How can i track which program sends data over my network and can i see the contents of it?
If we have a AV software installed in a VM , can we see what it's sending from your pc when doing a scan?
-
Do you want to track what information a program sends out of your network ?– BokisCommented Feb 9, 2019 at 14:57
-
Yeah. I got a suspicious portable software and want to know what it sends.– AltobanCommented Feb 9, 2019 at 15:05
-
you can use a tool to track your network traffic, i would suggest wireshark.org– BokisCommented Feb 9, 2019 at 15:08
-
Can Wireshark see if the software is uploading documents for example?– AltobanCommented Feb 9, 2019 at 15:31
Add a comment
|
1 Answer
With wireshark you can see all the incoming/out-coming traffic at your network. You can install wireshark at your vm.
It shows you a breakdown for every packet being exchanged from your network, you can see all the information of that packet including ip source, ip destinations,payload, protocol being used etc.
Once you've found a suspicious packet you can right click it -> follow stream which will show you the entire exchange of packets between your computer and the target server.For every packet you can see its payload,which is the actual content of the packet.
The payload will be in HEX form and possibly encrypted which is a downside at tracking exactly what information is sent.
-
Is there a way to filter so I know which packet to look for?– AltobanCommented Feb 10, 2019 at 1:10
-
I'm seeing the same ip address appearing as source and destination throughout, I think it's Microsoft ip or something. But nothing else.– AltobanCommented Feb 10, 2019 at 1:59
-
can u specify a bit more what u are looking for? What OS are u running?Do u know the program u wanna track?– BokisCommented Feb 10, 2019 at 11:02
-
Okay I'm in hyper V, windows 10, trying to see if Dr web curit is uploading files from my computer. I see lots of Microsoft ip, but other destinations as well. Don't know what to follow. I uploaded the AV scanner to virus total here: virustotal.com/#/file/…– AltobanCommented Feb 10, 2019 at 22:28