Get network usage per process

[simy8891]

Hi guys,

It's been a while since I wrote my last message here and a while since I used AutoIt. I'm currently sort of desperate and I'm trying to find some help in regards of getting the network usage per process!

I'm not interested in the total network usage of the NIC, but only on a specific PID's network utilization. They idea is to collect the amount of traffic uploaded and downloaded by a list of specific processes. So far Process Hacker and Process Explorer are capable of getting what I need, but I need to use these numbers in another script so they're sort of useless to me. I can't seem to find a way around it.

Any idea, help is greatly appreciated.

Thanks

[SlackerAl]

There is a lot of good stuff here: 

HTH

[simy8891]

21 minutes ago, SlackerAl said:

There is a lot of good stuff here: 

TH

Thanks, but unfortunately this is not good for what I need. Actually, if you look the last message in that thread on page 4, you'll see a user asking what I'm after: 

Quote

Well now since this has been bumped, I was wondering.
Is there a way to get process receive/send bytes over network like procexp?

 

[SlackerAl]

could you use something like Tcpvcon (included with TcpView) to extract the information you need?

[simy8891]

9 minutes ago, SlackerAl said:

could you use something like Tcpvcon (included with TcpView) to extract the information you need?

Tcpvcon only shows the connections, but not the bandwidth utilization of each process. I'd be more than happy to use a 3rd party cmd-like application at this point, but couldn't really find any.

[SlackerAl]

Sorry, I assumed more functionality in the cmd line version than there was... Last stab in the dark: How about https://www.wireshark.org/docs/man-pages/tshark.html available open source and windows binaries.

 

Skip that, I can't see how to resolve port addresses to PIDs

 

 

Edited February 27, 2018 by SlackerAl
Not helpful :/

[simy8891]

Appreciated the help though. I very rarely open new threads as I try to search the hell out of things before (why shall I re-invent the wheel)? But yeah, this is one of the times where I'm stuck everywhere. My goal would be doing it in Powershell, but AutoIT, C anything else would do now as long as I can then play with the outputs.

What's funny is that Resource Monitor in Windows shows the Send/Receive network info per process, but I can't find the same counter in Perfmon (which would be the one I'd use to then grab the counters from).

[JohnOne]

Start with looking into event tracing (ETW)

[Andreik]

You might get some information about a connection bandwidth using GetPerTcpConnectionEStats.