#Wireshark filter by port software#

* along with this program if not, write to the Free Software * You should have received a copy of the GNU General Public License * GNU General Public License for more details. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * but WITHOUT ANY WARRANTY without even the implied warranty of * This program is distributed in the hope that it will be useful,

* of the License, or (at your option) any later version. * as published by the Free Software Foundation either version 2 * modify it under the terms of the GNU General Public License * This program is free software you can redistribute it and/or * Process information (pid, process name) This is done through process_info.h and process_info.c implementation. Under windows, you can use the netstat command to query the source address, destination address, port and process PID for each connection. Get the process corresponding to the IP packetДЇirst, associate the process with the port number.

I am modifying on the basis of this version: I implemented it in a recent version with reference to its code and found it really works.

Wireshark-dev: Re: Filter by local process name.

I found an implementation when I checked the materials online, but the version is older, November 2012. In particular, when we need to analyze the protocol for a particular program, it's perfect to have a process name as a filter. When using wireshark, one of the most frustrating things is filtering out what you need from a large number of data packets.