How to Track Internet Traffic on a Computer and a Server

Unlimited home plans taught you not to think about gigabytes, but head out of town with a mobile modem, rent a server with paid traffic or buy proxies billed by volume, and you need a counter again. There are usually two questions: how much goes in total and what exactly eats it. Tools to answer both are built in almost everywhere, people just do not look for them.

Computer: built-in counters

Windows counts by itself: network settings show monthly usage per app and per adapter, and you can set a limit there, past which the system warns you and holds back background updates. For a live view, use Task Manager: the network column shows who is downloading right now. On macOS, Activity Monitor's Network tab gives an instant picture, and accumulated per-app usage is easier to see with third-party apps from the App Store. On a Linux desktop, nethogs gives a quick answer: traffic per process in real time.

Smartphones

Android and iOS keep counters in cellular settings: usage per app, limits and warnings, data saving with one switch. The main trick is to set the cycle start date to match your plan, or the numbers will not match your carrier's. The second useful switch blocks background refresh for hungry apps, video and cloud galleries, since they eat your cap unnoticed.

A laptop on the road tethered to a phone is a separate story. Windows and macOS can mark a network as metered, and the system then holds back updates and cloud sync. Mark your phone's hotspot as metered on all your devices once, and the classic "laptop ate the whole bundle in one evening" ends for good.

Router: accounting for the whole network

When one line serves a home or office, it is easier to count at the entry point. Firmware on mid-range and better home routers keeps per-device statistics: who downloaded how much per day and month. On Keenetic, MikroTik and OpenWrt routers the picture is more detailed: per-client graphs, limits, exports. This is the only honest way to see the TV, cameras and guest devices that no Task Manager will ever show.

Server: vnstat and NetFlow

On a VPS with paid traffic, vnstat goes on first: a light counter that records usage per interface and answers "how much went out this month" with one command. To find out "who exactly", add iftop or nethogs. Larger infrastructure needs an event stream: NetFlow or IPFIX from equipment to a collector, where traffic is visible by address, port and time. It is the same mechanism behind carrier billing, in miniature.

Why the numbers do not match

Counters at different points never show the same figure, and that is normal. A phone counts only the cellular interface, and Wi-Fi bypasses its limit. A router sees local traffic between devices that the ISP never sees. The system measures useful bytes, the carrier counts them along with service headers, and with small packets the gap grows to noticeable percentages. Add retransmissions on a poor link and background updates while you are not looking, and a ten percent mismatch stops being surprising.

• Compare counters over the same period and on the same interface.
• Treat the side that sends the bill as the reference: the carrier, the host, the service dashboard.
• Investigate daily spikes instead of percentage gaps: they point to a hungry newcomer on the network.

Traffic for proxy tasks

A separate case is traffic going through proxies billed per gigabyte. Counting it on your side is useful for control, but the primary source is always the dashboard statistics, because charges follow them. Two tips from practice. First: when scraping, turn off images and video in your software, and pages weigh several times less with the same data. Second: if your volumes are steadily large, compare billing formats, because traffic is not counted at all on packages, and a counter there only serves your peace of mind.

For server tasks, add an alert: a threshold in vnstat or a simple scheduled check that notifies you of abnormal daily usage. Nine out of ten nasty traffic bills began with a quiet week when something looped on the server or a stranger found an open service.

Whatever level you choose, one rule applies: the counter has to be in place before the questions begin. Installed afterwards, it shows only the new normal, and where the earlier gigabytes went stays a mystery. Five minutes spent turning on a built-in counter today saves you log archaeology a month from now.