Bandwidth monitoring grouped by domain/process

Question

Under Windows platform, what is the simplest way to achieve bandwidth monitoring with the following grouping use cases:

• monitor all incoming/outgoing bandwidth grouped by domain/ip (http requests mainly);
• monitor all incoming/outgoing bandwidth grouped by process name/id (all the protocols);

Ideally it would have two modes of monitoring:

• accumulative - calculates total traffic size (in bytes) after monitoring is finished (could be days). All the statistics is displayed/logged with desired grouping. Ideally, with scheduling option.
• real-time - outputs average bandwidth load in real-time with desired grouping.

GUI is acceptable, although CLI is preferable.

---

I took a look at Wireshark, it has plenty of configs and statistics in GUI version. Is it possible to achieve desired monitoring with Lua or tshark for command line usage? What are the other tools except Wireshark that can be used for such monitoring?

Answer 1

I found NTOP-XTRA (for windows) which does the job partially. BUT i'm still looking for a tool which can monitor host traffic per process (.exe).

Ntop-xtra is provided with no charge, built on top of open-source project ntop. It has plenty of options to see traffics statistics, relatively easy to configure and can dump data selectively to the disk (rrd). It can be also configured with your router, if it supports NetFlow collector (e.g., instructions for dd-wrt firmware) and monitor traffic of your entire home LAN in details. Unfortunately, it does not provide any info about processes that initiate network activity.

Answer 2

Finally found the first tool that can monitor traffic per process - Microsoft Network Monitor (somehow reminds of Wireshark, but simpler). Although it is seems to be discontinued (dates back to 2010), but works great.

The only thing left to figure out how to capture only stats data without all the detailed packet information.