blocks|key|1253105|text|您可以将来自wireshark的端口号与来自netstat的端口号进行匹配，这将告诉您侦听该端口的进程的PID。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1253106|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Netstat^0|M|7|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

You could match the port numbers from wireshark up to port numbers from, say, <a href="http://en.wikipedia.org/wiki/Netstat" rel="noreferrer">netstat</a> which will tell you the PID of a process listening on that port.

blocks|key|1467991|text|如果你正在寻找另一种方式，并且你使用的环境是Windows，微软的Network+Monitor+3.3是一个很好的选择。它具有process+name列。您可以使用上下文菜单轻松地将其添加到筛选器并应用筛选器。像往常一样，GUI非常直观……|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1467992|entityMap|0|LINK|mutability|MUTABLE|url|https://en.wikipedia.org/wiki/Microsoft_Network_Monitor^0|X|F|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Just in case you are looking for an alternate way and the environment you use is Windows, Microsoft's <a href="https://en.wikipedia.org/wiki/Microsoft_Network_Monitor" rel="noreferrer">Network Monitor</a> 3.3 is a good choice. It has the process name column. You easily add it to a filter using the context menu and apply the filter.. As usual the GUI is very intuitive...

blocks|key|1253246|text|您可以在wireshark上使用以下命令示例检查端口号：-|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1253247|tcp.port==80|1253248|tcp.port==14220|1253249|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

You can check for port numbers with these command examples on wireshark:-

tcp.port==80

tcp.port==14220

blocks|key|1253318|text|对于监控某些进程试图连接到的位置，这是一件很重要的事情，在Linux上似乎没有任何方便的方法来做到这一点。然而，有几种解决方法是可能的，所以我觉得值得一提。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1253319|有一个名为nonet的程序，它允许在没有互联网接入的情况下运行程序(我的系统上的大多数程序启动程序都设置了它)。它使用setguid在nonet组中运行一个进程，并设置一个iptables规则来拒绝来自该组的所有连接。|offset|length|1253320|更新:到目前为止，我使用的是一个更简单的系统，您可以使用ferm轻松地拥有一个可读的iptables配置，并且只需使用程序sg来运行具有特定组的程序。Iptables还允许您重新路由流量，因此您甚至可以将其路由到单独的接口或端口上的本地代理，如果您不想在检查流量时禁用所有互联网，则允许您在wireshark中过滤或直接从iptables记录数据包。|style|CODE|1253321|将其调整为在组中运行程序并在执行生命周期内使用iptables削减所有其他流量并不是很复杂，然后您可以只捕获来自此进程的流量。|1253322|如果我有空来写这篇文章，我会在这里发布一个链接。|1253323|另一方面，你总是可以在虚拟机中运行一个进程，并嗅探正确的接口来隔离它建立的连接，但这将是一个相当差的解决方案……|1253324|entityMap|0|LINK|mutability|MUTABLE|url|http://www.winehq.org/pipermail/wine-users/2009-August/057931.html|1|http://en.wikipedia.org/wiki/Iptables^0|0|5|5|0|2E|8|1|0|1P|2|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|10|8|@]|9|@$D|11|E|12|1|13]|$D|14|E|15|1|16]]|A|$]]|$1|F|3|G|5|6|7|17|8|@$D|18|E|19|H|I]]|9|@]|A|$]]|$1|J|3|K|5|6|7|1A|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1B|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1C|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]]|Q|$R|$5|S|T|U|A|$V|W]]|X|$5|S|T|U|A|$V|Y]]]]

This is an important thing to be able to do for monitoring where certain processes try to connect to, and it seems there isn't any convenient way to do this on Linux. However, several workarounds are possible, and so I feel it is worth mentioning them.

There is a program called <a href="http://www.winehq.org/pipermail/wine-users/2009-August/057931.html" rel="nofollow">nonet</a> which allows running a program with no Internet access (I have most program launchers on my system set up with it). It uses setguid to run a process in group nonet and sets an <a href="http://en.wikipedia.org/wiki/Iptables" rel="nofollow">iptables</a> rule to refuse all connections from this group.

