XDA’s write-up on moving one noisy device off the main network echoes a pattern most home labs eventually hit: one gadget is dragging everything else down. A smart TV pushing telemetry, an old camera phoning home to a defunct cloud service, a printer scanning for firmware updates every 15 minutes. Finding the culprit needs a bandwidth monitor that can tell you which device on your LAN is doing what, not just which app on the machine you happen to be on.
We ranked seven desktop apps for detecting bandwidth-hogging devices on a home or small-office network. The list mixes lightweight LAN monitors that anyone can install with the deep packet-capture tools network engineers already know. Every pick works cross-platform or has a first-class Windows build; the two that need dedicated hardware are called out.
What to look for in a bandwidth monitoring app
- LAN-wide visibility, not just this device. A per-app monitor tells you what your PC is doing. A LAN monitor tells you what the smart TV is doing.
- Per-device breakdown by IP or MAC. Aggregate throughput charts hide the answer; you want a per-device row that ranks by bytes.
- Live and historical view. Live catches a burst, historical catches a slow leak. Both matter.
- DNS resolution. A destination shown as an IP is unactionable; a destination shown as a hostname tells you which service the device is talking to.
- Reasonable install path. The best of these run on a spare desktop or laptop; the deepest need mirror-port hardware.
Quick comparison
| App | Best for | Coverage | License | Setup effort |
|---|---|---|---|---|
| Sniffnet | Modern per-device dashboard | This machine + LAN adjacent | GPLv3 (FOSS) | Low |
| GlassWire | Prettiest per-app breakdown | This machine + LAN devices | Freemium | Low |
| NetLimiter | Per-app rate limiting | This machine | Paid ($20) | Low |
| Wireshark | Deep packet capture | This machine + mirror port | GPLv2 (FOSS) | Medium |
| Fing Desktop | LAN discovery and speed | LAN devices | Freemium | Low |
| PRTG Network Monitor | Enterprise sensor grid | LAN via SNMP / NetFlow | Free up to 100 sensors | High |
| ntopng | Flow analysis for the home lab | LAN via NetFlow | GPLv3 (FOSS) | High |
The 7 best apps for detecting bandwidth-hogging devices
1. Sniffnet, the modern per-device dashboard
Sniffnet by Giuliano Bellini is the newer Rust-written network monitor that finally puts a good UI on top of libpcap. Live throughput charts, per-connection details, DNS reverse-lookup for destinations, filtering by protocol, notifications when a threshold trips. Cross-platform Windows, macOS, and Linux binaries.
For a first-timer trying to find which device is saturating a Wi-Fi link, Sniffnet’s per-device view surfaces the answer without having to know what a pcap filter is.
Where it falls short: Sees only traffic passing the machine it runs on, so pair with an ARP-cache scan (Fing or built-in) for a full LAN view. Some ISPs’ consumer routers don’t expose enough info to identify LAN peers uniquely.
Pricing:
- Free: Full functionality, GPLv3
- Paid: No paid tier
Platforms: Windows, macOS, Linux
Download: Sniffnet on GitHub
Bottom line: Install first. The friendliest starting point for finding a bandwidth hog.
2. GlassWire, the polished per-app breakdown
GlassWire is the Windows and Android network monitor that presents traffic as a timeline of apps and destinations. Every process that opens a socket appears in the sidebar with its cumulative bytes and destinations; a click drills into which hostnames it contacted. Firewall integration lets you block a specific process from the same UI.
For a machine you already use daily, GlassWire is the tool that catches the app quietly uploading gigabytes without your noticing.
Where it falls short: Per-machine only (does not monitor other LAN devices without paid Endpoint tier). Free tier limits history to 30 days. Some antivirus products flag the packet-capture driver, requiring an exception.
Pricing:
- Free: 30-day history, single device
- Paid: Basic from around $40 one-time
Platforms: Windows, macOS (limited), Android
Download: GlassWire (official)
Bottom line: The best-looking option, and the pick when you want the answer on the machine you already use.
3. NetLimiter, per-app rate limiting
NetLimiter by Locktime Software goes past monitoring into enforcement. Set a hard upload cap on the Windows Update service, throttle a Steam download to 5 MB/s during work hours, block a specific app from touching the network at all. Rules run per user, per process, per remote host.
For a home office sharing a link with a game-download-heavy household, NetLimiter is the tool that puts a budget on each app rather than fighting for QoS at the router.
Where it falls short: Windows only. Paid app (no free tier past the trial). No LAN-wide view.
Pricing:
- Free: 30-day trial
- Paid: Around $20 one-time (Pro), $30 (Home)
Platforms: Windows
Download: NetLimiter (official)
Bottom line: The pick when you want to cap an app rather than just find it.
4. Wireshark, the deep packet capture reference
Wireshark is the reference network protocol analyzer. Every packet on the wire, decoded to the byte, with display filters that let you narrow to “traffic from 192.168.1.42 to any DNS server on port 53 that failed.” For diagnosing why a specific device misbehaves (rogue DHCP, chatty mDNS, malformed HTTP), nothing else on this list is as precise.
