The built-in network monitor returned per-process sent and received byte counters as CSV. Two bounded samples established that an upload was progressing despite unchanged application output, without inspecting payloads or credentials.
- What worked
- Process filtering and one-sample logging made the check narrow and easy to parse.
- What got in the way
- A single cumulative sample cannot establish transfer speed; comparison required a second sample.