Sniffing TCP traffic for specific process using Wireshark

Question

Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID?

I'm working on Windows 7, but I would like to hear about solution for Linux as well.

Answer 1

Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic through the columns - but it's quite fast.

The blog post Process Attribution In Network Traffic from their developers explains it in detail.

Answer 2

Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor.

And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).

This MSDN blog post explains the entire (simple) process.

The short version:

1. Open an elevated command prompt and run: "netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl" (make sure you have a \temp directory or choose another location).
2. Reproduce the issue or do a reboot if you are tracing a slow boot scenario.
3. Open an elevated command prompt and run: "netsh trace stop" Your trace will be stored in c:\temp\nettrace-boot.el or where ever you saved it. You can view the trace on another machine using netmon.

Answer 3

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process.

Some of the options are:

• If you know that an application contacts certain IP addresses or ports, you could specify a capture filter such as udp port 53 or host example.com.
• Run a program in a virtual machine (VM) and capture traffic from within the VM, or from the bridge attached to the outside of the VM.
• On Linux, create an isolated network namespace and use a virtual Ethernet (veth) pair to connect the new network namespace with the main network namespace. Capture from either end of the veth interface and start your process within the network namespace.

For the latter approach, I wrote some scripts to automate it, it can be found at https://github.com/Lekensteyn/netns. It was precisely designed for this purpose, create a network capture from a single process (and its children) without leaking other traffic.

Various other approaches such as using eBPF and custom dissectors to add process information, as well as potential approaches for Windows and macOS can be found in these issues on the Wireshark issue tracker:

• Bug 16194 - Allow us to filter traffic by sending or receiving process
• Bug 1184 - *Shark should support associating TCP and UDP packets with processes

Answer 4

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.

The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular postings before then.

Update: The Message Analyzer was retired late 2019.

Answer 5

On Mac

sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}'  |unbuffer -p grep -owE "[0-9]{1,5}" |xargs  -I {} sh -c  'G=$(echo {}|tr -d "\r"); sudo lsof -i TCP -OPn -o | grep $G'

Change lsof -i TCP -OPn -o with netstat -aptun for linux

Answer 6

The best option for Windows that I have found in 2023 is using WinShark, which is not that well known:

https://github.com/airbus-cert/Winshark

It uses ETW to capture PID related to each packet, you just have to use something like winshark.header.ProcessId == 1234.

Installing it is also very straightforward which is explained in their github.