How to find which process is using the network
Something is using your bandwidth, holding a port open, or quietly talking to the internet in the background — and you want to know exactly which process is responsible. This guide shows you how to tie a connection to the app behind it: first with the free tools built into Windows and macOS, then the faster way with NetGlobe, where every connection is already labelled with its process.
The short version
Free and built in: On Windows, use Resource Monitor,
netstat -ano, and Task Manager to map a connection or port
to a process ID (PID). On macOS, use Activity Monitor, lsof,
and nettop. They're accurate — but they hand you a PID and
a raw IP address, with no idea who's on the other end.
The faster way: NetGlobe attributes every live connection to its process on a geolocated map and, on one click, tells you the process, its trust score, and who the endpoint is. It's a one-time $18.99 on Windows or Mac. It shows the process — it doesn't block it.
The built-in (free) way.
Every Windows PC and every Mac ships with tools that tie a connection — or a specific port — back to the process that owns it. Here's how to use them accurately.
On Windows
Open Resource Monitor for a live view of every process with network activity:
C:\> resmon # Network tab → "Processes With Network Activity" + "TCP Connections"Or list every connection in Command Prompt with its owning process ID (PID) in the last column:
C:\> netstat -anoTo find what's holding a specific port, filter by it (replace PORT with the number):
Run an administrator prompt with -b to print the executable name directly:
Then match that PID in Task Manager → Details (add the PID column), or check Task Manager → App history for per-app network totals.
On macOS
Open Activity Monitor → Network to rank processes by data sent and received. For the connections and ports behind them, open Terminal and list open sockets with their process:
$ lsof -nP -iNarrow it to established TCP sessions only:
$ lsof -nP -iTCP -sTCP:ESTABLISHEDTo find what's using a specific port, name it directly:
$ lsof -nP -iTCP:PORTOr watch live, per-process throughput, top-style:
$ nettop -m tcpWhere the built-in tools stop
These commands are correct and genuinely useful, but they stop at a PID and a raw IP.
You learn that PID 5820 is chrome.exe talking to
140.82.113.21 — not who owns that address, where it is, or
whether it's on a threat list. Short-lived connections also vanish between runs of
netstat. That's the gap NetGlobe closes.
Attribute it instantly with NetGlobe.
Same connections, but every one is already tied to its process and explained on one click. Four steps.
-
Open NetGlobe
On Windows 10 or 11, install it from the Microsoft Store. On Mac (macOS 11+, Apple Silicon or Intel), use the direct download. Launch it — it reads your live connection table locally, on the device, with no account and no upload. It's a one-time $18.99 on either platform.
-
Every connection is already attributed to its process
On the live, geolocated map, each active connection is labelled with the process that opened it — so you can see at a glance which app is on the network, with no PID lookups.
-
Click a connection to inspect it
Click a line to open Endpoint Focus: the owning process and its 0–100 trust score, plus the endpoint's country and city, the network owner via WHOIS/RDAP, reverse DNS, the TLS certificate, and any threat-intel matches.
-
Find the process you're after
Sort or filter by process to surface the one using the most connections or bandwidth, or the unexpected one reaching a place it shouldn't — then decide whether it belongs.
What to check once you've found it.
Once you know the process, three questions tell you whether it's normal or worth a closer look.
- Is the process expected and signed? A familiar, code-signed app is usually fine; an unsigned process with a low trust score — especially one running from a temp or downloads folder — is worth a closer look.
- Where is it connecting? Check the endpoint's country and network owner. A steady connection to a region or hosting provider none of your apps should touch stands out.
- Is the endpoint flagged by threat intel? NetGlobe checks each endpoint against FireHOL, Spamhaus DROP/EDROP, ThreatFox, and the Tor exit list, and flags any match right in Endpoint Focus.
- Is it persistent? A process that keeps reconnecting to the same odd host on a schedule is more suspicious than a single, one-off hit.
Finding the process — FAQ
How do I find which process is using a port on Windows?
Run netstat -ano | findstr :PORT in Command Prompt (replace PORT with the number). The last column is the process ID (PID) holding that port. Match the PID in Task Manager's Details tab — add the PID column — or run netstat -anob as an administrator to print the executable name directly. Resource Monitor (resmon) under the Network tab shows the same mapping in a live view.
How do I find which process is using a port on Mac?
In Terminal, run lsof -nP -iTCP:PORT to list the process holding that port, or lsof -nP -i for every open network socket; add -sTCP:ESTABLISHED for live TCP only. The COMMAND and PID columns name the process behind the connection.
How do I see which app is using the most bandwidth?
On Windows, Task Manager's App history tab shows network totals per app, and Resource Monitor's Network tab shows live per-process throughput. On macOS, Activity Monitor's Network tab ranks processes by data sent and received, and nettop -m tcp gives a live view. NetGlobe also attributes live throughput to each process, alongside where every connection is going.
Can I see what a process is connecting to, not just that it's connected?
The built-in tools give you the remote IP address and port, but not what that endpoint actually is. NetGlobe shows the endpoint itself — its geolocation, the network owner via WHOIS/RDAP, reverse DNS, and the TLS certificate — so you know not just that a process is connected, but who it's connected to.
Does NetGlobe block a process?
No. NetGlobe is a visibility and diagnostics tool, not a firewall: it shows and explains which process is on the network and where it's going, but it doesn't block traffic. To stop a process from connecting, use your operating system's firewall for enforcement and run NetGlobe alongside it for understanding.
Commands shown are the standard, documented tools that ship with Windows and macOS; exact output and flags can vary by version. Process and endpoint details are provided for informational purposes — NetGlobe reports what your machine is connecting to, it does not block connections.
Related guides & comparisons
Stop hunting PIDs. See the process.
Every connection already labelled with its process, geolocated and explained. A one-time $18.99 — on the Microsoft Store for Windows, or a direct download for Mac.
No account. Runs entirely on your device. See the full feature list or the FAQ.