How to see which programs connect to the internet on Windows and Linux

Find out which apps on your computer are talking to the network, where they connect, and what deserves a closer look.

Every computer has dozens of programs that connect to the network: browsers, updaters, chat apps, sync tools and background services. Knowing which ones talk, and to whom, is the first step to spotting something that should not be there.

Windows: built-in tools

• Resource Monitor (resmon) → Network tab lists processes with network activity and their remote addresses.
• Command line: netstat -b -n in an administrator terminal shows each connection and the program that owns it.
• PowerShell: Get-NetTCPConnection | Select LocalPort,RemoteAddress,State,OwningProcess, then match the process ID in Task Manager.

Linux: built-in tools

• ss -tunap lists TCP and UDP sockets with the owning process (run with sudo to see every process).
• lsof -i shows open network files per program.
• nethogs shows live bandwidth per process, if installed.

What to look for

1. Programs you do not recognise. Check the file path: software in temporary or download folders is more suspicious than in Program Files or /usr.
2. Unexpected destinations. A text editor connecting to an unfamiliar country, or a program that keeps connecting while you are not using it.
3. Listening ports. Programs waiting for incoming connections widen your attack surface. Close the ones you do not need.
4. Bursts of upload traffic from programs that should not send much data.

Most connections are harmless — updates, telemetry and sync — so look for patterns rather than single events, and look up unknown programs before deleting anything.

Keep a history, not just a snapshot

The built-in tools show what is connected right now. Suspicious software often connects briefly or at night. A monitor that records connections over time and remembers which programs it has seen before makes new behaviour stand out.

Trying it

Andromeda Sentinel does this continuously on Windows and Linux: it records which programs connect where, highlights new and unusual behaviour with risk indicators, and can explain a connection in plain language with an optional local AI model. Monitoring is free.