WhoYouCalling: Effortless Process Network Monitoring with ETW and BPF

by ddos ·

WhoYouCalling

Monitors network activity made by a process through the use of Windows Event Tracing (ETW) and Full Packet Capture (FPC). Filters a generated .pcap file with BPF based on the detected network activity made by the process. This application makes process network monitoring hella’ easy.

“Why not just use ProcMon+Wireshark??”🤔🤔

One of the best methods of monitoring activities by a process in Windows is with the Sysinternal tool ProcMon. However, there are some downsides:

  1. Manual Work: To get a Full Packet Capture per process you need to manually start a packet capture with a tool like Wireshark/Tshark, and create a filter for endpoints based on the results of ProcMon, which can be timeconsuming and potential endpoints may be missed due to human error if the process is not automated.
  2. Child processes: It can be tedious to maintain a track record of all of the child processes that may spawn and the endpoints they’re communicating with.
  3. DNS queries: (AFAIK) ProcMon doesn’t support capturing DNS queries. It does provide with UDP/TCP sent to port 53, but no information of the actual domain name that’s queried nor the given address response.

Feature

  • Can start and monitor an executable.
  • Can monitor an already running process.
  • Can monitor additional related processes based on executable names.
  • Executables can be run as other users and in elevated and unelevated states.
  • Creates a full packet capture .pcap file per process.
  • Records TCPIP activities made by a processes, netflow style.
  • Records DNS requests and responses made and retrieved by applications.
  • Creates Wireshark filter for domains queried via DNS with the DNS responses
  • Can specify pcap filtering to only record TCPIP activity being sent from the process. This is applied to the recorded .pcap.
  • Can be automated with a timer.
  • By default all monitoring is applied to all spawned child processes.
  • Can kill spawned process and its childprocesses on stop.
  • Process and DNS results can be exported to JSON.
  • Can generate a Wireshark DFL filter per process.
  • Can generate a BPF filter per process.

Install & Use

Tags: Network Monitoring