How to use Resource Monitor to find network activity

Resource Monitor's Network tab lists programs, connections and ports. Learn how to open it, read it and pair it with a taskbar speed readout.

Resource Monitor goes deeper than Task Manager. Its Network tab shows which processes are sending and receiving data, and with whom.

Open it

Press Win+R, type resmon and press Enter. Select the Network tab.

What the sections show

Processes with Network Activity: programs ordered by data sent and received per second.
Network Activity: the same data grouped by remote address.
TCP Connections: open connections, with local and remote addresses and ports.
Listening Ports: programs waiting for incoming connections.

A simple workflow

Watch your taskbar readout. When it spikes, note the time.
Open Resource Monitor and sort Processes with Network Activity by Total (B/sec).
Identify the program at the top.
Decide whether to pause it, change its settings or leave it.

Cautions

Remote addresses can look cryptic. Do not assume that an unfamiliar address is malicious, since many apps use cloud services and content delivery networks. If something seems wrong, use your security software and the program’s own settings.

Why also keep a live readout

Resource Monitor is detailed but passive: you must open it. A small display such as NetSpeedDisplay tells you when something is happening, and Resource Monitor tells you what. For simple comparisons, read NetSpeedDisplay and built-in Windows tools.

How to use Task Manager to see network usage

Task Manager shows network activity per process and per adapter. Learn where to look, what the numbers mean and where a live readout helps.

Network traffic monitoring on Windows

How network traffic monitoring works and what the numbers mean.

Published 2026-10-17