Data traffic for hotfix downloads not seen in monitors

[JS]

I use XP Pro and would like to be able to see the net traffic
generated when XP downloads hotfixes.

I have got my XP set up to notify me of new updates. But when I
click "Download" I have no way of teling if the download procedure
has ended.

XP's Task Manager may be able help but I am not clear what to look
process name to look for nor what process activity to set.
Setting up Perfmon seems too involved to track only one category
of download.

I tend to use a few third-party download monitors:

(1) NetLimiter from http://www.netlimiter.com/
(2) TaskInfo from http://www.iarsn.com/

From what they show me, it seems that the traffic from the
Microsoft download is executed in a such away that it does not
show up in these utilities.

QUESTION: What is so unusual about the hotfix data that allows it
to avoid being seen by these sorts of utilites?

QUESTION: How can I easily see the hotfix traffic?

 

[Guest]

Use ethereal and set the filter to 'tcp and port 80'.