# Finding who generates traffic

**URL:** <https://community.ipfire.org/t/finding-who-generates-traffic/7898>\
**Category:** Network\
**Created:** [10 May 2022 18:51 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898 "2022-05-10T18:51:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![whitetiger](https://community.ipfire.org/user_avatar/community.ipfire.org/whitetiger/32/8435_2.png) [@whitetiger](https://community.ipfire.org/u/whitetiger)\
**Post date:** [10 May 2022 18:51 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/1 "2022-05-10T18:51:26Z")

</div>

The network generates traffic in Internet upload for about 500MB **per hour** , this only in certain hours of the day.  
My ISP is penalizing me for this excessive traffic and therefore I have to find who is generalizing it.  
How can I do from IPFire?  
Then, having found the PC, I have to understand what is generating it. Anyone have to suggest me a tools for Win10?

---

<div class="post-metadata">

**Author:** ![tphz](https://community.ipfire.org/user_avatar/community.ipfire.org/tphz/32/16551_2.png) [@tphz](https://community.ipfire.org/u/tphz)\
**Post date:** [10 May 2022 19:44 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/2 "2022-05-10T19:44:16Z")

</div>

You can try

> **[Monitor network usage / bandwidth of every application on Windows](http://www.nirsoft.net/utils/app_network_counter.html)**
>
> Tool for Windows that displays the bandwidth usage and number of TCP / UDP bytes / packets sent / received by every application on your system.

> **[MiTeC Homepage](http://www.mitec.cz/netmet.html)**
>
> MiTeC

[https://www.venea.net/web/nettraffic](https://www.venea.net/web/nettraffic)

* * *

Look up how to use iptraf-ng  
`The LAN station monitor` or `IP traffic monitor` function should be helpful

![obraz](https://community.ipfire.org/uploads/default/original/2X/0/01b5269fcfd508f2eb34eb309ce1e43aec9726c8.png)

![obraz](https://community.ipfire.org/uploads/default/original/2X/0/08799a4efc5c8793c952c7fc1e74bec26c151a18.png)

 ![obraz](https://community.ipfire.org/uploads/default/original/2X/2/2ba232e86c41283042dec7c53ce26b172b3c027c.png)

![obraz](https://community.ipfire.org/uploads/default/original/2X/8/801bfd8e2bf56c1c8c0568f1c522d22550002741.png)

---

<div class="post-metadata">

**Author:** ![anon42188109](https://community.ipfire.org/letter_avatar_proxy/v4/letter/a/94ad74/32.png) [@anon42188109](https://community.ipfire.org/u/anon42188109)\
**Post date:** [10 May 2022 19:46 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/3 "2022-05-10T19:46:11Z")

</div>

If indeed, a win10 pc is the issue,

Settings \> Networks \> Data Usage where it lists which app has traffic

 ![image](https://community.ipfire.org/uploads/default/original/2X/1/1884bc91609ea9b3fc2f692ab45cd476608c5ccb.png)

---

<div class="post-metadata">

**Author:** ![whitetiger](https://community.ipfire.org/user_avatar/community.ipfire.org/whitetiger/32/8435_2.png) [@whitetiger](https://community.ipfire.org/u/whitetiger)\
**Post date:** [11 May 2022 03:13 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/4 "2022-05-11T03:13:05Z")

</div>

I need to find the PC that is generalizing traffic in INTERNET UPLOAD.  
The traffic over PC’s ethernet card is also for other reason, for example to NAS, server or printers.

---

<div class="post-metadata">

**Author:** ![tphz](https://community.ipfire.org/user_avatar/community.ipfire.org/tphz/32/16551_2.png) [@tphz](https://community.ipfire.org/u/tphz)\
**Post date:** [11 May 2022 07:18 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/5 "2022-05-11T07:18:51Z")

</div>

Czy próbowałeś iptraf-ng?

The following is an example of using the `LAN station monitor` function on interface green0  
 ![obraz](https://community.ipfire.org/uploads/default/original/2X/e/e9e5cff60fea67203491058fd828df6b69dae8db.png)

![obraz](https://community.ipfire.org/uploads/default/original/2X/4/4d5bb8a366fc3f0331c6b1043161bd1c8ed9b577.png)

 ![obraz](https://community.ipfire.org/uploads/default/original/2X/5/559a0c035e06cae58079f857a6e723d21fcb1199.png)

Before uploading a large file

 ![obraz](https://community.ipfire.org/uploads/default/original/2X/5/5d8f76e78b79bac4c09b0d107fef3a01bb4032d8.png)

When a computer uploads a large file

 ![obraz](https://community.ipfire.org/uploads/default/original/2X/6/6174ccb2e64156ba6755243c263519003f16305d.png)

---

<div class="post-metadata">

**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\
**Post date:** [11 May 2022 07:32 UTC](https://community.ipfire.org/t/finding-who-generates-traffic/7898/6 "2022-05-11T07:32:21Z")

</div>

You could also look at pmacct  
[https://wiki.ipfire.org/addons/pmacct](https://wiki.ipfire.org/addons/pmacct)

This monitors data usage down to the client level and the data is stored either in a memory table or in an sqlite3 database.