I would like to know if it is possible in WireShark to monitor ONLY the activity coming from a single software.
p.e. if I use CSVpad.exe, how can I monitor all activity from CSVpad?
1
-
If you have that information available within Wireshark you can probably define a filter. If you don't you could create a (virtual) network interface and let only one application use it (highly configuration dependent). If that isn't an option either you don't.– SethOct 29, 2018 at 11:23
Add a comment
|
2 Answers
Find out what port number the application in question is using and apply a port filter to the capture. Two applications cannot use the same port, so it will be unique.
To find which port your application is using, launch a command prompt as Administrator and run netstat -a -b.
You can add a filter under Capture > Capture Filters...
Then go to Capture > Options and apply the filter to your interface
If you need to capture multiple ports, you can do so like this:
-
Thank you Layne, but where do you find the port number of an application? Don't applications use multiple ports (depending on the protocol)?– RemanOct 29, 2018 at 22:40
-
1According to this page: stackoverflow.com/questions/48198/… , you can use
netstat -a -bin CMD to find what port an application is using. Some applications do use multiple ports; I have updated my answer to show how you can filter for multiple ports.– Layne BOct 29, 2018 at 22:50
As far as I'm aware this still isn't possible to do with Wireshark. There is a long-standing enhancement bug request for this feature to be added though in case you want to track it. It's Wireshark Bug 1184.
I believe Microsoft Message Analyzer, the successor to Microsoft Network Monitor, supports this though, although I've never experimented with it myself.
answered Oct 29, 2018 at 21:47
