If you are playing a multiplayer video game on Windows 11 and your “ping” suddenly skyrockets, something on your computer is secretly downloading or uploading massive amounts of data in the background. It could be Windows Update, a Steam game updating silently, or even a malicious crypto-mining virus.
The standard Windows Task Manager is notoriously bad at showing live network connections, often grouping everything under generic “svchost” processes. To find out exactly which application is secretly stealing your bandwidth, you must safely extract the active TCP/IP connection list using the Command Prompt.
How to Safely Extract Windows 11 Active Network Connections
You must use the `netstat` (Network Statistics) utility to dump the live connection table.
- Click the Start button, type cmd. You must right-click “Command Prompt” and select Run as administrator (otherwise, you won’t be able to see the specific app names).
- Click “Yes” on the User Account Control prompt.
- To extract a complete list of every active connection along with the specific process ID (PID) that owns it, carefully type the following exact command:
netstat -ano - Press Enter.
The terminal will output a massive list. Look at the right-most column labeled PID (Process Identifier). You will see numbers like “4512” or “8900.”
If you want Windows to actually extract the human-readable name of the application (like “steam.exe”) instead of just the PID number, type this more advanced command and press Enter:
netstat -abno
Windows will now scan your active connections and explicitly list the executable file responsible for the data transfer in brackets (e.g., [chrome.exe] or [backgroundTaskHost.exe]). If you spot a highly suspicious `.exe` file sitting in the “ESTABLISHED” state and consuming your bandwidth, you can take that exact name and search it in the Task Manager to forcefully end the task.