Home / server / Questions / 184039
Accepted
Keyne Viana
Asked: 2010-09-24 08:40:27 +0800 CST

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

  • 772

is there an easy way to know from where the packets come from? Which program?

My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I can't figure out which program is doing that.

wireshark packet

2 Answers

  1. No, wireshark doesn't have this data. Remember, it's sniffing the wire. If you were on a shared network segment, it would show packets from other machines. Hell, even in an unshared segment it shows packets bound to you from other machines, or broadcasts - wireshark certainly has no way of knowing what processes on the remote machines generated those.

    What OS are you using? If it's Windows, netstat or TCPView (from Sysinternals) work. I think netstat is also the command on most Unixes.

    • 2
  2. Best Answer

    In this case you might just want to use a software firewall, like ZoneAlarm, it will tell you what apps on a computer are sending where.

    • 1