How to Monitor Network Traffic on Windows Server: Built-In Tools, Pktmon and Monitoring Platforms

Older guides tell you to install Microsoft Network Monitor on Windows Server 2008. That advice is outdated. Mainstream and extended support for Windows Server 2008 ended on January 14, 2020, so production servers should run a supported release, and modern capture uses tools included in current Windows builds.

Traffic data answers four questions: how much bandwidth is used, which processes and remote hosts use it, whether packets are dropped or retransmitted, and whether the pattern is normal. Standards help here. IETF RFC 7011 (IPFIX) defines the flow export protocol, and RFC 3954 documents NetFlow version 9, the format many switches and routers still export.

This guide is for Windows Server administrators in small and mid-sized IT teams. It pairs well with our guides to Windows monitoring software and packet sniffing tools, and with the Network Monitoring Software category.

Step 1: Measure Bandwidth With Performance Monitor

Performance Monitor reads the Network Interface counters, which report bytes sent and received per adapter. Start here because it is low impact, works on every supported Windows Server release and gives you a baseline before you dig into packets.

1. Open Performance Monitor (perfmon) and add the Network Interface counters Bytes Total/sec and Current Bandwidth for your adapter.
2. For a quick command-line sample, run typeperf "\Network Interface(*)\Bytes Total/sec" -sc 10 to print ten readings.
3. Save a Data Collector Set to log the counters during business hours so you can compare peaks with normal days.

Convert the readings into a utilization figure so alerts can use a percentage rather than raw bytes.

Multiply bytes by 8 to get bits, then divide by the link speed. A 1 Gbps adapter moving 50 MB per second is using about 40 percent of the link.

Step 2: Find Which Processes Use the Network

Resource Monitor and netstat link traffic to processes and remote addresses. Use them when bandwidth looks high and you need to know which application or connection is responsible before you capture any packets.

• Open Resource Monitor (resmon) and review the Network tab for processes with network activity, TCP connections and listening ports.
• Run netstat -ano to list connections with owning process IDs, then match the ID in Task Manager.
• Run netstat -e for adapter-level byte, packet and error counts.

Unexpected outbound connections from a server deserve a closer look. Compare them with your expected services and, if needed, follow your incident response process.

Step 3: Capture Packets With Pktmon

Packet Monitor (pktmon) is included with Windows and captures packets, counts them and reports drops with reasons at several points in the networking stack. Use it when counters say something is wrong and you need packet evidence.

1. Open an elevated Command Prompt and add a filter for the traffic you care about, for example pktmon filter add -p 443.
2. Start the capture with pktmon start --capture, reproduce the issue, then run pktmon stop.
3. Review totals with pktmon counters or convert the log with pktmon etl2pcap PktMon.etl and open it in Wireshark.

Microsoft documents that pktmon is included in-box from Windows build 19041 onward and can write pcapng-compatible output. Check Microsoft's Packet Monitor documentation for syntax on your build. Always filter captures: unfiltered captures on a busy server grow fast and can include sensitive data.

Step 4: Add Continuous Monitoring With a Platform

Built-in tools show the moment you run them. A monitoring platform records traffic continuously, alerts on thresholds and keeps history for capacity planning. For a Windows server fleet, this is how you notice a saturated link before users report slowness.

Platforms collect data through SNMP, WMI, agents and flow exports. When choosing, confirm each supports the data sources you use. These products from the directory cover network and server monitoring:

• PRTG Network Monitor (freemium pricing model)
• SolarWinds Network Performance Monitor (paid pricing model)
• ManageEngine OpManager (freemium pricing model)
• Progress WhatsUp Gold (freemium pricing model)
• Nagios XI (paid pricing model)
• Zabbix (free pricing model)
• Datadog Network Monitoring (freemium pricing model)
• Auvik (paid pricing model)
• LogicMonitor (paid pricing model)

Pick one that matches your scale and budget, then keep the free built-in tools for deep dives. Pricing models vary, and SaaSPodium lists some of these as free or freemium, so confirm current limits on each vendor site as of November 2026.

Step 5: Interpret the Results and Set Alerts

Raw numbers only help when compared with a baseline. Record normal utilization for each server across a week, then alert on sustained deviation rather than brief spikes, which cause alert fatigue.

• High utilization with no growth in users: look for backups, replication or a runaway process.
• Rising errors or drops: check cables, duplex settings, drivers and offload settings.
• Retransmissions on one path: investigate the switch port or remote link.
• Unknown destinations: verify against expected services and escalate if unexplained.

Security and Privacy Considerations

Packet captures can contain credentials and personal data. Limit who can run captures, filter to the minimum scope, store files securely and delete them when the investigation ends. Treat capture files as sensitive records under your data-protection policy.

Frequently Asked Questions

What is the best free way to monitor network traffic on Windows Server?
Use Performance Monitor for bandwidth, Resource Monitor and netstat for per-process connections, and pktmon for packet capture. All are included with current Windows Server releases and cost nothing beyond admin time.

Is Microsoft Network Monitor still the right tool?
No. Network Monitor is a legacy tool, and Windows Server 2008 left extended support on January 14, 2020. Current Windows builds include pktmon, which can output pcapng files for Wireshark.

When should we move from built-in tools to a monitoring platform?
Move when you manage more than a few servers, need alerts and history, or must prove capacity trends. Start with a free or freemium platform from the Network Monitoring category and compare trial results on your own traffic.