0

Configuring Wireshark to ID Local Apps Downloading Thru svchost

asked 2022-07-19 22:35:08 +0000

Is there a way to config WIRESHARK to display apps/programs on my PC that are using svchost.exe to download. I have Win10 set to pause updates for a month and have configured as many apps as I can to not automatically download updates or backup data remotely, yet I just went thru over an hour where "something" downloaded 600MB via svchost. I have Norton 360 running and Malwarebytes and just ran both doing full system scan and all is "clean". I did run netstat -b in elevated cmd prompt but could not find culprit there (difficult to look through anyway). Thanks!

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted

0

answered 2022-07-20 18:53:46 +0000

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Wireshark cannot currently do this, but such capture can be made using the built-in Windows capture tool PktMon.

The tool is available in Windows 10 builds 19041 (20H1) or later

edit flag offensive delete link

Comments

Thanks a ton! Looking at the tool and commands right now.

NCBlacksmith ( 2022-07-20 22:10:00 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Question Tools

1 follower

Stats

Asked: 2022-07-19 22:35:08 +0000

Seen: 101 times

Last updated: Jul 20 '22

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

Powered by Askbot version 0.10.2