Ethereal-users: Re: [Ethereal-users] Ethereal Version 0.10.6 - Identifying actual program transm

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 05 Sep 2004 13:24:34 -0700
mark abrams wrote:

How do I identify the actual program that is
transmitting the packets from my PC to the destination
IP?

You can use a network analysis program such as Ethereal to find the traffic, get the local IP address and port number (and protocol, i.e. TCP or UDP) from the packets, and, if this is Windows, use a utility such as TCPView:

	http://www.sysinternals.com/ntw2k/source/tcpview.shtml

or, if it's a UN*X, use a utility such as lsof:

	http://freshmeat.net/projects/lsof/

(which comes with at least some UN*Xes) to see what process is using that IP address, port number (and protocol).