Investigating Historical Network Usage Spikes and Setting Alerts with ControlUp for Desktops

A user reported a network performance issue at one of their offices where a single computer had downloaded and uploaded several gigabytes of data within approximately the last four hours. They sought a way to determine exactly what data was downloaded and where it was uploaded to after the fact.

ControlUp experts clarified that while ControlUp for Desktops can provide detailed network usage volume information retrospectively, it does not store historical data about the specific destination addresses or detailed process-level network activity. The device’s Performance tab includes historical charts such as Network Usage (MB/s) and Hourly Network Usage (MB), which show the volume of data sent and received over time. This helps confirm the timing and magnitude of a network spike but only at the overall device level, not by specific process or destination.

For live, real-time network connection details—including which process is communicating with which remote IP address—the Network tab and TCP Connections Map can be used. This tab shows detailed, process-to-destination connections but does not retain historical data, so it only helps monitor ongoing network activity. Consequently, if the large data transfer activity occurred several hours ago and is no longer ongoing, ControlUp itself cannot provide retrospective insights into the process or endpoints involved.

To investigate historical transfers of this nature, network security and monitoring should be supplemented with firewall logs, proxy logs, or netflow data, which retain detailed connection records over time. This approach is recommended for network administrators with access to those tools.

For prevention and proactive detection, users can configure static threshold alerts in ControlUp to notify them immediately if network usage exceeds a predefined value in the future. This allows administrators to catch high-volume transfers as they happen and investigate using real-time detail from ControlUp. The documentation for setting static threshold alerts can be found here: https://support.controlup.com/docs/devices-static-threshold-alerts.

Additional guidance on real-time network analysis is available at https://support.controlup.com/docs/live-network-analysis.

Read the entire ‘Investigating Historical Network Usage Spikes and Setting Alerts with ControlUp for Desktops’ thread below:

Hi everyone. We have a situation where one of our offices is experiencing very slow network performance.

About four hours ago, one computer appears to have downloaded several gigabytes of data and also uploaded a large amount. Is there anywhere I can look to determine what it was downloading and where it was uploading the data to?

You can use the “Network” tab on a Device and see perhaps?

Network tab is just live data

Ah yeah not sure there’d be much in that way for past data

Hey! Short version — ControlUp for Desktops can tell you _how much_ and _when_, but probably not _what/where_ after the fact, in this scenario.

_Historical (works for 4h ago):_ On the device’s _Performance_ tab, the _Network Usage (MB/s)_ and _Hourly Network Usage (MB)_ charts show volume over time, split _Sent vs Received_ — so you can confirm the spike and whether it was mostly up or down. This is device-level total, not per-process.

_Live only:_ The _Network_ tab (_TCP Connections / Map_) is the one that shows _process → destination IP_ — but it’s real-time and keeps no history, so it only helps if the transfer is _still_ happening. Same for _Active Processes_.

So: use the historical charts to pin the timing/volume, and if it’s still active, hit the Network tab for the destination. For a one-off from 4h ago, I don’t think we can recover the process + where-it-went from ControlUp itself — that’d likely have to come from firewall/proxy/NetFlow logs. Worth a sanity-check with someone who knows the network side better than me, but that’s my read.

More info: support.controlup.com/docs/live-network-analysis

Is there a way to set up real-time alerts so we are notified immediately if this happens again? That might help us catch it in the act and see exactly what they are doing.

You could probably set up a static threshhold alert for the value of the network metric where you would want this to trigger:
support.controlup.com/docs/devices-static-threshold-alerts

Continue reading and comment on the thread ‘Investigating Historical Network Usage Spikes and Setting Alerts with ControlUp for Desktops’.  Not a member? Join Here!