Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a good, free or not free, packet sniffer.

The main feature I am looking for is an ability to watch a chosen process and view / read all of the data it is sending or receving.

Also I want to be able to sniff the connections between local host. (not a must)

I have tried Wireshark, SmartSniff, SocketSniff and they all dont do what I am looking for.

Thanks, Tanner

share|improve this question
You can create filters in Wireshark. – monksy Oct 27 '09 at 5:58
What OS is this for? – TRS-80 Nov 11 '09 at 13:03

Try microsoft network monitor It captures raw packets. Additionally it organize packet captures by processes on the machine.

share|improve this answer

CommView is a great packet sniffer. It's not free but has a lot of features, including filtering packets per processes:

What you can do with CommView

  • View detailed IP connections statistics: IP addresses, ports, sessions, etc.
  • Reconstruct TCP sessions.
  • Map packets to the application that is sending or receiving them.
  • View protocols distribution, bandwidth utilization, and network nodes charts and tables.
  • Generate traffic reports in real time.
  • Browse captured and decoded packets in real time.
  • Search for strings or hex data in captured packet contents.
  • Import and export packets in Sniffer®, EtherPeek™, AiroPeek™, Observer®, NetMon, and Tcpdump formats, export packets in hex and text formats.
  • Configure alarms that can notify you about important events, such as suspicious packets, high bandwidth utilization, unknown addresses, etc.
  • Create your own plug-ins for decoding any protocol.
  • Exchange data with your application over TCP/IP.
  • Export any IP address to SmartWhois for quick, easy IP lookup.
  • Capture loopback traffic (a new, unique feature in version 4.1).
share|improve this answer
Thanks. So far the this was the only product that was able to record the traffic on the local interface. I tried Wireshark and Microsoft Network Monitor tool but none of them worked on the XP machine I was tried to debug. Note: capture and save works with demo version, but the viewer will show you only 50% of the packages :( – sorin Jul 18 '13 at 13:24

This is an interesting requirement.
How about using your favorite capture tool along with netstat to trace the local ports and protocol used by the process over the capture time? you could then filter for them later.


# with the capture running in the backround, loop over the following
netstat -nt --program | grep firefox
# this will give you a close trace of firefox connections

Of course, you will miss those that finish fast between your two netstst calls.

share|improve this answer
A good idea, but with the scanner running it picks up alot of unwanted packets even with filters. I am looking for a program like I discribed to see if a suspicious process is sending data to a server and what it is sending while I run it in a sandbox. – Tanner Collin Oct 27 '09 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.