Is it possible to sniff TCP traffic for a specific process using Wireshark, even through a plugin to filter TCP traffic based on process ID?

I'm working on Windows 7, but I would like to hear about solution for Linux as well.

  • 1
    strace, see this answer over on AskUbuntu and no, if you limit your question to be specific to WireShark I think there is no such thing. On Windows you could use the Network Monitor, a sniffer created by MS themselves. Plus there is an experimental build for Windows, see this mailing list entry.
    – 0xC0000022L
    Commented Apr 30, 2013 at 19:47
  • 1
    Wireshark works on the network interface level, it can't know which process has sent a packet.
    – Igor Skochinsky
    Commented Apr 30, 2013 at 20:13
  • @IgorSkochinsky: being a KM driver developer I can tell you that at least the information would be available. But then, libpcap doesn't only have a Windows implementation and I think this limitation may be owed to the cross-platform nature of the library.
    – 0xC0000022L
    Commented Apr 30, 2013 at 20:14

6 Answers 6


Process Attribution In Network Traffic (PAINT)/Wireshark from DigitalOperatives might be what you're looking for. It's based on Wireshark 1.6.5, and it works with Windows Vista and above. It has been released to the public in December 2012 for research purposes, and I've been using it since then. Not only does it work - you can filter the traffic through the columns - but it's quite fast.

The blog post Process Attribution In Network Traffic from their developers explains it in detail.

Screenshot, taken from the blog post linked above

  • Ooops, my bad. Thought I had added it. Link It appears I can't add more than two links yet.
    – TDKPS
    Commented May 3, 2013 at 0:11
  • alright, fixed that for you. Hope it's fine this way.
    – 0xC0000022L
    Commented May 3, 2013 at 0:16
  • 2nd link is broken Commented Feb 5, 2019 at 2:20

Well, if you're willing to not use Wireshark, you can do this out of the box with Microsoft Network Monitor.

And the even better news is that on Windows 7 (or Win2008 R2) and newer, you can start/stop captures from the command line without installing anything (you can even do it remotely).

This MSDN blog post explains the entire (simple) process.

enter image description here

The short version:

  1. Open an elevated command prompt and run: "netsh trace start persistent=yes capture=yes tracefile=c:\temp\nettrace-boot.etl" (make sure you have a \temp directory or choose another location).
  2. Reproduce the issue or do a reboot if you are tracing a slow boot scenario.
  3. Open an elevated command prompt and run: "netsh trace stop" Your trace will be stored in c:\temp\nettrace-boot.el or where ever you saved it. You can view the trace on another machine using netmon.

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter to limit filtering to a single process.

Some of the options are:

  • If you know that an application contacts certain IP addresses or ports, you could specify a capture filter such as udp port 53 or host example.com.
  • Run a program in a virtual machine (VM) and capture traffic from within the VM, or from the bridge attached to the outside of the VM.
  • On Linux, create an isolated network namespace and use a virtual Ethernet (veth) pair to connect the new network namespace with the main network namespace. Capture from either end of the veth interface and start your process within the network namespace.

For the latter approach, I wrote some scripts to automate it, it can be found at https://github.com/Lekensteyn/netns. It was precisely designed for this purpose, create a network capture from a single process (and its children) without leaking other traffic.

Various other approaches such as using eBPF and custom dissectors to add process information, as well as potential approaches for Windows and macOS can be found in these issues on the Wireshark issue tracker:


An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.

The latest build of Version 1.4 as of this post is published October 28, 2016, and the Message Analyzer TechNet Blog has gone mysteriously radio silent as of ~September 2016 after regular postings before then.

Update: The Message Analyzer was retired late 2019.

  • The link to the download page for Microsoft Messenger Analyzer no longer exists. Accordingly, here are the manual download links for both the 32-bit and 64-bit versions. 32-bit: download.microsoft.com/download/2/8/3/… 64-bit: download.microsoft.com/download/2/8/3/… Known Issues in v1.4: download.microsoft.com/download/2/8/3/…
    – dsasmblr
    Commented Dec 1, 2017 at 14:12
  • @dsasmblr Could you be more specific about what link isn't working? The ones I posted are still working.
    – gcode
    Commented Dec 1, 2017 at 20:39
  • Huh. The first link you have wasn't working initially (it is now, though). Even when I Googled the name of the application and tried clicking on the link from the search results, it took me to a 404 page. MS might've been updating something at that moment. I nabbed the download links from a cached version of the page.
    – dsasmblr
    Commented Dec 1, 2017 at 22:07
  • 1
    > Microsoft Message Analyzer (MMA) is being retired and its download packages removed from microsoft.com sites on November 25 2019. Sad...
    – toster-cx
    Commented Feb 20, 2021 at 16:44
  • 1
    @toster-cx Updated my answer, thank you for mentioning it. Sorry about that :(
    – gcode
    Commented Feb 20, 2021 at 20:15

On Mac

sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}'  |unbuffer -p grep -owE "[0-9]{1,5}" |xargs  -I {} sh -c  'G=$(echo {}|tr -d "\r"); sudo lsof -i TCP -OPn -o | grep $G'

Change lsof -i TCP -OPn -o with netstat -aptun for linux


The best option for Windows that I have found in 2023 is using WinShark, which is not that well known:


It uses ETW to capture PID related to each packet, you just have to use something like winshark.header.ProcessId == 1234.

enter image description here

Installing it is also very straightforward which is explained in their github.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.