Pair with a switch that supports a mirror port (or with a hub in a monitor-mode Wi-Fi capture) and Wireshark sees every packet on the LAN, not just the machine it runs on.
Where it falls short: Steep learning curve for first-time users. Capture files grow fast on busy networks. Passive capture on modern switched networks needs mirror-port hardware unless you install Wireshark on the router itself (some OpenWrt setups do this).
Pricing:
- Free: Full functionality, GPLv2
- Paid: No paid tier
Platforms: Windows, macOS, Linux
Download: Wireshark (official)
Bottom line: The precision tool. Install when Sniffnet or GlassWire pointed at the device but you need to see exactly what it is saying.
5. Fing Desktop, LAN discovery and speed testing
Fing Desktop by Fing is the desktop counterpart to the well-known Fing mobile app. It scans the LAN, identifies every connected device by MAC address and manufacturer, runs speed tests, and monitors Internet outages. Per-device history is available on the Fingbox paid tier or in the free browser view.
For a first pass on a home network you have never audited, Fing Desktop’s device list is the fastest way to answer “what is even on my Wi-Fi.”
Where it falls short: Historical per-device throughput needs the Fingbox hardware add-on. Some features are gated to Fing Premium. Device identification depends on Fing’s fingerprint database.
Pricing:
- Free: Device discovery, live scan
- Paid: Fing Premium from around $30/year, Fingbox hardware separately
Platforms: Windows, macOS
Download: Fing Desktop (official)
Bottom line: Best LAN discovery tool. Pair with Sniffnet for the throughput layer.
6. PRTG Network Monitor, the enterprise sensor grid
PRTG Network Monitor by Paessler is the home-lab option that also works on real production networks. It ingests SNMP from routers and switches, NetFlow from anything that speaks it, and can probe individual services (HTTP, DNS, ping) as separate sensors. Charts, alerting, and reporting are polished, and the free tier covers 100 sensors, which is plenty for a home LAN.
For anyone whose router supports NetFlow export, PRTG gives you per-device throughput history without needing to install anything on the client machines.
Where it falls short: Windows server or dedicated Linux appliance for the probe. Setup effort is higher than the picks above. Paid tiers get expensive past 500 sensors.
Pricing:
- Free: 100 sensors, forever
- Paid: PRTG 500 from around $2,150 one-time (enterprise tier)
Platforms: Windows (probe), Web (dashboard)
Download: PRTG (official)
Bottom line: The step up from consumer tools if your router speaks NetFlow.
7. ntopng, flow analysis for the home lab
ntopng by ntop is the open-source flow monitor that a lot of home-lab setups build on. Feed it NetFlow, sFlow, or IPFIX from a router (or run it on a mirror port), and it produces per-host, per-application, and per-protocol breakdowns with historical retention. Community edition is free; the Pro tier adds behavioural analytics.
For the OPNsense, pfSense, or MikroTik crowd, ntopng is the natural companion. It also runs as a Docker container for anyone with a spare Raspberry Pi.
Where it falls short: Steeper setup than any of the picks above. Best on a dedicated small box, not the desktop you use daily. Community edition retention is modest.
Pricing:
- Free: Community edition, GPLv3
- Paid: Pro from around $350/year per node
Platforms: Linux, macOS, Windows (via Docker)
Download: ntopng (official)
Bottom line: Best fit for a home lab that already runs an OPNsense or pfSense box.
How to pick the right one
- First-time user: Sniffnet.
- The bandwidth hog is an app on the machine you already use: GlassWire.
- You want to cap an app rather than just find it: NetLimiter.
- You need to see exactly what a device is saying: Wireshark.
- You need a LAN inventory before you can start monitoring: Fing Desktop.
- Your router speaks NetFlow and you want history: PRTG or ntopng.
FAQ
Can any of these see my neighbour’s Wi-Fi traffic?
No. Modern Wi-Fi is encrypted per-station, and even monitor-mode capture only shows the fact that traffic exists, not its contents.
Do I need to install this on a router?
For a full LAN view, either mirror-port hardware, a router that exports NetFlow, or an app installed on the router itself. Otherwise the picks above see only traffic passing through the machine they run on.
Will these detect a device sending data without my consent?
Yes, if the device is on your LAN and the destination is not local. Sniffnet, GlassWire, and Wireshark will all show a mystery device talking to an external host; DNS reverse-lookup gives you the hostname.
Are these safe on a corporate network?
Deep packet capture on a network you do not own is a policy issue, sometimes a legal one. Ask before running Wireshark or ntopng at work. On your own home LAN, all seven picks are fine.
Which is best for a Raspberry Pi home monitor?
ntopng in a Docker container fed by a mirror port. Sniffnet also runs on ARM Linux if you want a lighter option.
