Resolved Logging What is Accessing the Net

I have a bandwidth cap on internet access, but I'm routinely blowing it by a huge margin. I already have Comodo, which shows me what is accessing the net right now and how much data is being transferred, but the information is ephemeral. I also have NetWorx, which keeps a log of how much data is being transferred. If I see NetWorx suddenly indicate a lot of activity I can take a look in Comodo to figure out what is happening, but I don't have a log of what transferred how much and from where so I can check what has happened in my absence. Thus I know that something downloaded 200Mb this morning when I wasn't looking, but I don't know what performed the download or which server it was talking to, so I can't stop it from doing the same in the future. 200Mb is one fifth of my monthly allowance.

I've tried adding a firewall rule to my router to get it to log everything, but it takes great delight in telling me I already have a rule that passes everything (the uneditable default, which doesn't log). I've considered Wireshark, but it logs far too much information and doesn't compile it into a form useful for this purpose. I've also searched endlessly for a simple logging utility, but all I find is people asking for the same thing and for the same reason.

Does anyone have any suggestions please? I'm using Win7 64 bit.

 

Yes, it's 1Gb. I need to replace it, but I do need to find out what is downloading vast quantities of data and see if I can stem the flow. That 200Mb was downloaded without any indication of anything useful happening as a result. So far I've managed to save about 100Mb a day in useless uploads and downloads.

Thanks for your suggestions, but as far as I can tell neither is capable of generating a report along the lines of:

[Application] [IP address] [Downloaded] [Uploaded]

There is a Microsoft tool called Port Reporter that I think will do this, but whilst the service seems to install OK the user interface uses .Net 1.1 and that doesn't run on Windows 7.

 

Thanks. Again it doesn't log, though I might be able to cobble together something using the command line version.

I've just been playing with PortReporter again. I can get it to generate a partial log. It doesn't tell me how much data was transferred, but if NetWorx reports a big transfer at some time during the day I can at least go back and look in the log file to see what IP addresses were accessed at that time. The log files will be monstrous though; just as well I have a big hard disk.

 

With the aid of TCPView I've just found one of the biggest bandwidth hogs. I make extensive use professionally of the web site of a highly reputable British company. I use it so much I normally have at least one page open on their website all the time my PC is switched on. It has a little applet on it, and that applet slowly and probably innocently chews it's way through tens of megabytes every day. Like a dripping tap, it wastes bandwidth so quietly no-one notices. Not any more it wont; it's now blocked with my firewall.

 

Well I've still got to find out what it is that downloads 200Mb in one lump when I'm not looking and then does nothing with it, and I've only got an awkward and indirect means of doing that, but I'll mark it as resolved anyway as I've squished one of the biggest offenders. Thank you for your suggestions.