GSOC Project:Process information

[kunal bansal <kunalbansal.02 () gmail com>]

based on post
http://www.wireshark.org/lists/wireshark-dev/201305/msg00039.html
&
http://www.wireshark.org/lists/wireshark-dev/201305/msg00118.html

i got to know that the implementation has already been done in linux but we
have to devise a UI via wireshark for the same

Besides For *Windows*:
honeevent can also be implemented using  winpcap
though using netshdump (which works via ETW, a good realtime support)works
great to create a log file but it doesn't seems an option because it uses
higher administrative rights.
So if we really want to realtime access we need to make a script using ETW
on windows.

hone_notify can work as it is
.

FOR* Mac OSX*

As mentioned in my proposal,using dtrace scripts is a nice option.

conntrack DTrace script for Solaris and Opensolaris to monitor all outgoing
TCP and UDP connections by process, user and port.

It has some filtering capabilities allowing to filter traffic by port,
process or user.


https://github.com/kunalbansal16/demo/blob/master/wiresharkdemo/mac%20os/dtrace/conntrack.d

Regards,
Kunal Bansal

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe