This thesis presents a technique to determine whether a user is actively interacting with a device from inside the network. By the observation of user's traffic, network operators can use the detection method to improve traffic management by prioritizing user facing flows. Understanding whether a user is using a device from inside the network requires separating user generated traffic from the one that is automatically generated by a machine in the background. To accomplish this, we apply three filtering methods, looking at request URLs and at the inter events distance and periodicity. Using real world data from eight devices in the UK collected with a tool capable of recording not only network traffic, but also user input, we show how our method separates the traffic generated by the user.