That's a good one. I think I'd look at the output of a traffic sniffer. But that won't tell you what process is doing it. I can't think of anything more useful than TdiMon. I don't think it has a UI to show you bandwidth utilization, but it will at least show you which apps are doing network reads and writes. I guess I'd just quiesce everything I knew about and look to see which apps are still going.