This disclosure describes systems, methods, and apparatus for per-application network traffic monitoring by extending socket functionality to include socket wrappers able to identify network traffic volume, applications responsible for the traffic, the network being loaded, and distinguish between internal device traffic and external network traffic. Network traffic shaping can then be carried out by managing an offending application's traffic. A disclosed method includes loading a call intercept library prior to loading any core libraries of an operating system, calling a socket wrapper, calling a socket by way of functions of at least one of the core libraries, and receiving at least one data packet, from a responding application external to the communications device, at the socket. The method may also include trapping a call, to read the at least one data packet; and releasing the call to the socket so the data packet is read by the destination application.