up vote 0 down vote favorite
share [g+] share [fb]

I'm looking for a program that can trace what a specific program on my computer is sending/receiving over my Ethernet connection. I'm not trying to crack a password or anything.

Thanks

link|improve this question
feedback

2 Answers

up vote 1 down vote accepted

In answer to your update...

Wireshark wont let you filter by process, but depending on what kind of packets the process sends out, you could get creative and filter by port or some other pattern in the packets (assuming any exists). Otherwise, if youre running windows, netmon apparently lets you filter by process, but Ive never used netmon before and Im just repeating what Ive read somewhere else.

link|improve this answer
You are right, netmon does.. I think that's the best answer. I just tried it. microsoft.com/downloads/en/… Here is a pic of the screen img203.imageshack.us/img203/5361/msnetmon.jpg see left hand side of the window you can choose programs and it just displays the packets for that program.. netmon has nothing under filters for program, presumably because it's not data in a packet, but it still has the option to just show for each program or process rather. – barlop Feb 9 '11 at 14:30
Thanks barlop & alexl, filtering by port was a great idea and worked perfectly. – Gootik Feb 9 '11 at 17:32
feedback
up vote 1 down vote

The type of program you speak of is called a packet sniffer. Wireshark(formerly known as Ethereal) is free and will do it.

link|improve this answer
Also, use netstat with the -o switch to display process ID. netstat can list connections and what process is making them. Ethereal can show you all that is in all the packets. You can use netstat or quicker, perhaps quicker, task manager or tasklist to see what process has what process id. – barlop Feb 9 '11 at 7:24
Yea I've used Ethereal, but it gives me the packets for all the connections over TCP, I just want to see packets for a single program. Unless there is a way with Ethereal that I'm not aware of. – Gootik Feb 9 '11 at 7:25
@Gootik I'm suggesting using netstat with -o to see what process uses what connection, then view the connection in detail with wireshark. There are some alternatives to netstat with -o.. A tiny free program called Active Ports is very good.. So Active Ports + Wireshark. Wireshark tells you everything. So you filter things in wireshark. Of course Active Ports would tell you IP and Port, per program, that is what you need to know to know what to filter in Wireshark. – barlop Feb 9 '11 at 14:08
Thanks again barlop, filtering was what I was missing. – Gootik Feb 9 '11 at 17:33
@Gootik yes the filtering by port in your case.. but I wouldn't use the word filtering for "filtering" by program. ethereal and netmon reserve the word for what is in the packet. – barlop Feb 10 '11 at 2:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.