I know some softwares can capture the network packets bases process, I only know WSexplorer, Commview. But they all work with some problem in my Windows8 system.
Is there any other application like them?
5
2
If you are happy with the command line interface and wish to do a lot of other network packet investigation there is scapy - it is a python based interface to the same libraries that are used by wireshark that does quite a lot more.
- Free
- Open Source
- Cross Platform
- Can create and dispatch packets in addition to capture and analysis including creating invalid/malformed packets if needed.
An example from the demo:
>>> res,unans = traceroute(["www.microsoft.com","www.cisco.com","www.yahoo.com","www.wanadoo.fr","www.pacsec.com"],dport=[80,443],maxttl=20,retry=-2)
Received 190 packets, got 190 answers, remaining 10 packets
193.252.122.103:443 193.252.122.103:80 198.133.219.25:443 198.133.219.25:80 207.46...
1 192.168.8.1 192.168.8.1 192.168.8.1 192.168.8.1 192.16...
2 82.251.4.254 82.251.4.254 82.251.4.254 82.251.4.254 82.251...
3 213.228.4.254 213.228.4.254 213.228.4.254 213.228.4.254 213.22...
[...]
>>> res.graph() # piped to ImageMagick's display program. Image below.
>>> res.graph(type="ps",target="| lp") # piped to postscript printer
>>> res.graph(target="> /tmp/graph.svg") # saved to file
3D Plot:
>>> res.trace3D()
answered Dec 15 '14 at 6:32
-
thx alot what a beautiful and powerful application itis... but im under windows plantform and i think scapy couldnt support capture basing process or PID:) – MaryOpenS Dec 16 '14 at 5:10
-
AFAIK No network packets include a PID as it is meaningless off the platform and valid only for the duration of the process - instead they have a source and destination port but you can use psutil, github.com/giampaolo/psutil, net_connections, to get a list of open ports and the PIDs using them, then to get the name to match the PID. – Steve Barnes Dec 16 '14 at 6:09
-
sure that there IS NOT a PID infor within any packet because of none of level-3 business with levle-5. i think the only way combining PID and stream is basing system plantform program byself. – MaryOpenS Dec 17 '14 at 7:41
1
You can use Wireshark:
- free and open-source
- works on Windows/Linux/Mac
- can capture all network data:
answered Dec 15 '14 at 3:53
-
but wireshark cannot capture bases process, i have to examine all the ports process using and set a expression in filter so that get almost(maybe not all) packets. disappointing...:( – MaryOpenS Dec 16 '14 at 5:10
