Is it possible to filter the capture result for specific programs so that it only shows the packets which that program has sent/recieved ? asked 08 Jul '13, 05:46  Milad Rad |
One Answer:
No, you can't unless each program uses specific ports that you can associate to the program, e.g. port 80 being an apache web server process. This means that you need to know for certain that there is that program running on the originating host, and no other program "hijacked" that port. There is no program executable name or other identification of the originating process in a trace file, unless using capture programs that can provide this (like Microsoft NetMon etc.) answered 08 Jul '13, 05:48  Jasper ♦♦ edited 08 Jul '13, 05:50 |
