One of our readers recently asked us if we were aware of any integrated tools that would let an analyst compare network events against process events on a specific computer. As he pointed out, there are many tools that can tell you what is going on network-wise (netstat, tcpdump, portmon, etc.) and plenty that can tell you what the computer is doing (procmon, process explorer, etc.) but none that bring them all together. Here is how he described his wish list: I want a tool (or set of tools) for monitoring a Windows PC in such a way that: So, readers - got any ideas? We had a lively debate between some of the handlers earlier today but could not come up with exactly what he is looking for. If you know of such a tool please use the comment feature below to tell us all about it. Of course, we are aware of Microsoft's Sysinternals suite by Mark Russinovich but that is not what our reader is looking for. Thanks for any ideas. Marcus H. Sachs |
Marcus 301 Posts ISC Handler Apr 11th 2010 |
Thread locked Subscribe |
Apr 11th 2010 1 decade ago |
While not satisfying all 3 of the requirements, Microsoft's Network Monitor 3.3 (http://blogs.technet.com/netmon/archive/2009/04/22/network-monitor-3-3-has-arrived.aspx) monitors packets, but organizes them in a tree view by process. I find it helps me easily identify traffic associated with certain processes...even those hosted by svchost.
|
Mick 1 Posts |
Quote |
Apr 11th 2010 1 decade ago |
TCPSpy may be what you'd want in the *nix world. I don't know if it runs in cygwin, and a quick google search neither confirmed nor denied. Perhaps it's worth a shot though?
http://the.wiretapped.net/security/network-monitoring/tcpspy/ |
brad 3 Posts |
Quote |
Apr 12th 2010 1 decade ago |
I have a free utility on my website that may help. It presently provides output generally matching 2 of the 3 items in the wish list. http://scadmintools.net/advantage.aspx is geared toward targeting remote hosts in an Active Directory environment. Coincidentally, I am planning on updating a couple of features, one of which reads summary stdout from tshark in the next version. This will help to look at general pack caps and associate with Windows diags in a common UI for AD security admins. Time permitting, I should be able to release ADVantage v4 in a month or so.
|
brad 1 Posts |
Quote |
Apr 12th 2010 1 decade ago |
MS's Network Monitor is a good start. It can be silently installed and scripted to obtain info on a machine after an event occurs.
Make a UNC connection to the machine. Silently install MS NetMon with psexec: psexec \\COMPUTERNAME -c NM33_x86.exe /q Check the time on the computer to aid in scheduling the capture task: net time \\COMPUTERNAME Copy a "capture.bat file to the NetMon dir on the machine: xcopy capture.bat "\\COMPUTERNAME\C$\program files\Microsoft Network Monitor 3\" Contents of "capture.bat" c: cd "c:\program files\Microsoft Network Monitor 3" nmcap /network * /capture tcp /File C:\temp\tcp.cap /terminatewhen /timeafter 60 seconds Remotely schedule the task: schtasks /create /s COMPUTERNAME /tn "NetCapTest" /tr "c:\program files\Microsoft Network Monitor 3\capture.bat" /sc once /st 10:25:00 /sd 04/12/2010 Copy the tcp.cap file over and review the contents. Regards. |
brad 2 Posts |
Quote |
Apr 12th 2010 1 decade ago |
Microsoft has a service that I just started playing with that will solve part of this issue.
"Process Reporter" and its counterpart "Process Reporter Parser". Very cool service and LOTS of data on the processes running. Transparent to the user from what I have found. It has aided us in identifying malware that only 2 of 39 vendors on VirusTotal were able to detect. |
brad 1 Posts |
Quote |
Apr 12th 2010 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!