Windows – How to determine which process is sending UDP packets once per hour

networkingpacket-captureudpwindows

I was doing a packet capture as part of a development project and saw some odd traffic coming from my machine in the capture file.

About every 3600 seconds, a NAT-PMP request is being sent to the IP "1.1.168.192". (Kind of amusing, looks like something got the endianness wrong.)

I'm concerned the machine could potentially have malware, but malware scans report nothing.

I started a packet capture filtering out only the NAT-PMP packets in question, and the packets are going out almost every hour, but not reliably every hour.

Wireshark itself can't tell me which process is sending the packets. TCPView could work, but I'd have to make sure I'm at the machine almost exactly when the packets go out, because the list doesn't retain closed or inactive connections for very long. With the packets not reliably going out every single hour, that's a frustrating proposition.

Suggestions on how to figure out which process is sending these packets at a wide interval?

Best Answer

You can easily accomplish this with SysInternals' Process Monitor. Run it as Administrator, then configure it as follows:

  1. On the Filter menu click Filter...
  2. In the first drop down box, select Operation. Select Is for the match condition, then in the blank drop-down box select UDP Send, then click Add.

enter image description here

  1. Again, in the first drop-down box, select Path. Select Contains for the match condition, then enter your destination IP address in the free-text drop-down, then click Add.

enter image description here

  1. Click OK to activate the new filter.
  2. Let Process Monitor run until it finds matching traffic.

enter image description here

  1. Right-click on any matching entry and choose Properties, then click the Process tab to view the process associated with the outbound UDP traffic.

enter image description here

Related Topic