Revision history [back]

How can I setup the capture to get the calling process name?

In order for Wireshark to determine the name of the process that sent a packet:

• it would have to be running on the same machine as that process, otherwise all it has are packets that arrived on its network interface, which may have come from anywhere, including a system that either has no notion of processes or no notion of process names;
• the capture mechanism Wireshark is using would either have to provide that information as part of the packet metadata, or Wireshark would need to have a list of network connections and processes using those network connections, and would need to be able to look up the network address and port number from which the packet was sent in that list.

Currently, the only capture mechanism that provides that information in a form that Wireshark could use is the capture mechanism used in newer versions of macOS; you'd have to capture using Apple's version of tcpdump, in which case at least some packets sent by the machine will have a pcapng packet comment giving the process name.