Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The problem is: Using Microsoft Network Monitor 3.4, I can know which process created a TCP connection, but Microsoft Network Monitor cannot report which process sends UDP packets.

I'm a network admin for my corp, and some working PCs used by our staff send out a lot of UDP packets from nowhere so I'd like to find out whether they are from some malicious process. Is there a utility to help me out?

For experiment, I use sock.exe to manually forge UDP packets so that I can verify whether the utility can report the process name. sock.exe is compiled from example code from Richard Steven's TCP/IP Illustrated, with cygwin.

enter image description here

EDIT:

I find the swiss army knife-like Microsoft Process Monitor(v3.01 as of Apr 2012) can do this job, except with some minor bug.

enter image description here

Still waiting to hear about some more dedicated and more handy utility.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Well, Microsoft Process Monitor is now the most appropriate free tool for me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.