a basic system resource usage overview of the other four main tabs: CPU, Memory, Disk, and Network.

The CPU graph shows the total percentage of CPU capacity in use, with blue indicating the maximum CPU frequency. The Disk graph displays total current I/O and the highest active time percentage. Similarly, the Network and Memory graphs offer insights into network activity and memory usage, respectively.

Analyzing CPU Usage:

The CPU tab in Resmon allows you to monitor individual processes and their impact on CPU performance. You can filter each view by the process, helping you identify resource-intensive applications or processes causing performance issues.

Monitoring Memory Usage:

The Memory tab in Resmon shows the memory consumption of each running process, along with graphs on the right. This gives you a quick view of what physical memory is being used for. You can easily see the total physical memory, active memory usage, and hardware-reserved memory.

Tracking Disk Activity:

Under the 'Disk' tab, you can find processes engaged in disk activity. Right-clicking on any process will give you options to end the process or the entire process tree. This tab helps pinpoint any processes causing excessive disk usage or slow performance.

Monitoring Network Activity:

The Network tab in Resmon shows which programs are accessing the network and their connected IP addresses. This information is useful for troubleshooting network-related issues and identifying bandwidth-hungry applications.

Additional Features:

Resmon also allows you to monitor specific processes, identify disk read/write issues, and even terminate processes directly from its interface. It is available on most Windows versions, including Windows 7, 8, 8.1, and 10, as well as Windows Server editions.

By using Resmon, you can gain valuable insights into your system's performance, identify resource bottlenecks, and optimize your computer's resource allocation for better efficiency.

Frequently asked questions