Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The problem is: Using Microsoft Network Monitor 3.4, I can know which process created a TCP connection, but Microsoft Network Monitor cannot report which process sends UDP packets.

I'm a network admin for my corp, and some working PCs used by our staff send out a lot of UDP packets from nowhere so I'd like to find out whether they are from some malicious process. Is there a utility to help me out?

For experiment, I use sock.exe to manually forge UDP packets so that I can verify whether the utility can report the process name. sock.exe is compiled from example code from Richard Steven's TCP/IP Illustrated, with cygwin.

enter image description here


I find the swiss army knife-like Microsoft Process Monitor(v3.01 as of Apr 2012) can do this job, except with some minor bug.

enter image description here

Still waiting to hear about some more dedicated and more handy utility.

share|improve this question
up vote 3 down vote accepted

Well, Microsoft Process Monitor is now the most appropriate free tool for me.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .