📎 AI Summary:
The thread discusses how to identify the application responsible for ICMP traffic on a Windows system. The original poster, amane, seeks a utility that can pinpoint the source of ICMP packets, as tools like netstat do not show this information. Respondents indicate that Windows lacks a direct feature for this purpose and suggest using process monitoring tools like procmon to investigate potential API calls or processes, with amane planning to try procmon and follow up later. The overall sentiment is that identifying the application behind ICMP traffic requires indirect methods, as there’s no straightforward built-in solution.
A

amane

New Member
Member details
Joined
Apr 7, 2018
Messages
5
Thread Author #1
Hello All,

We are observing lots of ICMP traffic from a windows system. However, we are not able to identify which application is generating this traffic.

We tried to check by using "netstat -abn" however, it shows only TCP and UDP traffic, but not ICMP.

Is there any feature or utility in windows that can tell us which application is causing this?

Thanks in advance.
Ameer Mane

Sent from my Moto G (4) using Tapatalk
 

Solution
Neemobeer
There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.
Sort by date Sort by votes
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#2
There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.
 

Upvote 1 Downvote
Solution
A

amane

New Member
Member details
Joined
Apr 7, 2018
Messages
5
Thread Author #3
Neemobeer said:
There's nothing I'm aware of that will give you this kind of information. I experimented with netsh trace and firewall audit logging. I think at best you will have to run procmon and look for calls to ping.exe and do a little research to ID dot net api calls to programmatically send out ICMP packets.
Click to expand...
Hello Neemobeer,

Thanks for update. I will look for procmon as I have not explored it yet. I will try it and will let you know.

Regards,
Ameer Mane

Sent from my Moto G (4) using Tapatalk
 

Upvote 0 Downvote
You must log in or register to reply here.