One of our readers recently asked us if we were aware of any integrated tools that would let an analyst compare network events against process events on a specific computer.  As he pointed out, there are many tools that can tell you what is going on network-wise (netstat, tcpdump, portmon, etc.) and plenty that can tell you what the computer is doing (procmon, process explorer, etc.) but none that bring them all together.  Here is how he described his wish list:

I want a tool (or set of tools) for monitoring a Windows PC in such a way that:

* it monitors packets in pcap, like tcpdump and
* it monitors each process network activity like netstat -anpb while
* being able to keep log and records of process activity changes, not just showing the past few seconds' changes.

A sample usecase scenario: I wake up in the morning and check my Wireshark or NetWitness Investigator logs and notice a strange session and I want to be able to quickly glue that session to a process that has been responsible for that...

While a mix of netstat and command-line Foo for piping outputs to a log file among Wireshark can do the job, I hope there must be a decent and handy tool out there, for this purpose.

So, readers - got any ideas?  We had a lively debate between some of the handlers earlier today but could not come up with exactly what he is looking for.  If you know of such a tool please use the comment feature below to tell us all about it.  Of course, we are aware of Microsoft's Sysinternals suite by Mark Russinovich but that is not what our reader is looking for. 

Thanks for any ideas.

Marcus H. Sachs
Director, SANS Internet Storm Center