Packet Catcher

[S6k9GNh0]

Anyone know a program that catches packets from a specific process?

[R0mai]

Maybe you're looking for this?
http://www.oxid.it/

[maikel]

if you mean network packets, i believe wireshark has proper filters.

Maikel

[mcleano]

Both Cain & Able(http://www.oxid.it/) and wireshark are good options. Ettercap is also very good and works well on linux if you're looking at SSL.

[S6k9GNh0]

Wireshark does not have the ability to attach itself to a process and look at its packets. I'm looking for all outgoing and ingoing packets to a specific process.

[chrisname]

Depends on what system you want to do it on.
winpcap, CreateProcess and CreatePipe (windows), or
libpcap, fork() and pipe() on *nix.

[mcleano]

Wireshark does not have the ability to attach itself to a process and look at its packets. I'm looking for all outgoing and ingoing packets to a specific process.

But it does have the ability to look at all in/outgoing packets on specific ports. Could you not just monitor the port?

[S6k9GNh0]

Yeah, but it's troublesome when the app uses multiple ports.

[mackabee]

@computerquip: You want WPE PRO (if you're using windows)

WPE PRO works by injecting the dll that comes with it (wpespy.dll IIRC) and hooks the winsock functions.

I don't know of an alternative for linux but it would work the same. Use the ptrace system call to do what you need in order to hook the socket functions.