I was doing a packet capture as part of a development project and saw some odd traffic coming from my machine in the capture file.
About every 3600 seconds, a NAT-PMP request is being sent to the IP "18.104.22.168". (Kind of amusing, looks like something got the endianness wrong.)
I'm concerned the machine could potentially have malware, but malware scans report nothing.
I started a packet capture filtering out only the NAT-PMP packets in question, and the packets are going out almost every hour, but not reliably every hour.
Wireshark itself can't tell me which process is sending the packets. TCPView could work, but I'd have to make sure I'm at the machine almost exactly when the packets go out, because the list doesn't retain closed or inactive connections for very long. With the packets not reliably going out every single hour, that's a frustrating proposition.
Suggestions on how to figure out which process is sending these packets at a wide interval?