Search code examples
wiresharkpacketmonitor

Wireshark, monitor certain process/task or prevent ordinary packets be monitored


Here's what I'm trying to do. Wireshark continuously monitors packet exchanges. I want to zero the packets that are monitored in any way. This is because I want to monitor only packets that occur during certain processes, specific tasks.

packet monitored by wireshark while doing nothing


Solution

  • You don't really have control over what packets are on the wire. Wireshark's sparklines are just showing you that it sees packets on the network that this adaptor is attached to, and that traffic almost certainly isn't all originating from your computer, as it includes broadcast traffic, as well as unicast packets destined to your computer from other computers, possibly multicast traffic, etc. While you can probably disable some services on your computer to reduce the traffic it generates, that's rather inconvenient to do and still doesn't guarantee you'll isolate all traffic to the process of interest.

    What you do have control over is which packets are captured, and for that, it's best to research the processes you're interested in. If the traffic it generates and ports it uses are documented and well-known, you can use that information to construct an appropriate capture filter. If it's not documented, then you may need to "baseline" that application first, in other words capture all traffic, then start up the process of interest and see what traffic is generated. Once you discover the packets it generates, you should be able to restrict capturing to only that traffic of interest. Alternatively, you can capture all traffic and then post-filter using Wireshark's display filters.