Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning.

When I start listening/recording packets in Wireshark, there where so many packages being recorded (700 packages per minute). Is it normal to have that much traffic if I have all the programs that will cause traffic such as all browsers, log me in, dropbox, goto meeting, etc., closed?

In order to try to solve the problem I am analyzing random packets. Take for instance this filter:

enter image description here

I just selected a random IP: 74.125.130.99.

So how can I know from what program those packets where created? Also how can I get more info about that communication bwtween my computer (192.168.0.139) and that server (74.125.130.99)?

I just selected a random IP from the Wireshark capture. There are also other IPs that I have no idea why they are communicating with my computer. How can I figure that out?

share|improve this question
1  
If you do a whois on that IP address, it shows that it's owned by Google. –  sblair Sep 1 '12 at 14:50
    
The command netstat -b -a on cmd is very helpful too! –  Tono Nam Sep 1 '12 at 16:54
add comment

1 Answer

up vote 4 down vote accepted

The process id doesn't make it onto the stream that Wireshark is reading.
Netmon is better suited for this task on Windows.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.