How to Monitor Device Uploads on Your Router and Windows PC

This guide covers what a router can and can't tell you. It also covers what to do on Windows when the router falls short, and how to avoid blaming a device that is just doing its job. The walkthrough follows How-To Geek's report by Monica J. White. It adds vendor documentation from ASUS, Google, Ubiquiti, and Microsoft.

Step 1: Work out what is on your network​

You can't judge a device's behavior until you know which devices exist.

1. Open your router's admin page or its companion app. Typical addresses are 192.168.1.1 or 192.168.0.1, though yours may differ. Check the router label or its documentation.
2. Look for a section called Connected Devices, Clients, Device List, or Network Map. The name varies by vendor.
3. Match each entry to something you own: PC, phone, TV, console, smart plugs, cameras, printers.

Depending on the router, you may see local IP addresses, MAC addresses, and sometimes manufacturer names. Don't panic over an unfamiliar entry. Randomized MAC addresses and generic hostnames can make your own phone or laptop look like a stranger. Unplug or rename things one at a time to identify them, rather than assuming the worst.

Google's help documentation shows how list scope can differ. In the Google Home app, the device list includes devices that used the network in the last 30 days, not only ones currently connected. A device you don't see right now may still appear in a history view.

Step 2: Look for upload traffic​

Many routers include some kind of traffic monitor, but the label and depth vary. Look for names like Traffic Analyzer, Bandwidth Monitor, or Traffic Usage.

Some examples from vendors:

• ASUS documents a Traffic Monitor, reached under Traffic Analyzer > Traffic Monitor in its web interface. It covers Internet, wired, and wireless packets, and ASUS notes that firmware features differ across versions and models.
• Google Wifi and Nest Wifi show how much data each device has uploaded and downloaded in the Google Home or Google Wifi app. Google notes that the totals shown next to "Devices" represent Internet (WAN) traffic.
• Synology SRM offers Network Center > Traffic Control > Monitor, according to the research brief. Synology says it covers Internet traffic, not LAN traffic.

Two habits will keep you from misreading the numbers:

• Separate live rate from total. A live rate in Mbps or B/sec shows what is happening right now. A total in MB or GB shows how much moved over a period. They answer different questions.
• Check both active and idle periods. A phone uploading while you back up photos is normal. A smart plug uploading heavily at 3 a.m. deserves a second look.

Step 3: See where the data goes, if your gear allows​

Some higher-end routers and gateways log sessions, not just rates. Ubiquiti's UniFi line is the example How-To Geek uses. UniFi's Traffic Flows view is under Insights > Flows. Ubiquiti's documentation says it shows completed sessions passing through the gateway. Fields include source and destination ports, blocked or allowed status, risk level, applied policies, bytes transferred, and session duration.

Ubiquiti's documentation also sets several limits:

• Traffic Flows requires UniFi Network 9.1 or later and UniFi OS 4.2.8 or later.
• Internal SSD or added storage is required for Traffic Flows and Traffic Logging, even if you export logs.
• Logging differs by gateway. Some models log only blocked flows. Others, such as the UDM Pro, UCG Max, and EFG families, log both allowed and blocked flows.
• For UXG models, viewing all flows, including Live Flows, needs a Cloud Key Enterprise, UniFi OS Server, or Official Hosting subscription.

Ubiquiti's separate Traffic and Device Identification feature (a form of deep packet inspection) categorizes traffic and identifies device types. Its documentation says an app taking a large share of traffic can be blocked or speed-limited with a rule. That is categorization, not proof of what a device sent.

What a destination does and doesn't tell you​

A destination IP address or domain can help you work out which service a device talks to. Looking it up can show, for example, a cloud backup provider or a camera vendor's servers. It does not show the content. As the original article puts it, you learn who and when, not what. That holds even on advanced gear.

An unfamiliar destination isn't proof of malice either. CDNs, telemetry endpoints, and update servers often resolve to names that mean nothing to a human reader.

Step 4: When your router isn't enough​

ISP-supplied or basic routers often show little beyond a device list. You can still investigate from a Windows PC.

Resource Monitor​

1. Press Win + R, type resmon, and press Enter.
2. Open the Network tab.
3. In Processes with Network Activity, click the Send (B/sec) column to sort by upload.

This shows which applications on that PC are sending data right now. It covers only that machine, and it is a live view, not a history of past activity.

TCPView​

Microsoft's free Sysinternals TCPView goes a step further on the destination side. According to Microsoft's documentation, TCPView also reports the name of the process that owns the endpoint. It lists TCP and UDP endpoints with local and remote addresses and connection state. By default it updates every second, and you can change the rate under Options | Refresh Rate. Changed endpoints are highlighted in yellow, removed ones in red, and new ones in green. Microsoft's page lists v4.19, supporting Windows 8.1 and later and Windows Server 2012 and later. The download also includes Tcpvcon, a command-line version.

One independent writeup says you can right-click a row to run a Whois lookup on the remote address. That helps with identifying a destination, but it still tells you nothing about the content.

A note on terminology: Windows performance counters such as Bytes Sent/sec describe network-interface utilization. They don't attribute traffic to individual applications. Use Resource Monitor or TCPView for per-process work.

Pi-hole​

For network-wide visibility, the original article also suggests Pi-hole, a DNS-level tool. DNS logs show which domains each device asks about. They don't show upload volume or content.

What counts as suspicious​

Plenty of uploading is routine. How-To Geek lists phone photo sync, security cameras, and background Windows updates. Cloud backups also fit. Treat the following as the stronger signals:

• Unusually large transfers.
• Sustained uploads from a device that should be idle.
• Repeated connections to destinations that don't fit the device's role.

Compare more than one observation window before drawing conclusions. A single burst is far less meaningful than a pattern.

Practical limits and caveats​

• Router support varies widely. Don't assume your model has per-device traffic stats, destination logs, or history.
• Counts may exclude local traffic. Synology says its monitor covers Internet traffic only. Other vendors may differ.
• Application detection is estimated. Synology puts the accuracy of its deep-packet-inspection-based application detection at roughly 80 to 90 percent. Treat app labels as hints.
• Windows tools see only one PC. Resource Monitor and TCPView won't reveal what your TV or camera is doing.
• Encrypted traffic hides content. That is general industry knowledge rather than something the sources spell out. Most modern traffic is encrypted, so even detailed logs rarely show what was sent.

The takeaway​

Your router can't read your devices' minds. It can often show who is talking, how much, and sometimes to whom. Begin with the device list. Check the traffic monitor if there is one. Then use Resource Monitor and TCPView on your PC for the process-level detail your router can't give. Investigate patterns, not single data points. If a device you can't explain keeps uploading while idle, unplug it and see whether the pattern stops.