Solved

How do I trace ICMP packets to the Windows process that is sending them?

Posted on 2007-04-11
3
1,520 Views
Last Modified: 2013-11-29
Hi there,
 
I've got a system sending large ICMP packets that our firewall is detecting. This is not a major issue but they are oversized and are fragmenting. Which seems odd. They appear to be transmitted at somewhat regular intervals.
 
I would like to dertermine what process is generating these packets. I've seached and found suggestions but no program or tool that is comparable to TCPView.  Which is really what I'd like to see. I am a network administrator and compiling code on Windows is something I would like to avoid if possible. Ideally a pre-exisiting program to resolve this would be great.
 
Does anyone have a solution or suggestion on how to trace what process is sending these large ICMP packets?

I actually have 2 systems doing this: Windows 2000 Server, SP4 and Windows Server 2003 Standard.

-Wireshark does not tie packets to a process.
-TCPView does not sho ICMP traffic.
-I wonder if this is even possible.
 
Thanks,
 
Eric
0
Comment
Question by:erisler
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 2

Expert Comment

by:Micah_B
ID: 18890591
Hello,
Does the command "netstat" cover this function?
You could try a "netstat -p icmp" for starters.
Hope this helps
0
 

Author Comment

by:erisler
ID: 18917687
Netstat does not help. I've posted several forum messages and had no luck. I'm really looking for a program that will monitor for ICMP packets and show the following:

-ICMP statistics (packet size, etc).
-originating process

Thanks for the help.

Eric
0
 
LVL 5

Accepted Solution

by:
skaap2k earned 250 total points
ID: 18925127
A firewall like zonealarm will do something like this for you "Process X is trying to send a ping to x.x.x.x" .. do you want to allow this ... you could customise the app to just watch for ICMP traffic ..
0

Featured Post

Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
robocopy vs xcopy vs copy 8 179
Sharing same loopback address on different switches 1 62
Auto-launch VPN via Wifi 7 84
Configure 2 Servers with Crossover cable 3 44
The article explains the protocols and technology which is involved when two computers on different TCP/IP networks communicate with each other. In the diagram, a router is used to segregate two networks. The networks are 192.168.1.0/24 and 192…
Configuring network clients can be a chore, especially if there are a large number of them or a lot of itinerant users.  DHCP dynamically manages this process, much to the relief of users and administrators alike!
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question