Traffic usage per application

it's appreciated that you develop new versions freely, thanks!
it's a good idea to add the feature to have the live bandwidth usage per application, maybe a new choice under tools menu for this purpose named "application monitor"
and also it good to have onpeak/offpeak option for applications tabs under usage report.

Noted that. Will do in the future

I like the new application view.
but it could be better when you can click applications for Details. so to speak: clicking on f.e. Skype.exe would show more than path, like details in win system.
As well i want to know what an "unknown" application is. Those never show any path but it counts the bandwidth usage.
So u can guess i am currently searching my whole system what this "unknown" application is. and until now i dont have any clue so far.

any guesses?

"Unknown" may refer to an application that had established connections before NetWorx was started or whose name and path NetWorx was unable to determine.

It would normally be little traffic recorded under "Unknown".

thank you Andrew for quick response.
Since i am starting networx with OS it should have tracked any programs going online. it just couldnt determine that "unknown" one. it accumulated up to 160MB traffic since Application Settings came with last patch. so its not that low bandwidth usage.

isit possible that a new installation of networx would help to detect that source?

Hi Andrew,

I just installed the newest version from the beta site and included your driver rather than use WinPCap.

I connected to the internet and used Firefox to open this site. I then checked the Application tab, nothing re FF was shown.
But I did see the note on the Applications tab that I had to have "Ignore LAN traffic" option set to ON.

Until now, I wanted to monitor the router, and I had to leave the "Ignore local traffic within the LAN" unticked = OFF, and this way, nothing is recorded in the Applications tab.

So I ticked the "Ignore local traffic within the LAN", got the "All connections" interface, browsed with FF and initially saw FF and svchost. It's interesting that svchost is only sending data (just a tiny bit, but it keeps growing regularly...???, maybe something to do with terredo and IPV6?).
Subsequently, other programs that check for updates are also showing up, which is great.

(Right now the PC uses a wireless adapter to connect to the router. W7 Pro 64)

Thanks for adding this feature. Too bad there's no way to dig deeper into svchost traffic.

J

I have a similar problemm @ unknown application....and it amouts to over 75 % of the total usage. And suddenly i have a very very high usage, there is a huge spurt....well over 500 mb a day !! So am very surprised , and wish to figure out what is this unknown application

I have the same problem. Of the 1.76 GB of bandwidth, 93% is unkown.

Have you got some third-party antivirus or firewall that are filtering traffic?

I posted the following in a different thread:
---
opened the db with sqlitespy, selected the 'application' table
saw one row without an image_name (which is reported as "other" by networx)
changed the user_name of the row with no image_name to "ddd" (won't ever be a user with name "ddd"
edited all data_in and data_out values to zero
closed the db
---
started networx (installed version)
---
connected to internet, after 30+ minutes, I confirmed that 'unknown' no longer reports data_in or data_out.

Therefore, changing the user_name of the 'unknown' row to a 'non-existent user_name' is a good thing to do. It really should be done by networx and never be used as a real user_name.

Note: the 'unknown' traffic is a 'ghost', it was never transmitted through my router or measured by my ISP.
However it may affect the Networx quota (I didn't check this...yet .

J

Edit: PS
Andrew, When I reverted from 5.2.8 to 5.2.7 I used sqlitespy to DROP Table "Applications". Now when I just updated 5.2.8 over top, it didn't create the table. Is there a way to get the table back without losing all the history?
I know that I can force the current months totals into a new, fresh copy of the db without too much trouble but doing this for all the prior months would be tedious (if I uninstalled NW and installed a fresh copy of 5.2.8 with an empty db).

Execute the following

PRAGMA user_version = 2

This will downgrade the DB version number and NetWorx will create the application table.

Quote

Andrew

Execute the following:
PRAGMA user_version = 2

This will downgrade the DB version number and NetWorx will create the application table.
SQLiteSpy doesn't offer that command unfortunately, just the DROP TABLE for an existing table.