Update: by now I use an even simpler system, you can easily have a readable iptables configuration with ferm, and just use the program <code>sg</code> to run a program with a specific group. Iptables also alows you to reroute traffic so you can even route that to a separate interface or a local proxy on a port whith allows you to filter in wireshark or LOG the packets directly from iptables if you don't want to disable all internet while you are checking out traffic.

It's not very complicated to adapt it to run a program in a group and cut all other traffic with iptables for the execution lifetime and then you could capture traffic from this process only.

If I ever come round to writing it, I'll post a link here.

On another note, you can always run a process in a virtual machine and sniff the correct interface to isolate the connections it makes, but that would be quite an inferior solution...

blocks|key|1253435|text|在某些情况下，您不能按进程id进行过滤。例如，在我的例子中，我需要嗅探来自一个进程的流量。但我发现在它的配置目标机器的IP地址，添加了过滤器ip.dst==someip和瞧。它在任何情况下都不会起作用，但对某些人来说是有用的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1253436|entityMap^0|1Y|E|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

In some cases you can not filter by process id. For example, in my case i needed to sniff traffic from one process. But I found in its config target machine IP-address, added filter <code>ip.dst==someip</code> and voila. It won't work in any case, but for some it's useful.

blocks|key|1468267|text|使用netstat获取端口号|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1468268|netstat+-b|code-block|syntax|javascript|1468269|然后使用Wireshark过滤器：|1468270|tcp.port+==+portnumber|1468271|entityMap|0|LINK|mutability|MUTABLE|url|https://it.wikipedia.org/wiki/Netstat^0|2|7|2|7|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|13|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|14|8|@]|D|@]|E|$I|J]]|$1|O|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]]]

Get the port number using <a href="https://it.wikipedia.org/wiki/Netstat" rel="nofollow"><code>netstat</code></a>:

<pre><code>netstat -b
</code></pre>

And then use the Wireshark filter:

<pre><code>tcp.port == portnumber
</code></pre>

blocks|key|1253604|text|使用strace更适合这种情况。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1253605|strace+-f+-e+trace=network+-s+10000+-p+<PID>;|code-block|syntax|javascript|1253606|选项-f，用于跟踪所有派生进程；选项-e+trace=netwrok，用于仅过滤网络系统调用；选项-s，用于显示字符串长度，最多10000个字符。|1253607|您还可以仅跟踪某些调用，如send、recv、read操作。|1253608|strace+-f+-e+trace=send,recv,read+-s+10000+-p+<PID>;|1253609|entityMap^0|2|6|0|0|2|2|I|G|1D|2|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|13|8|@]|D|@]|E|$]]|$1|O|3|P|5|H|7|14|8|@]|D|@]|E|$I|J]]|$1|Q|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|R|$]]

Use <code>strace</code> is more suitable for this situation. 

<pre><code>strace -f -e trace=network -s 10000 -p &lt;PID&gt;;
</code></pre>

options <code>-f</code> to also trace all forked processes, <code>-e trace=netwrok</code> to only filter network system-call and <code>-s</code> to display string length up to 10000 char. 

You can also only trace certain calls like send,recv, read operations. 

<pre><code>strace -f -e trace=send,recv,read -s 10000 -p &lt;PID&gt;;
</code></pre>

Is there a way to filter/follow a <a href="http://en.wikipedia.org/wiki/Transmission_Control_Protocol" rel="noreferrer">TCP</a>/<a href="http://en.wikipedia.org/wiki/Transport_Layer_Security" rel="noreferrer">SSL</a> stream based on a particular process ID using <a href="http://en.wikipedia.org/wiki/Wireshark" rel="noreferrer">Wireshark</a>?

Filter by process/PID in Wireshark

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

有没有一种方法可以使用根据特定的进程ID过滤/跟踪/流

问在Wireshark中按进程/PID过滤
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Wireshark中按进程/PID过滤EN