The problem is: Using Microsoft Network Monitor 3.4, I can know which process created a TCP connection, but Microsoft Network Monitor cannot report which process sends UDP packets.
I'm a network admin for my corp, and some working PCs used by our staff send out a lot of UDP packets from nowhere so I'd like to find out whether they are from some malicious process. Is there a utility to help me out?
For experiment, I use sock.exe to manually forge UDP packets so that I can verify whether the utility can report the process name. sock.exe is compiled from example code from Richard Steven's TCP/IP Illustrated, with cygwin.
I find the swiss army knife-like Microsoft Process Monitor(v3.01 as of Apr 2012) can do this job, except with some minor bug.
Still waiting to hear about some more dedicated and more handy utility.