Listing Current Network Sessions in Windows with Resource Monitor

Home > Blogs > Windows 7 > Listing Current Network Sessions in Windows with Resource Monitor

Listing Current Network Sessions in Windows with Resource Monitor

Like This Blog 1 Mike Danseglio
Added by May 6, 2015

“What is my computer doing on the internet?”
“What servers does this new software talk to?”
“Where are these cloud files kept?”
“Does {insert any software here} use the internet all the time or does it ask me first?”

I get these kinds of questions all the time. Many users and administrators want to know what their software is connecting to, both internet and intranet resources.

I’ve seen some very complex answers to this problem including packet analyzers, network sniffers, and even router-based logging. But there are much simpler and inexpensive tools that are already built in to Windows. One of my favorites is a GUI tool called Resource Monitor.

Using Resource Monitor to List Current Network Sessions

Resource Monitor is primarily used as a performance analysis and troubleshooting tool. Because it helps analyze network performance, it’s also handy in listing existing network sessions.

To launch Resource Monitor, you can simply click the pearl and type Resource Monitor. It is also in the Start menu under Accessories, System Tools.

When you run Resource Monitor for the first time it displays the Overview tab as shown in Figure 1.

001-Resource-Monitor-Listing-Current-Network-Sessions

Figure 1. The Resource Monitor main page.

There’s plenty of information right there about CPU, thread count, etc. But you’re looking for the list of existing sessions. First, click the Network tab. Then expand the Processes with Network Activity, Network Activity, and TCP Connections sections. You’ll end up with a view similar to Figure 2.

002-Network-Activity-TCP-Connections-Resource-Monitor-Listing-Current-Network-Sessions

Figure 2. A dog’s breakfast of network connection data.

I’ve already sorted by Total Bytes per Second to see the processes sorted by network utilization. You can list them in any order that helps you to identify the sessions you’re looking for.

Enjoy!

Mike Danseglio -CISSP / MCSE / CEH
Interface Technical Training – Technical Director and Instructor

Mike Danseglio teaches Security classes at Interface Technical Training. His classes can be attended in Phoenix, Arizona or online from anywhere in the world with RemoteLive.

Videos You May Like

Agile Methodology in Project Management

0 154 0

In this video, you will gain an understanding of Agile and Scrum Master Certification terminologies and concepts to help you make better decisions in your Project Management capabilities. Whether you’re a developer looking to obtain an Agile or Scrum Master Certification, or you’re a Project Manager/Product Owner who is attempting to get your product or … Continue reading Agile Methodology in Project Management

JavaScript for C# Developers – September 24, 2014

0 487 3

Is JavaScript worth taking the time to learn if I’m a server-side .NET developer? How much of C# carries over to JavaScript? In this recorded video from Dan Wahlin’s webinar on September 24,2014, Dan answers these questions and more while also discussing similarities between the languages, key differences, and the future of JavaScript (ES6). If … Continue reading JavaScript for C# Developers – September 24, 2014

Detailed Forensic Investigation of Malware Infections – April 21, 2015

4 608 5

How does an investigator hunt down and identify unknown malware? In this recording of our IT Security training webinar on April 21, 2015, Security expert Mike Danseglio (CISSP / CEH) performed several malware investigations on infected computers and identify symptoms, find root cause, and follow the leads to determine what’s happening. He demonstrated his preferred … Continue reading Detailed Forensic Investigation of Malware Infections – April 21, 2015

Write a Comment

See what people are saying...

  1. Avatar Onur

    Do you have any idea why resource monitor shows “hostname” instead of IP address either for remote and local destinations, just like MikeDani7SB in your screenshots?

    Cheers.

Share your thoughts...

Please fill out the comment form below to post a reply.