WhoYouCalling: Effortless Process Network Monitoring with ETW and BPF
WhoYouCalling
Monitors network activity made by a process through the use of Windows Event Tracing (ETW) and Full Packet Capture (FPC). Filters a generated .pcap file with BPF based on the detected network activity made by the process. This application makes process network monitoring hella’ easy.
“Why not just use ProcMon+Wireshark??”🤔🤔
One of the best methods of monitoring activities by a process in Windows is with the Sysinternal tool ProcMon. However, there are some downsides:
- Manual Work: To get a Full Packet Capture per process you need to manually start a packet capture with a tool like Wireshark/Tshark, and create a filter for endpoints based on the results of ProcMon, which can be timeconsuming and potential endpoints may be missed due to human error if the process is not automated.
- Child processes: It can be tedious to maintain a track record of all of the child processes that may spawn and the endpoints they’re communicating with.
- DNS queries: (AFAIK) ProcMon doesn’t support capturing DNS queries. It does provide with UDP/TCP sent to port 53, but no information of the actual domain name that’s queried nor the given address response.
Feature
- Can start and monitor an executable.
- Can monitor an already running process.
- Can monitor additional related processes based on executable names.
- Executables can be run as other users and in elevated and unelevated states.
- Creates a full packet capture .pcap file per process.
- Records TCPIP activities made by a processes, netflow style.
- Records DNS requests and responses made and retrieved by applications.
- Creates Wireshark filter for domains queried via DNS with the DNS responses
- Can specify pcap filtering to only record TCPIP activity being sent from the process. This is applied to the recorded .pcap.
- Can be automated with a timer.
- By default all monitoring is applied to all spawned child processes.
- Can kill spawned process and its childprocesses on stop.
- Process and DNS results can be exported to JSON.
- Can generate a Wireshark DFL filter per process.
- Can generate a BPF filter per process.
