I know some softwares can capture the network packets bases process, I only know WSexplorer, Commview. But they all work with some problem in my Windows8 system.
Is there any other application like them?
If you are happy with the command line interface and wish to do a lot of other network packet investigation there is scapy - it is a python based interface to the same libraries that are used by wireshark that does quite a lot more.
- Free
- Open Source
- Cross Platform
- Can create and dispatch packets in addition to capture and analysis including creating invalid/malformed packets if needed.
An example from the demo:
>>> res,unans = traceroute(["www.microsoft.com","www.cisco.com","www.yahoo.com","www.wanadoo.fr","www.pacsec.com"],dport=[80,443],maxttl=20,retry=-2)
Received 190 packets, got 190 answers, remaining 10 packets
193.252.122.103:443 193.252.122.103:80 198.133.219.25:443 198.133.219.25:80 207.46...
1 192.168.8.1 192.168.8.1 192.168.8.1 192.168.8.1 192.16...
2 82.251.4.254 82.251.4.254 82.251.4.254 82.251.4.254 82.251...
3 213.228.4.254 213.228.4.254 213.228.4.254 213.228.4.254 213.22...
[...]
>>> res.graph() # piped to ImageMagick's display program. Image below.
>>> res.graph(type="ps",target="| lp") # piped to postscript printer
>>> res.graph(target="> /tmp/graph.svg") # saved to file
3D Plot:
>>> res.trace3D()
answered Dec 15 '14 at 6:32
-
thx alot what a beautiful and powerful application itis... but im under windows plantform and i think scapy couldnt support capture basing process or PID:) – MaryOpenS Dec 16 '14 at 5:10
-
AFAIK No network packets include a PID as it is meaningless off the platform and valid only for the duration of the process - instead they have a source and destination port but you can use psutil, github.com/giampaolo/psutil, net_connections, to get a list of open ports and the PIDs using them, then to get the name to match the PID. – Steve Barnes Dec 16 '14 at 6:09
-
sure that there IS NOT a PID infor within any packet because of none of level-3 business with levle-5. i think the only way combining PID and stream is basing system plantform program byself. – MaryOpenS Dec 17 '14 at 7:41
You can use Wireshark:
- free and open-source
- works on Windows/Linux/Mac
- can capture all network data:
answered Dec 15 '14 at 3:53
-
but wireshark cannot capture bases process, i have to examine all the ports process using and set a expression in filter so that get almost(maybe not all) packets. disappointing...:( – MaryOpenS Dec 16 '14 at 5:10
