Users can monitor network activity in Windows 10 and 11 using the built-in Resource Monitor. By running the 'resmon' command, users can view active TCP connections, identify which processes are sending or receiving data, and filter activity by specific applications.
For long-term traffic analysis, Windows provides a data usage tool located in the Network & Internet settings. This feature allows users to track the volume of data consumed by individual programs over a period of 30 days, a week, or a single day.
Advanced users can utilize the command line or PowerShell to investigate network connections. Commands such as 'netstat -b' or 'Get-NetTCPConnection' provide detailed information about active processes, while the 'ipconfig /displaydns' command reveals recent DNS cache entries.
Microsoft offers the TCPView utility, part of the Sysinternals suite, for real-time monitoring. The tool displays active connections, highlights new or closed sessions, and allows users to terminate specific processes or connections directly from the interface.
To restrict network access, users can configure the Windows Defender Firewall via the 'wf.msc' console. While the default settings permit most outgoing traffic, manual rules can be created to block specific applications from accessing the internet.
