Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I've installed winpcap and use windump:

E:\>windump -i 2 -B 5000 -n -s 0 -l -C 1 -W 10 -e -q -X
windump: listening on \Device\NPF_{9718B3B1-6C96-4431-889B-2B1A37BED06E}
01:25:23.029278 00:19:5b:42:7b:b0 > 00:1e:8c:39:ea:64, IPv4, length 85: 83.140.172.212.6669 > 192.168.1.5.49266: tcp 31
        0x0000:  4520 0047 0070 4000 3706 8113 538c acd4  E..G.p@.7...S...
        0x0010:  c0a8 0105 1a0d c072 8272 c7b3 5be0 19fc  .......r.r..[...
        0x0020:  5018 0b08 c556 0000 5049 4e47 203a 706f  P....V..PING.:po
        0x0030:  7274 3830 632e 7365 2e71 7561 6b65 6e65  rt80c.se.quakene
        0x0040:  742e 6f72 670d 0a                        t.org..

How do I know, which process sent/got this packet? How can I know the PID?

share|improve this question

2 Answers 2

Currently, WinDump doesn't support that (and tcpdump doesn't support it on any flavor of UN*X, nor does Wireshark on any OS).

However, recent versions of Microsoft Network Monitor do. It's free-as-in-beer, and has a GUI (which may be a bug or a feature in your case).

share|improve this answer
    
Guy is correct. And if you prefer, NetMon comes with nmcap.exe, which is CLI version. –  charleswj81 Apr 15 '13 at 3:24

On windows:

netstat -on

on Unix:

netstat -pn

wou will see the connections and PIDs

share|improve this answer
    
But probably the connection can be already closed between I parse the tcpdump line and launch the netstat. How can I be sure, that I won't miss the localip:port before it dissapear or be rewrited by some new connections? –  Nakilon Apr 13 '13 at 21:53
    
I am not a windows person, but I believe you can write a PowerShell scrip to tigger netstat as soon as windump captures a packet –  tigran Apr 13 '13 at 22:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.