Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID?
I'm working on Windows 7, but I would like to hear about solution for Linux as well.
Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic through the columns - but it's quite fast.
The blog post Process Attribution In Network Traffic from their developers explains it in detail.
Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor.
And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).
The short version:
- Open an elevated command prompt and run: "netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl" (make sure you have a \temp directory or choose another location).
- Reproduce the issue or do a reboot if you are tracing a slow boot scenario.
- Open an elevated command prompt and run: "netsh trace stop" Your trace will be stored in c:\temp\nettrace-boot.el or where ever you saved it. You can view the trace on another machine using netmon.
An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.
The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular postings before then.