bandwhich
bandwhich v0.23.1 is a Windows terminal network monitor that shows live bandwidth by process, connection and remote address, useful for investigating sync jobs, updates and VPN interfaces.
What bandwhich provides
bandwhich summarizes current network activity by local process, connection and remote address in a terminal view. It is useful for finding which background synchronization, updater or VPN interface is using bandwidth, but it is not a full packet capture or protocol forensic tool.
Windows capture prerequisites
The Windows build may require Npcap, an administrator terminal and the correct active network interface. VPNs, virtual machines and multiple adapters make interface selection easy to get wrong. Confirm the monitoring policy of the device before collecting network metadata.
Maintenance boundary
v0.23.1 is treated here as a Windows x64 archive and the project is in a slower maintenance phase. Test the binary in the target environment and keep a copy of the version and interface assumptions. Review date: 2026-08-23.
Save to your cloud drive
Open the cloud drive to get the file directly, or save it for convenient access on another device.
Quark Cloud Drive
RecommendedSave bandwhich to this cloud drive
Baidu Netdisk
Save bandwhich to this cloud drive
bandwhich v0.23.1 Windows bandwidth guide
Extract the Windows x64 archive, prepare Npcap and an administrator terminal, identify the active adapter and compare a few controlled network tasks.
Before you start
- Use 64-bit Windows and an account that can install the capture driver and open an administrator terminal.
- Install or verify a compatible Npcap configuration according to the device policy.
- Close unrelated downloads and note the process or network activity being investigated.
Installation steps
- 01
Extract and verify the program
Unzip the archive to a fixed directory, check the executable name and version and avoid running it from a compressed preview window.
- 02
Prepare the capture environment
Confirm Npcap, list physical and virtual adapters and identify the interface currently carrying the test traffic.
- 03
Start from an administrator terminal
Open the terminal with the required permission, pass the selected interface if needed and check that processes and connections appear.
Quick start
- 01
Generate a controlled sample
Start one known download or synchronization task, observe its process and remote endpoint and stop it to confirm the displayed bandwidth falls.
- 02
Compare interfaces
Repeat the test on a VPN or virtual adapter only when needed and record which interface actually carries the traffic.
- 03
Save a short observation
Record time, process, interface and approximate bandwidth without retaining more network data than the investigation requires.
Usage tips
- Administrator access and packet capture permissions should be limited to the troubleshooting session.
- A process-to-bandwidth view does not replace packet analysis or endpoint security logs.
- Remote addresses and process names can be sensitive operational data.
Troubleshooting and uninstall
Why is no traffic visible?
Check administrator access, Npcap, the selected active adapter and whether the test task is really using that interface. VPNs often require a different adapter.
Why does the process association look wrong?
Compare the task timing, adapter and connection list, then repeat with one controlled process. Shared services and short-lived connections can make attribution approximate.
- Save only the required observationsRecord the process, interface and time needed for the issue, then delete temporary output that contains unnecessary endpoints.
- Remove the binary and driver if unusedDelete the extracted archive and remove Npcap only when no other approved tool needs it; follow the system's driver management process.
Frequently asked questions
Why might bandwhich show no traffic after startup?
Check administrator access, Npcap and the active interface. VPNs and virtual adapters often require an explicit interface choice.
Does bandwhich save full packets?
It presents summarized process, connection and remote-address activity rather than acting as a complete packet analysis recorder.
Does the download require an extraction code?
The Quark entry does not require one; the four-character code for the Baidu entry is shown beside its download entry.