Windows 10 Identifying which application is generating ICMP Traffic

amane · Apr 8, 2018

Hello All,

We are observing lots of ICMP traffic from a windows system. However, we are not able to identify which application is generating this traffic.

We tried to check by using "netstat -abn" however, it shows only TCP and UDP traffic, but not ICMP.

Is there any feature or utility in windows that can tell us which application is causing this?

Thanks in advance.
Ameer Mane

Sent from my Moto G (4) using Tapatalk

Neemobeer · Apr 9, 2018

There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.

Neemobeer · Apr 9, 2018

There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.

amane · Apr 9, 2018

Neemobeer said:
There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.

Hello Neemobeer,

Thanks for update. I will look for procmon as I have not explored it yet. I will try it and will let you know.

Regards,
Ameer Mane

Sent from my Moto G (4) using Tapatalk

Windows 10 Identifying which application is generating ICMP Traffic

amane

New Member

Neemobeer

Neemobeer

Cloud Security Engineer

amane

New Member

Similar threads