2

The problem is: Using Microsoft Network Monitor 3.4, I can know which process created a TCP connection, but Microsoft Network Monitor cannot report which process sends UDP packets.

I'm a network admin for my corp, and some working PCs used by our staff send out a lot of UDP packets from nowhere so I'd like to find out whether they are from some malicious process. Is there a utility to help me out?

For experiment, I use sock.exe to manually forge UDP packets so that I can verify whether the utility can report the process name. sock.exe is compiled from example code from Richard Steven's TCP/IP Illustrated, with cygwin.

enter image description here

EDIT:

I find the swiss army knife-like Microsoft Process Monitor(v3.01 as of Apr 2012) can do this job, except with some minor bug.

enter image description here

Still waiting to hear about some more dedicated and more handy utility.

Improve this question

1 Answer 1

Reset to default
3

Well, Microsoft Process Monitor is now the most appropriate free tool for me.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .