{"id":484698,"date":"2026-06-19T02:33:13","date_gmt":"2026-06-19T02:33:13","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/484698\/"},"modified":"2026-06-19T02:33:13","modified_gmt":"2026-06-19T02:33:13","slug":"i-tried-3-free-apps-to-see-what-was-using-my-internet-connection-but-only-one-let-me-take-control","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/484698\/","title":{"rendered":"I tried 3 free apps to see what was using my internet connection, but only one let me take control"},"content":{"rendered":"

I started looking at network-monitoring tools because my home network has become more crowded than I realized. This isn’t just one desktop plugged into a router anymore. I have multiple Roku TVs<\/a>, an Xbox, an Alexa speaker, a Fire TV Stick<\/a>, several iPads and phones, and around four PCs online at any given time. I also have a Mac I use for music production that can download updates and content in the background. Add in music gear like my Kemper Player, and there are a lot of things in the house that may have a reason to be using my internet connection.<\/p>\n

That doesn’t automatically mean anything shady is happening. Most of it is probably normal: updates, sync services, app checks, streaming devices refreshing content, and background services doing what they were designed to do. But that’s also why I wanted a better look. When so many devices and apps are connected<\/a>, “something is using the internet” is not a useful answer.<\/p>\n

That’s what sent me looking for a network-monitoring tool in the first place, but I didn’t just want another dashboard full of activity graphs. I wanted something I could actually understand without becoming a network engineer, and I wanted more than a passive list of connections. If an app or device was talking to the internet, I wanted to know what was making the connection, where it was going, and whether I had any control over it.<\/p>\n

Wireshark showed me everything, but it was too much<\/p>\n

Powerful packet capture is not the same as an easy answer<\/p>\n

Wireshark<\/a> was the first tool I tried because it has a great reputation, and it did exactly what I expected it to do. It showed me network traffic in incredible detail. I could see packets, protocols, addresses, ports, timing, and more low-level information than I could reasonably process. That is the strength of Wireshark, but it was also the problem for me.<\/p>\n

I wasn’t trying to become a network analyst. I just wanted to understand what was using my internet connection and whether anything deserved a closer look. Wireshark gave me all of the raw data, but turning that data into a simple answer took more effort than I wanted to spend. If you already know how to read packet captures, it is an excellent tool. But if you are looking for an easy, app-friendly way to see what is talking to the internet, you may end up in the same boat I did: impressed by how much Wireshark can show you, but overwhelmed by how much work it takes to make sense of it.<\/p>\n

\t\t\"How-ToQuiz<\/p>\n

\t\t
\n\t\t\t8 Questions \u00b7 Test Your Knowledge
\n\t\t\t\tNetwork monitoring fundamentals
Trivia challenge<\/p>\n

From packet sniffers to SNMP traps \u2014 find out how much you really know about
\n\t\t\t\t\t\tkeeping networks healthy.<\/p>\n


\n\t\t\t\t\t\tProtocolsToolsSecurityConceptsPerformance \n\t\t\t\t\t<\/p>\n

Begin<\/p>\n

\t\t\t <\/p>\n

\t\t
\n\t\t\t <\/p>\n

Which protocol is most commonly used by network monitoring tools to collect device
\n\t\t\t\t\tstatistics like CPU load, bandwidth usage, and interface status?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAICMPBSNMPCSMTPDDHCP \n\t\t\t<\/p>\n

<\/p>\n

Correct! SNMP (Simple Network Management Protocol) is the backbone of
\n\t\t\t\tnetwork monitoring. It allows management systems to poll devices and receive traps \u2014 unsolicited alerts
\n\t\t\t\t\u2014 when something goes wrong.<\/p>\n

<\/p>\n

Not quite. The correct answer is SNMP (Simple Network Management
\n\t\t\t\tProtocol). While ICMP is used for basic ping tests, SNMP is the industry-standard protocol for
\n\t\t\t\tcollecting detailed device metrics and receiving event notifications.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

What does the popular open-source tool Wireshark primarily do?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAMaps network topology automaticallyBMonitors server uptime and sends alertsCCaptures and analyzes network packet data in real timeDScans for open ports across a subnet \n\t\t\t<\/p>\n

<\/p>\n

Correct! Wireshark is a packet analyzer that captures live traffic and
\n\t\t\t\tlets you inspect individual frames in detail. It supports hundreds of protocols and is an essential tool
\n\t\t\t\tfor troubleshooting and security analysis.<\/p>\n

<\/p>\n

Not quite. Wireshark is a packet capture and analysis tool. It lets
\n\t\t\t\tnetwork engineers dissect traffic at the frame level, making it invaluable for diagnosing connectivity
\n\t\t\t\tissues, spotting malicious traffic, and understanding protocol behavior.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

