Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there an easy way to know from where the packets come from? Which program?

My pc which is on is continuously sending packets (TCP and SMB) to an unknown host ( and I can't figure out which program is doing that.

share|improve this question
netstat -abn does the trick – Zephyr Pellerin Sep 23 '10 at 16:42
Thanks! I'll try... – Keyne Viana Sep 23 '10 at 16:51
up vote 1 down vote accepted

In this case you might just want to use a software firewall, like ZoneAlarm, it will tell you what apps on a computer are sending where.

share|improve this answer
I'm not convinced that I need a firewall to that... – Keyne Viana Sep 23 '10 at 18:46
You don't need one, it is just a simple method for seeing what app is sending info out to which IP address. It will of course only give you basic information, so it all depends on what level of detail you're after. – MaQleod Sep 23 '10 at 18:56
I see... I'll try and see the results... thanks. – Keyne Viana Sep 23 '10 at 20:04
Thank you! It works, see my comment on @mfinni answer. – Keyne Viana Sep 23 '10 at 23:29

No, wireshark doesn't have this data. Remember, it's sniffing the wire. If you were on a shared network segment, it would show packets from other machines. Hell, even in an unshared segment it shows packets bound to you from other machines, or broadcasts - wireshark certainly has no way of knowing what processes on the remote machines generated those.

What OS are you using? If it's Windows, netstat or TCPView (from Sysinternals) work. I think netstat is also the command on most Unixes.

share|improve this answer
Thanks! I'm on Windowns. I'll try netstat and TCPView and come back with the results. – Keyne Viana Sep 23 '10 at 17:08
Just a note: The processes in on my machine, not remote. But I understand, Wireshark cannot do this trick. – Keyne Viana Sep 23 '10 at 17:13
Microsoft Network Monitor 3.4 can show you both the PID and the name of the process responsible for the traffic. – joeqwerty Sep 23 '10 at 17:35
Good call, Joe. – mfinni Sep 23 '10 at 18:11
Glad to help... – joeqwerty Sep 23 '10 at 19:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.