What software do I need to do the above PRAGMA... ?

Thanks,

J

Edit: If I Export the data, uninstall 5.2.8, install 5.2.7, install 5.2.8 over top and finally Import the data, will that accomplish my objective? (i.e. get the newest db with the Applications table with all history intact)?

Well that didn't work, traffic was not updating from the router.

I put the 'working' v.5.2.8 db back and router traffic is being recorded again, but the Application table is still missing which means that I can't Backup my stats.

I really need to know how to do the PRAGMA thing.

Thanks,

J

This worked:
copy networx.db from 2013-05-03 which has 5 tables to replace the current networx.db which has 8 tables
open networx
check the config and counts to May 3rd = OK
open the Usage Report and Restore usage data from Backup 5.2.7 2013-06-05.xml to networx.db
check the config and counts to June 5th = OK
exit networx

install v 5.2.8 which created the Application table (but now there are only 7 tables),
The config and counts are correct and traffic from router is being captured.

So, everything is OK. I'd still like to know how to run the PRAGMA.

J.

Use any SQLite management tool. I prefer SQLiteSpy and this is how it can be done (reading user_version).

Thanks Andrew, I'd never used SQL before, the "Execute SQL" was greyed out and I was at a loss of what to do.

I used SQLiteSpy to create and save a simple one line file named PRAGMA.sql and was able to match your results.

It's nice to learn something new and I'll spend some time reading up on SQL, it may make it an easier way to update the networx.db when I need to sync some readings with the router stats, such as when playing with "All connections" + "Ignore local..." for the "Applications" feature (and the "Unknown", etc.).

I promise that I won't run the "DROP TABLE" ever again on the networx.db

J

Hey Andrew,

Actually, my "unknown" application(s) is currently 40% of my total. What gives?

Scott

Thank you for NetWorx. It helps very much keeping track of my 5 GB usage per month from Verizon. I am just an old lady putting my five cents (with inflation) into this thread, trying to find out what the “Unknown” application usage is.

I start my laptop without the USB modem from Verizon, just to be sure NetWorx has time to load first before going on the Internet to be able to record ALL of the usage.

I am the only user on my laptop. My NetWorx Settings: All Connections and a check mark in the box: Ignore local traffic within the LAN. However, I am still getting the “Unknown” application data usage.

I have Windows Update set to check for updates but let me choose whether to download and install them. Every day I do a manual update for Windows Defender and see my Unknown usage increase at this moment.

I am almost sure the “Unknown” application in my case is Windows Defender updates on my Windows 8, 64-bit laptop.

Thank you again for NetWorx.
Sincerely,
Renate

Note: the 'unknown' traffic is a 'ghost', it's never been transmitted through my router or measured/charged for by my ISP.

However it does affect the Networx quota so you think you've used a lot when you haven't..

To satisfy yourself that this is 'ghost' traffic, compare the Networx total to your ISP which should provide the data usage/traffic counts throughout the month.
Well, at least my ISP, Bell Canada, does.
I simply log into "My Account" on the Bell web site and a few clicks later I can see the m-t-d total traffic and 2 clicks more I can have a csv file with detailed data for each connection session (I don't stay connected 24x7).

Once you verify that the 'unknown' isn't real (you don't get billed for it) you'll feel better but you'll still have to do the math to determine your real usage by backing out the 'unknown' from the overall totals.

Or, give up tracking by application unless you're sure you need to track something...

IMHO only of course,

J

Hello,

Ive just read this tread and im glad the 'unknown' is just a ghost. But i have another 'app' above that is even more usage then the unknown.
THe name of the app are all like chinese signs..


Dimi

The "Chinese" characters is a bug fixed in the latest version (5.2.11)

My ISP has complained that I am downloading above my limits - though I don't do anything that should cause that, so I've been trying to find out what's causing this and I installed Networx.
Many thanks - very useful.

However the only thing I can see that is downloading in volume is "Unknown" and I assume this must be what my ISP is talking about.

From the above discussion I think you're saying that you can eliminate "unknown" from being reported by changing the SQL table.
But I don't see why that means it isn't real, and if it is real then it should be reported rather than hidden.

Is it possible that something is downloading and Networx simply can't see what is doing it?

Any suggestions on other ways I can try to investigate this Unknown downloader?

Many thanks for any thoughts

@ Ralph
re-read my post from June 19, 2013.
In that I state that the 'unknown' traffic is NOT showing up in my router totals.
I used Networx to record traffic that appears to occur within the PC, i.e. the network adapter, AND
I also recorded the traffic reported by my router (using SNMP). That's two independent measurements.
I then compared those to my ISP's report.
The router agreed, Networx Applications Tab did NOT agree.

If I remember correctly, the total traffic on the Applications tab was 'much' higher than the Usage report.
Therefore I used the term 'ghost traffic'.

You can do the same as a test.
At the end of a day - Clear the Applications tab totals and disconnect from the internet (or turn off the PC).
At the beginning of the next day - connect to the internet and compare the totals on the Applications tab with the Usage report.

You didn't say whether you were able to access the detailed charges from your ISP. You need to do that in order to play detective.
You also need to disconnect from the internet when you're not using it to make the comparisons meaningful time wise. Compare those to the Hourly traffic.

You also didn't say if you used a wireless connection. If you do, and you haven't 'secured' the router, someone else may have found your router and is using it without your knowledge.

J

Many thanks for that response J.
I don't have access to my ISP data, and I don't know how / whether I can see my Router data. So all I have to work with is Networx data.

My ISP tells me on the phone that I am using more than 300Gb per month and my limit is 50.
Networx tells me that I have used 8Gb in 1 week and "unknown" seems to be doing 4-6 GB per day.

Without an ability to check further than Networx I wanted to be certain that the Unknown traffic isn't real before I look for other problems.
The router is secure and I recently added MAC address checking to lock it down further.

Many thanks
Ralph.

What is your ISP?
They should maintain and make available detailed logs of your traffic by day at a minimum if you are always connected and your PC is always ON.
If you connect/disconnect multiple times during a single day, they should have totals by each connection within that day.
They must keep that information to support their charges to you.
Have you contacted your ISP and asked for that information?

My ISP is Bell Canada. They provide a means to check my usage through the month and include a detailed listing in the Billing each month.
However, I always disconnect when I've finished using the internet and may connect/disconnect several times during the day. Therefore I don't know how much data would be available if I left the PC and connection 'always ON' but I'd at least expect a total by day.

There is a tiny fly in the ointment however, Bell logs everything using the UTC clock rather than my local time. This means that when I compare totals by day, they are sometimes 'off' a bit when I'm connected after 7 PM (8PM during Daylight Savings Time), the usage after 7 PM is reported as the following day. Not a problem reconciling it, but a pain none-the-less.

But they've never reported more than my router.

You didn't say whether your ISP is billing you extra for the 250GB (300 - 50). If not, are they threatening to do so? If they are, you might want to configure Networx to monitor your router if it supports SNMP (in which case you can't use the Applications tab) or if that's not possible, buy a router that supports SNMP (or UPnP) to get accurate totals for usage.

Do you have multiple Users? Is Networx Usage report set to report 'All users combined' or just your user ID? Open the Usage report and left click on the Users icon to check.

It still isn't clear if your router has wireless or not. Mine does and that's what I use. Even though I'm the only one using it, I still force myself to log into the router to connect/disconnect from the internet and I run the Wi-Fi Guard every once in awhile to check for other devices within range, just in case (never had one show up, that's good).

Good luck playing detective,

J

Hello
How can enable networx to monitor traffic usage of each application? It just show the total usage in application tab and I want to control each one of them.
Sorry for terrible text! I can't speak english very well!
thanks alot

You need to tick Ignore local traffic within the LAN in the main settings.

yes
thank you