19

Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID?

I'm working on Windows 7, but I would like to hear about solution for Linux as well.

  • strace, see this answer over on AskUbuntu and no, if you limit your question to be specific to WireShark I think there is no such thing. On Windows you could use the Network Monitor, a sniffer created by MS themselves. Plus there is an experimental build for Windows, see this mailing list entry. – 0xC0000022L Apr 30 '13 at 19:47
  • 1
    Wireshark works on the network interface level, it can't know which process has sent a packet. – Igor Skochinsky Apr 30 '13 at 20:13
  • @IgorSkochinsky: being a KM driver developer I can tell you that at least the information would be available. But then, libpcap doesn't only have a Windows implementation and I think this limitation may be owed to the cross-platform nature of the library. – 0xC0000022L Apr 30 '13 at 20:14
29
+100

Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic through the columns - but it's quite fast.

The blog post Process Attribution In Network Traffic from their developers explains it in detail.

Screenshot, taken from the blog post linked above

  • Ooops, my bad. Thought I had added it. Link It appears I can't add more than two links yet. – TDKPS May 3 '13 at 0:11
  • alright, fixed that for you. Hope it's fine this way. – 0xC0000022L May 3 '13 at 0:16
  • 2nd link is broken – Hayden Thring Feb 5 at 2:20
16

Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor.

And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).

This MSDN blog post explains the entire (simple) process.

enter image description here

The short version:

  1. Open an elevated command prompt and run: "netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl" (make sure you have a \temp directory or choose another location).
  2. Reproduce the issue or do a reboot if you are tracing a slow boot scenario.
  3. Open an elevated command prompt and run: "netsh trace stop" Your trace will be stored in c:\temp\nettrace-boot.el or where ever you saved it. You can view the trace on another machine using netmon.
2

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.

The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular postings before then.

  • The link to the download page for Microsoft Messenger Analyzer no longer exists. Accordingly, here are the manual download links for both the 32-bit and 64-bit versions. 32-bit: download.microsoft.com/download/2/8/3/… 64-bit: download.microsoft.com/download/2/8/3/… Known Issues in v1.4: download.microsoft.com/download/2/8/3/… – dsasmblr Dec 1 '17 at 14:12
  • @dsasmblr Could you be more specific about what link isn't working? The ones I posted are still working. – TGP1994 Dec 1 '17 at 20:39
  • Huh. The first link you have wasn't working initially (it is now, though). Even when I Googled the name of the application and tried clicking on the link from the search results, it took me to a 404 page. MS might've been updating something at that moment. I nabbed the download links from a cached version of the page. – dsasmblr Dec 1 '17 at 22:07
  • I think you might be right about MS updating something; I remember seeing a strange error last night in the download site but when I refreshed it was gone. – TGP1994 Dec 2 '17 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.