5

I know some softwares can capture the network packets bases process, I only know WSexplorer, Commview. But they all work with some problem in my Windows8 system.

Is there any other application like them?

Improve this question
2

If you are happy with the command line interface and wish to do a lot of other network packet investigation there is scapy - it is a python based interface to the same libraries that are used by wireshark that does quite a lot more.

  • Free
  • Open Source
  • Cross Platform
  • Can create and dispatch packets in addition to capture and analysis including creating invalid/malformed packets if needed.

An example from the demo:

>>> res,unans = traceroute(["www.microsoft.com","www.cisco.com","www.yahoo.com","www.wanadoo.fr","www.pacsec.com"],dport=[80,443],maxttl=20,retry=-2)
Received 190 packets, got 190 answers, remaining 10 packets
   193.252.122.103:443 193.252.122.103:80 198.133.219.25:443 198.133.219.25:80  207.46...
1  192.168.8.1         192.168.8.1        192.168.8.1        192.168.8.1        192.16...
2  82.251.4.254        82.251.4.254       82.251.4.254       82.251.4.254       82.251...
3  213.228.4.254       213.228.4.254      213.228.4.254      213.228.4.254      213.22...
[...]
>>> res.graph()                          # piped to ImageMagick's display program. Image below.
>>> res.graph(type="ps",target="| lp")   # piped to postscript printer
>>> res.graph(target="> /tmp/graph.svg") # saved to file

enter image description here

3D Plot: 

>>> res.trace3D()

enter image description here

Improve this answer
3
  • thx alot what a beautiful and powerful application itis... but im under windows plantform and i think scapy couldnt support capture basing process or PID:) – MaryOpenS Dec 16 '14 at 5:10
  • AFAIK No network packets include a PID as it is meaningless off the platform and valid only for the duration of the process - instead they have a source and destination port but you can use psutil, github.com/giampaolo/psutil, net_connections, to get a list of open ports and the PIDs using them, then to get the name to match the PID. – Steve Barnes Dec 16 '14 at 6:09
  • sure that there IS NOT a PID infor within any packet because of none of level-3 business with levle-5. i think the only way combining PID and stream is basing system plantform program byself. – MaryOpenS Dec 17 '14 at 7:41
1

You can use Wireshark:

  • free and open-source
  • works on Windows/Linux/Mac
  • can capture all network data:

enter image description here

Improve this answer
1
  • but wireshark cannot capture bases process, i have to examine all the ports process using and set a expression in filter so that get almost(maybe not all) packets. disappointing...:( – MaryOpenS Dec 16 '14 at 5:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.