Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I've got some application on my Windows XP machine that is generating an HTTP request to aaronsw.com every half hour. We've trapped the packets in wireshark, but wireshark doesn't tell what application generated the packets. Is there any utility that looks at network traffic AND tells what executable produced the traffic?

share|improve this question

2 Answers

up vote 2 down vote

TCPView from System Internals will show all of the connections and the executable that created the connection.

share|improve this answer
This is awesome, except the traffic I'm researching is a quick ping taking place every 30 minutes... this tool doesn't log what's going on so there's almost no chance to catch it in action. Is there anything like this that generates a log? – jeffspost Mar 15 '10 at 16:48
Hmm... not that I know of, and at the network capture level you'll never get access to the application information. If it runs every 30 minutes than it is either a memory resident process, a scheduled task, or part of a DLL loaded into a host process like svchost. In the first and last case you can try and find the executable using another system internal tool called process explorer: technet.microsoft.com/en-us/sysinternals/bb896653.aspx Good luck! – Greg Bray Mar 16 '10 at 5:12
up vote 1 down vote

You could use netstat with the -b option to get that information provided you know enough about the connection to be able to find what you are looking for in the list.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.