Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to know some way to scan programs networking activities. I mean record outcoming data sent by a program (e.g. program updater or a program itself).

I guess this could be done using Wireshark scanning the computer networking traffic, but I've never used it, and I think there could be some other way.

Accepted solutions for both Windows and/or *nix (like) operating systems.

share|improve this question
    
Are you looking for the local machine or for your whole subnet? One option is to build a linux dhcp server/firewall and have all of your internet traffic to go through your server. This way you can monitor every packet. –  kobaltz Oct 8 '11 at 19:53
    
This is quite a general question. What is your final intent because there are are alot of packets sent out by any single program. Some programs don't even send the packets. It uses a proxy element. –  surfasb Oct 9 '11 at 0:48

2 Answers 2

up vote 0 down vote accepted

An application firewall, such as Palo Alto can be used to examine traffic at the perimeter and has an application signature database to identify the application that issued the connection.

share|improve this answer
    
Agreed but it would depend on the model/series and services (add-ons) purchased for the Palo Alto firewall(s). I know for a fact that the PA-3000 series offer application monitoring, URL filtering and packet capture options. The 3000 series provides a quick option for gathering packet captures (PCAPs). It really comes in handy when you want to analyze traffic flow and truly see what is traversing your network and of course for troubleshooting purposes. –  Dark_Cyber Jul 9 at 14:33

Since you asked for a "solutions for both Windows and/or *nix (like) operating systems".

In a *nix OS you can use a tool called TCPDump (should be natively available). TCPDump is a packet sniffer that allows you to capture traffic that passes through a node. It comes in handy for troubleshooting networking issues. If you decide to use it in a *nix environment, make sure to invoke sudowhen running it (it will help you avoid headaches).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.