VMware ESXi and vSphere Cluster Management

Using the Disk and Network Tab in Process Explorer

Learn how to use Process Explorer's Disk and Network tab to interpret per-process disk and TCP activity, totals, deltas, and troubleshooting patterns.

The Disk and Network tab in Process Explorer shows storage and network input/output (I/O) activity for one selected Windows process. It is useful when you need to determine which application is reading or writing data, transferring network traffic, or repeatedly opening and closing TCP connections.

The measurements belong only to the process whose Process Properties window is open. They are not system-wide totals, and they do not automatically identify every file or remote endpoint involved.

What the Disk and Network tab shows

Process Explorer is a Windows process-inspection utility. Its Process Properties window contains detailed information about a selected process. When available, the Disk and Network tab reports two groups of counters:

  • Network I/O: TCP connection and data-transfer operations performed by the selected process.
  • Disk I/O: File and other storage-related I/O requested by the selected process.

Typical uses include identifying a disk-heavy process, finding an active network client, and distinguishing activity happening now from work accumulated earlier in a process's lifetime.

Open Process Properties

  1. Select a process in the main Process Explorer process list.
  2. Open that process's Properties window.
  3. Choose the Disk and Network tab when it is available.
  4. Watch the values across successive display refreshes rather than relying on one observation.

Process Explorer updates the displayed values when it refreshes its display. The time represented by a delta therefore depends on the refresh interval and on when the process performed its work.

Administrative privileges are required

The Disk and Network tab is available only when Process Explorer is running with administrative privileges. These are elevated Windows permissions that allow the utility to expose this information.

If Process Explorer is running as an ordinary user, the tab may be missing from Process Properties for every process. This does not necessarily mean that the selected process has no disk or network activity.

  1. Close Process Explorer.
  2. Launch it using Run as administrator.
  3. Approve the User Account Control prompt when appropriate. Organizational credentials or authorization may be required.
  4. Reopen the selected process's Properties window and check for the tab.

Network I/O statistics

TCP is a connection-oriented network protocol. The Network I/O section counts TCP operations performed by the selected process. It normally includes connect, send, receive, and disconnect categories.

Each category can include an operation count, which is the number of operations, and an associated byte count where applicable, which describes the volume of transferred data.

  • Connect: A TCP connection-establishment operation initiated by the process.
  • Send: An operation in which the process transmits data.
  • Receive: An operation in which the process obtains data from the network.
  • Disconnect: A TCP connection-ending operation.

Connect and disconnect counts help reveal connection churn. Frequent increases can indicate repeated short-lived sessions, polling, or retry behavior. Send and receive counters show the direction and volume of data transfer. For example, a large receive-byte delta is consistent with downloading or data ingestion, while a large send-byte delta can indicate uploading, synchronization, telemetry, or requests producing server responses.

Disk I/O statistics

Disk counters describe file and other storage-related I/O requested by the selected process. They include operation counts and transferred byte totals for reads, writes, and other operations.

  • Reads: Operations that obtain data from storage.
  • Writes: Operations that send data for storage.
  • Other: Storage-related I/O outside the standard read and write categories.

High read deltas may occur while an application loads files, scans data, indexes content, fills a cache, or processes input. High write deltas may occur while it creates logs, downloads files, performs database work, creates temporary files, generates exports, or produces other output.

Counter categories at a glance

Network I/O — TCP Connect: Number of TCP connection-establishment operations. A high delta can indicate new sessions, polling, or retries.

Network I/O — TCP Send: Send operations and associated transmitted bytes. A high delta can indicate uploads, synchronization, telemetry, or request traffic.

Network I/O — TCP Receive: Receive operations and associated received bytes. A high delta can indicate downloads, streaming, or data ingestion.

Network I/O — TCP Disconnect: Number of TCP connection-ending operations. A high delta can indicate short-lived connections or repeated retries.

Disk I/O — Reads: Read operations and bytes obtained. A high delta can indicate loading, scanning, indexing, caching, or data processing.

Disk I/O — Writes: Write operations and bytes sent for storage. A high delta can indicate logging, downloads, database work, temporary files, or output generation.

Disk I/O — Other: Storage-related operations outside ordinary reads and writes. A high delta requires correlation with the process workload and other diagnostic views.

Totals versus delta counters

A total is a cumulative counter measured from process start until the current observation. A delta is the amount by which that counter changed between the current refresh and the immediately preceding refresh.

Total since process start: Represents the process's accumulated activity. It is best for assessing long-running behavior, but a large value can be mistaken for current activity.

Delta since previous refresh: Represents activity during the latest observation period. It is best for identifying what is happening now, but a brief spike or a long refresh interval can make it appear unusually large.

Deltas are especially useful for finding active work. If receive bytes increase substantially on several consecutive refreshes, the process is currently receiving data. If a long-running service has a large lifetime read total but nearly zero read delta across several refreshes, it performed substantial work in the past but may be idle now.

The refresh interval is the time between Process Explorer updates. A longer interval can include more activity and produce a larger delta; a shorter interval can produce smaller values or make bursty work appear as isolated spikes. Compare multiple refresh cycles under similar conditions.

Interpreting common activity patterns

Active download or data ingestion

  1. Open the Properties window for a browser, updater, or download client.
  2. Observe the network receive-byte delta over several refreshes.
  3. Look for a sustained increase rather than a single brief change.
  4. Correlate the result with the process name, command line, current workload, and other properties.

Sustained receive deltas indicate that the process is currently taking in network data.

Local output, logging, or export work

  1. Inspect the process while it is expected to create logs, exports, backups, or temporary data.
  2. Compare disk write-byte and write-operation deltas across several refreshes.
  3. Check whether the write activity stops when the workload completes.

Sustained write deltas indicate ongoing storage output requested by that process.

Repeated connection attempts

  1. Watch TCP connect and disconnect deltas over multiple refreshes.
  2. Look for frequent increases without a proportional amount of sent or received data.
  3. Correlate the pattern with application logs, configuration, or endpoint information available elsewhere.

Rapid connection turnover can suggest retries, polling, or many short-lived sessions. The counters alone do not establish why the connections occur.

Past activity versus current activity

A long-running service may have a very large cumulative disk-read total. If its read delta is near zero across several refreshes, the lifetime total reflects earlier activity rather than a current disk workload.

Limits and careful interpretation

  • Compare counters across refreshes instead of interpreting one value in isolation.
  • Correlate I/O with the process name, command line, parent process, CPU use, and other Process Explorer views.
  • A high lifetime total does not prove that the process is active now.
  • Low disk activity does not rule out memory-cached work; an application may be serving data from memory rather than requesting storage reads.
  • Low network activity does not rule out an idle but still-connected application.
  • Disk I/O bytes are not automatically a direct measurement of physical disk hardware activity. Caching, buffering, storage layers, and other processes require supporting evidence.
  • Network counters reveal activity level and direction, but they do not by themselves identify a remote endpoint.
  • Disk counters summarize requested activity, but they do not by themselves identify a complete file-by-file path.
  • High counters do not by themselves prove malicious behavior. Investigate context, workload, executable identity, command line, parent process, and endpoint or file evidence.

Troubleshooting

The Disk and Network tab is missing

The most likely cause is that Process Explorer is not running with administrative privileges. Close it, relaunch it with elevation, approve the User Account Control prompt when appropriate, and reopen Process Properties.

Totals are large but the process appears inactive

The totals may have accumulated earlier in the process lifetime. Watch the delta counters over several refreshes to determine whether activity is occurring now.

Delta values vary widely

The workload may be bursty, or the refresh period may represent different amounts of time. Compare several refresh intervals under similar conditions and correlate spikes with a user action, scheduled task, or application event.

Disk activity is visible but the files are unknown

The tab summarizes disk activity and does not provide a complete file-by-file explanation. Use complementary process, handle, file, or storage-monitoring views to identify the files involved.

Network activity is visible but the destination is unknown

The tab provides aggregate TCP operation and byte statistics rather than endpoint-level attribution. Use a network connection view or packet and network diagnostic tool to correlate the process with remote addresses and ports.

Exam-relevant notes

  • The tab is inside the selected process's Process Properties window.
  • It applies to one process, not the entire system.
  • Administrative privileges are required for the tab to be available.
  • Network categories are TCP connect, send, receive, and disconnect.
  • Disk categories are reads, writes, and other.
  • Totals accumulate from process start; deltas measure change since the previous refresh.
  • Deltas are generally better for identifying current activity, while totals describe lifetime behavior.
  • Interpret counters with refresh timing and corroborating process, file, endpoint, and workload information.

For a focused reference, see Disk and Network Tab.