Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got some application on my Windows XP machine that is generating an HTTP request to every half hour. We've trapped the packets in wireshark, but wireshark doesn't tell what application generated the packets. Is there any utility that looks at network traffic AND tells what executable produced the traffic?

share|improve this question

TCPView from System Internals will show all of the connections and the executable that created the connection.

share|improve this answer
This is awesome, except the traffic I'm researching is a quick ping taking place every 30 minutes... this tool doesn't log what's going on so there's almost no chance to catch it in action. Is there anything like this that generates a log? – jeffspost Mar 15 '10 at 16:48
Hmm... not that I know of, and at the network capture level you'll never get access to the application information. If it runs every 30 minutes than it is either a memory resident process, a scheduled task, or part of a DLL loaded into a host process like svchost. In the first and last case you can try and find the executable using another system internal tool called process explorer: Good luck! – Greg Bray Mar 16 '10 at 5:12

You could use netstat with the -b option to get that information provided you know enough about the connection to be able to find what you are looking for in the list.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.