A laptop that is doing nothing is still talking. Updates, sync, telemetry, and sometimes things you never agreed to. On one Windows laptop we looked at, a "media network" helper that shipped with the printer software was calling ten advertising servers on its own schedule. Nothing was stolen. It was simply traffic the owner did not know about, from a program he did not know he had.
Here is how to see it yourself, and what to do with what you find.
See it on Windows, with nothing to install
- Press the Windows key, type Resource Monitor, open it, and click the Networktab. "TCP Connections" lists every program with a live connection and the address on the other end.
- For a snapshot with program names, open PowerShell as administrator and run
netstat -b -n. Each block is one program and the addresses it is connected to.
See it on a Mac
- Open Terminal and run
lsof -i -n -P | grep ESTABLISHED. The first column is the program, the last is the address.
Reading what you see
- Addresses are companies. Look the address up. A browser talking to Google or Cloudflare is normal. A printer helper talking to an ad network is not something you need.
- Repeat offenders matter more than one-offs. A program that phones the same place every few minutes, all day, is the one to decide about.
- Ports tell a story.443 is normal web traffic. 135, 445 and 1900 are Windows file sharing and device discovery; they should never be reachable from outside your home or office, which is what the "Public" network setting on Wi-Fi guarantees.
What to do
- Remove what you did not ask for.Printer "media" apps, vendor update helpers you never use, trial software. Uninstall from Settings, Apps. If it cannot be uninstalled, disable its service.
- Keep Wi-Fi on Public. It makes Windows Firewall refuse every unrequested incoming connection.
- Block by company, not by one address. Ad and tracking networks use dozens of addresses. Blocking one does nothing. Decide per company.
- Watch before you block. A week of watching tells you what is normal. Then block with confidence instead of breaking something that mattered.
The continuous version
Resource Monitor shows you a moment. AriesView Security's endpoint view shows the week: every destination each program connected to, grouped by company, with a Trust or Block decision next to each one. It starts in watch-only mode, so nothing changes on the laptop until you say so. The same console shows your servers and your MCP tools, which is the point: one place to see where everything you own actually connects.
All guides
