A pretty easy thing to do so it seems but i'm struggling with it. I got some (Windows XP) clients connected via OpenVPN using bridged mode. Now suddenly I started to see higher traffic load from those clients and was wondering what process is generating the traffic.
So i grabbed Process Explorer and NetLimiter to find that openvpn.exe is causing the traffic, directed to the VPN endpoint on port 443. Once I turn OpenVPN off the traffic is gone of course.
The issue is that I'm not sure if OpenVPN.exe is generating the traffic - I doubt it - or any other process and that to Windows it just looks like OpenVPN.exe would generate the traffic because it's the last process that touches the traffic before sending it on the physical interface. I guess the same can be observed when using a software firewall.
Is there any way to find the "real" process that is generating the traffic?