Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter.

I have a specific issue on a system with very high traffic. Sniffing "all" packets and filtering them is becoming a very burdensome problem and eliminating packet emission from all but the offending app is not possible in this scenario.

share|improve this question

You don't mention what OS you're running on said system, but if it's running Windows you can use Microsoft Network Monitor, which shows the process ID for each "conversation" so it should allow you to focus your analysis. "Filtering" traffic per process ID is as simple as selecting the process in the left pane and viewing it's traffic in the right pane.

share|improve this answer
Right, thanks. I thought that with mentioning dtrace it would be a little more evident. This is an OS X server, however I likewise would similarly want to be able to apply this to Linux based servers and FreeBSD. – ylluminate Jul 13 '12 at 14:57

Not sure this is what you require, but netstat can help you associate process id with network port. In wireshark you can then filter on that port number, to only sniff a specific process id's packets.

share|improve this answer
Yes, this had crossed my mind, however I had hoped to find a more simplistic way to cross reference the pids with packets. – ylluminate Jul 13 '12 at 15:00

On windows there is an experimental build that does this, as described on the mailing list:

share|improve this answer
up vote 1 down vote accepted

Recently I ran into a really nice solution for this problem and wanted to share. It is found in the DTrace Book:

You'll want to pull down the examples from here:

I'm running no OS X. I extracted the scripts to dtbook under my ~/bin and executed the appropriate script as follows:

sudo ~/bin/dtbook/Chap6/soconnect_mac.d 

Which will then give you all processes with their connections. I usually pipe that into grep and search for apps specifically now.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.