Like This Blog 1

Added by Mike Danseglio May 6, 2015

“What is my computer doing on the internet?”
“What servers does this new software talk to?”
“Where are these cloud files kept?”
“Does {insert any software here} use the internet all the time or does it ask me first?”

I get these kinds of questions all the time. Many users and administrators want to know what their software is connecting to, both internet and intranet resources.

I’ve seen some very complex answers to this problem including packet analyzers, network sniffers, and even router-based logging. But there are much simpler and inexpensive tools that are already built in to Windows. One of my favorites is a GUI tool called Resource Monitor.

Using Resource Monitor to List Current Network Sessions

Resource Monitor is primarily used as a performance analysis and troubleshooting tool. Because it helps analyze network performance, it’s also handy in listing existing network sessions.

To launch Resource Monitor, you can simply click the pearl and type Resource Monitor. It is also in the Start menu under Accessories, System Tools.

When you run Resource Monitor for the first time it displays the Overview tab as shown in Figure 1.

Figure 1. The Resource Monitor main page.

There’s plenty of information right there about CPU, thread count, etc. But you’re looking for the list of existing sessions. First, click the Network tab. Then expand the Processes with Network Activity, Network Activity, and TCP Connections sections. You’ll end up with a view similar to Figure 2.

Figure 2. A dog’s breakfast of network connection data.

I’ve already sorted by Total Bytes per Second to see the processes sorted by network utilization. You can list them in any order that helps you to identify the sessions you’re looking for.

Enjoy!

Mike Danseglio -CISSP / MCSE / CEH
Interface Technical Training – Technical Director and Instructor

Mike Danseglio teaches Security classes at Interface Technical Training. His classes can be attended in Phoenix, Arizona or online from anywhere in the world with RemoteLive.

• CISSP (Certified Information Systems Security Professional)
• Certified Ethical Hacking and Countermeasures v8
• Computer Hacking Forensic Investigator – CHFI v8
• CompTIA Security + Certification Skills