Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

is there an easy way to know from where the packets come from? Which program?

My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I can't figure out which program is doing that.

share|improve this question
1  
netstat -abn does the trick –  zv_ Sep 23 '10 at 16:42
    
Thanks! I'll try... –  Telephone Sep 23 '10 at 16:51

2 Answers 2

up vote 1 down vote accepted

In this case you might just want to use a software firewall, like ZoneAlarm, it will tell you what apps on a computer are sending where.

share|improve this answer
    
I'm not convinced that I need a firewall to that... –  Telephone Sep 23 '10 at 18:46
    
You don't need one, it is just a simple method for seeing what app is sending info out to which IP address. It will of course only give you basic information, so it all depends on what level of detail you're after. –  MaQleod Sep 23 '10 at 18:56
    
I see... I'll try and see the results... thanks. –  Telephone Sep 23 '10 at 20:04
    
Thank you! It works, see my comment on @mfinni answer. –  Telephone Sep 23 '10 at 23:29

No, wireshark doesn't have this data. Remember, it's sniffing the wire. If you were on a shared network segment, it would show packets from other machines. Hell, even in an unshared segment it shows packets bound to you from other machines, or broadcasts - wireshark certainly has no way of knowing what processes on the remote machines generated those.

What OS are you using? If it's Windows, netstat or TCPView (from Sysinternals) work. I think netstat is also the command on most Unixes.

share|improve this answer
    
Thanks! I'm on Windowns. I'll try netstat and TCPView and come back with the results. –  Telephone Sep 23 '10 at 17:08
    
Just a note: The processes in on my machine, not remote. But I understand, Wireshark cannot do this trick. –  Telephone Sep 23 '10 at 17:13
2  
Microsoft Network Monitor 3.4 can show you both the PID and the name of the process responsible for the traffic. –  joeqwerty Sep 23 '10 at 17:35
    
Good call, Joe. –  mfinni Sep 23 '10 at 18:11
    
Glad to help... –  joeqwerty Sep 23 '10 at 19:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.