Take the 2-minute tour ×

Is there a way in C# or C/C++ & Win32 to monitor a certain process's network usage (Without that application being built by you obviously)? I would like to monitor just 1 process for like an hour or so, then return the bytes used by only that process, such as limewire for example.

Is it possible? I know netstat -e on windows will tell you total bytes sent/received, but that is for all processes.

edit: If i can't return just one processes usage, how can i get the bytes sent/received by the entire system? as netstat displays except i just want the integers.


netstat -e

                           Received            Sent

Bytes                    2111568926      1133174989
Unicast packets             3016480         2711006
Non-unicast packets            3122            1100
Discards                          0               0
Errors                            0               0
Unknown protocols                 0

I just want to get 2 variables, like rec = 2111568926 and sent = 1133174989

share|improve this question
which one did you go for Mike? –  Greg Jul 8 '10 at 5:52
add comment

4 Answers

It's possible, but if I'm not mistaken you'll have to create a network driver to filter all network traffic and than figure out which process created the traffic.

Microsoft has an free application for it called Microsoft Network Monitor 3.2 (download). According to the release notes it also has an api to use.


Here is a blog post about these API's.

In my opinion you should use this API (or another API such as WinPcap) to filter the traffic instead of writing your own device driver.

share|improve this answer
add comment

You could use WinPcap for this or write your own device driver. I don't think there are any per process perfmon counters you can leverage.

share|improve this answer
add comment

NetLimiter 2 Limiter

Network Traffic Monitor You can get the last freeware version from here

share|improve this answer
-1 This is a programming question. –  bleevo Jan 30 '11 at 1:58
Why are you -1 and leaving a comment on my answer. You should be putting this on the question. –  grom Feb 1 '11 at 4:02
add comment

I asked the same question on MSDN forum and get answer. Frankly speaking have tried it. I.e. tried but not so hard)) It was suggested to use ETW. I did not realize how to consume ETW events properly. http://social.msdn.microsoft.com/Forums/en-US/perfmon/thread/b82da95a-1c18-49ce-9bfa-e3d79ec40907

share|improve this answer
Please edit and give enough information that users don't have to go through the link to get the answer. –  Will Apr 12 '12 at 14:34
add comment

protected by Bill the Lizard Oct 28 '10 at 20:00