In network monitoring, what does the term ‘baseline’ refer to?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAThe minimum bandwidth guaranteed by an ISPBA snapshot of normal network behavior used as a reference for detecting anomaliesCThe lowest firmware version supported by a managed switchDThe default VLAN assigned to untagged traffic \n\t\t\t<\/p>\n

<\/p>\n

Correct! Establishing a baseline means recording what ‘normal’ looks
\n\t\t\t\tlike \u2014 typical traffic volumes, latency ranges, error rates, and more. When metrics deviate
\n\t\t\t\tsignificantly from the baseline, it signals a potential problem worth investigating.<\/p>\n

<\/p>\n

Not quite. A baseline is a recorded profile of normal network behavior
\n\t\t\t\tover time. Without one, it is very difficult to distinguish a genuine performance problem from ordinary
\n\t\t\t\tfluctuations in traffic patterns.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

Which metric measures the delay between a data packet being sent and its arrival at
\n\t\t\t\t\tthe destination?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAJitterBThroughputCLatencyDPacket loss \n\t\t\t<\/p>\n

<\/p>\n

Correct! Latency is the end-to-end travel time of a packet, typically
\n\t\t\t\tmeasured in milliseconds. High latency is especially problematic for real-time applications like VoIP
\n\t\t\t\tand video conferencing, where delays are immediately noticeable.<\/p>\n

<\/p>\n

Not quite. The answer is latency. Jitter refers to the variation in
\n\t\t\t\tlatency over time, throughput is the actual data transfer rate, and packet loss is the percentage of
\n\t\t\t\tpackets that never reach their destination \u2014 all important but distinct metrics.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

What is the purpose of ICMP in network monitoring?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAEncrypting management traffic between devicesBAssigning IP addresses dynamically to hostsCSending error messages and performing connectivity tests like pingDSynchronizing time across network devices \n\t\t\t<\/p>\n

<\/p>\n

Correct! ICMP (Internet Control Message Protocol) is used for
\n\t\t\t\tdiagnostics and error reporting. The familiar ‘ping’ command relies on ICMP echo requests and replies to
\n\t\t\t\ttest whether a host is reachable and measure round-trip time.<\/p>\n

<\/p>\n

Not quite. ICMP handles error reporting and connectivity testing. Time
\n\t\t\t\tsynchronization is handled by NTP, IP address assignment is done by DHCP, and management traffic
\n\t\t\t\tencryption is typically handled by SSH or TLS \u2014 not ICMP.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

Which type of monitoring focuses specifically on detecting unusual or malicious
\n\t\t\t\t\ttraffic patterns within a network?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tABandwidth monitoringBNetwork traffic analysis (NTA)CConfiguration managementDUptime monitoring \n\t\t\t<\/p>\n

<\/p>\n

Correct! Network traffic analysis examines flows and packet data to
\n\t\t\t\tidentify anomalies that could indicate intrusions, malware, or data exfiltration. Tools in this category
\n\t\t\t\toften use behavioral baselines and machine learning to flag suspicious activity.<\/p>\n

<\/p>\n

Not quite. Network traffic analysis (NTA) is the discipline focused on
\n\t\t\t\tidentifying malicious or abnormal behavior in traffic patterns. Bandwidth monitoring tracks utilization,
\n\t\t\t\tuptime monitoring checks availability, and configuration management audits device settings \u2014 all useful,
\n\t\t\t\tbut not security-focused by nature.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

What does the acronym ‘SNMP trap’ describe in a network monitoring context?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tAA firewall rule that blocks unauthorized SNMP queriesBAn unsolicited alert sent from a monitored device to a management system when an event occursCA scheduled poll sent by a monitoring server to check device healthDA method of encrypting SNMP community strings \n\t\t\t<\/p>\n

<\/p>\n

Correct! Unlike SNMP polling where the manager asks the device for data,
\n\t\t\t\ta trap is pushed by the device itself when a specific condition is met \u2014 such as a link going down or a
\n\t\t\t\ttemperature threshold being exceeded. This enables faster alerting without constant polling.<\/p>\n

<\/p>\n

Not quite. An SNMP trap is a proactive, unsolicited message sent by a
\n\t\t\t\tdevice to notify the monitoring system of an event. This is the opposite of polling, where the
\n\t\t\t\tmonitoring server initiates the data request on a schedule.<\/p>\n

<\/p>\n

Continue<\/p>\n

<\/p>\n

\t\t
\n\t\t\t <\/p>\n

What does ‘NetFlow’ technology allow network administrators to do?<\/p>\n

\t\t\t <\/p>\n


\n\t\t\t\tARemotely reboot network switches and routersBAutomatically assign VLANs based on device typeCCollect and analyze metadata about IP traffic flows passing through a deviceDPush firmware updates to managed network devices \n\t\t\t<\/p>\n

<\/p>\n

Correct! Originally developed by Cisco, NetFlow collects metadata about
\n\t\t\t\ttraffic flows \u2014 including source, destination, port numbers, and byte counts \u2014 without capturing the
\n\t\t\t\tfull packet payload. It gives administrators visibility into who is talking to whom and how much
\n\t\t\t\tbandwidth is being consumed.<\/p>\n

<\/p>\n

Not quite. NetFlow is a traffic flow telemetry protocol that records
\n\t\t\t\tmetadata about IP conversations traversing a router or switch. It is widely used for bandwidth analysis,
\n\t\t\t\tcapacity planning, and detecting unusual traffic patterns without the overhead of full packet capture. \n\t\t\t<\/p>\n

<\/p>\n

See My Score<\/p>\n

<\/p>\n

\t\t
\n\t\t\tChallenge Complete
\n\t\t\t\tYour Score<\/p>\n

\/ 8<\/p>\n

Thanks for playing!<\/p>\n

Try Again \n\t\t\t\t<\/p>\n

\t\t\t <\/p>\n

The other issue was control. Wireshark showed me what was happening, but it didn’t give me a simple way to do anything about it. That’s not a knock against Wireshark. It’s just not what the tool is built for. I wanted more than a window into my network traffic. I wanted something that could help me decide what should be allowed to keep talking to the internet.<\/p>\n

GlassWire made the activity much easier to understand<\/p>\n

A cleaner view still wasn’t the same as simple control<\/p>\n

GlassWire<\/a> was a much better fit for what I was trying to do at first. Instead of throwing me into a wall of packet data, it gave me a visual timeline that made the activity easier to grasp. I could see when my connection got busy, which apps were involved, and how much data they were using. The app-based breakdown was especially helpful because it moved the question from “what are all these packets?” to “which program is actually doing this?”<\/p>\n


\n \"Ping<\/p>\n

<\/a><\/p>\n

Related<\/p>\n

\t\t
\n\t\t\tHow to See All Devices on Your Network With nmap on Linux
\n\t\t<\/a><\/p>\n

It isn’t as intuitive as a user interface, but it is more powerful. <\/p>\n

That was a big improvement over Wireshark, but it still wasn’t quite what I was looking for. GlassWire<\/a> does have blocking abilities, so this isn’t a case where it only shows you traffic and stops there. For me, though, it still felt more like a monitoring tool first. I wanted something where control felt more central. I wanted a tool that made it simple to decide which apps should be allowed to keep talking to the internet and which ones needed a closer look.<\/p>\n

Portmaster didn’t just show connections, it let me control them<\/p>\n

The cool part was getting from “what is this?” to “should I allow it?”<\/p>\n

Portmaster<\/a> was the tool that felt closest to what I was looking for. It still showed me which apps were reaching out to the internet, but the difference was what I could do next. I could look at an individual app, see the destinations it was connecting to, and start making decisions instead of just staring at activity. That app-based approach made the whole process feel more practical. I wasn’t just asking, “what is this connection?” I was asking, “does this app need to be allowed to make it?”<\/p>\n

The per-app rules are what made Portmaster stand out for me<\/a>. Instead of treating network activity as one big stream of traffic, it let me think about it app by app. Not every app needs the same level of access. Portmaster made it easier to block or allow connections based on the app and destination, which is the kind of control I was looking for from the start.<\/p>\n

That said, Portmaster is not necessarily the easiest option for everyone. It asks you to be more involved, and that can be a good or bad thing depending on what you want. Blocking connections randomly is also a great way to break things, especially with apps that rely on background services, authentication, updates, or cloud sync. For me, that tradeoff was worth it because I wanted control, not just visibility. But if all you want is a simple graph of what used data today, GlassWire is probably the easier place to start.<\/p>\n

Portmaster is the one I’m leaving installed<\/p>\n

Wireshark was the most powerful tool I tried, and GlassWire made network activity much easier to understand, but Portmaster was the one that best matched what I was looking for. I didn’t just want to see that apps were using my connection. I wanted a practical way to look at those connections, understand where they were going, and decide what should be allowed. Portmaster is more hands-on than the others, and that won’t be the right fit for everyone, but for me, that extra control is exactly why it\u2019s the network-monitoring<\/a> tool I’m keeping.<\/p>\n","protected":false},"excerpt":{"rendered":"I started looking at network-monitoring tools because my home network has become more crowded than I realized. This…\n","protected":false},"author":2,"featured_media":484699,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[342,111,139,69,145],"class_list":["post-484698","post","type-post","status-publish","format-standard","has-post-thumbnail","category-mobile","tag-mobile","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/484698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=484698"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/484698\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/484699"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=484698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=484698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=484698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}