Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning.

When I start listening/recording packets in Wireshark, there where so many packages being recorded (700 packages per minute). Is it normal to have that much traffic if I have all the programs that will cause traffic such as all browsers, log me in, dropbox, goto meeting, etc., closed?

In order to try to solve the problem I am analyzing random packets. Take for instance this filter:

enter image description here

I just selected a random IP: 74.125.130.99.

So how can I know from what program those packets where created? Also how can I get more info about that communication bwtween my computer (192.168.0.139) and that server (74.125.130.99)?

I just selected a random IP from the Wireshark capture. There are also other IPs that I have no idea why they are communicating with my computer. How can I figure that out?

share|improve this question
1  
If you do a whois on that IP address, it shows that it's owned by Google. – sblair Sep 1 '12 at 14:50
    
The command netstat -b -a on cmd is very helpful too! – Tono Nam Sep 1 '12 at 16:54
up vote 6 down vote accepted

The process id doesn't make it onto the stream that Wireshark is reading.
Netmon is better suited for this task on Windows.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .