Jump to content
simy8891

Get network usage per process

Recommended Posts

simy8891

Hi guys,

It's been a while since I wrote my last message here and a while since I used AutoIt. I'm currently sort of desperate and I'm trying to find some help in regards of getting the network usage per process!

I'm not interested in the total network usage of the NIC, but only on a specific PID's network utilization. They idea is to collect the amount of traffic uploaded and downloaded by a list of specific processes. So far Process Hacker and Process Explorer are capable of getting what I need, but I need to use these numbers in another script so they're sort of useless to me. I can't seem to find a way around it.

Any idea, help is greatly appreciated.

Thanks

Share this post


Link to post
Share on other sites
SlackerAl

There is a lot of good stuff here: 

HTH


Problem solving step 1: Write a simple, self-contained, running, replicator of your problem.

Share this post


Link to post
Share on other sites
simy8891
21 minutes ago, SlackerAl said:

There is a lot of good stuff here: 

TH

Thanks, but unfortunately this is not good for what I need. Actually, if you look the last message in that thread on page 4, you'll see a user asking what I'm after: 

Quote

Well now since this has been bumped, I was wondering.
Is there a way to get process receive/send bytes over network like procexp?

 

Share this post


Link to post
Share on other sites
SlackerAl

could you use something like Tcpvcon (included with TcpView) to extract the information you need?


Problem solving step 1: Write a simple, self-contained, running, replicator of your problem.

Share this post


Link to post
Share on other sites
simy8891
9 minutes ago, SlackerAl said:

could you use something like Tcpvcon (included with TcpView) to extract the information you need?

Tcpvcon only shows the connections, but not the bandwidth utilization of each process. I'd be more than happy to use a 3rd party cmd-like application at this point, but couldn't really find any.

Share this post


Link to post
Share on other sites
SlackerAl

Sorry, I assumed more functionality in the cmd line version than there was... Last stab in the dark: How about https://www.wireshark.org/docs/man-pages/tshark.html available open source and windows binaries.

 

Skip that, I can't see how to resolve port addresses to PIDs

 

 

Edited by SlackerAl
Not helpful :/

Problem solving step 1: Write a simple, self-contained, running, replicator of your problem.

Share this post


Link to post
Share on other sites
simy8891

Appreciated the help though. I very rarely open new threads as I try to search the hell out of things before (why shall I re-invent the wheel)? But yeah, this is one of the times where I'm stuck everywhere. My goal would be doing it in Powershell, but AutoIT, C anything else would do now as long as I can then play with the outputs.

What's funny is that Resource Monitor in Windows shows the Send/Receive network info per process, but I can't find the same counter in Perfmon (which would be the one I'd use to then grab the counters from).

Share this post


Link to post
Share on other sites
Andreik

You might get some information about a connection bandwidth using GetPerTcpConnectionEStats.


When the words fail... music speaks

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • Miliardsto
      By Miliardsto
      I want to detect if exact process or window uses directx or opengl or maybe something else library used in applications.
      Thats becouse there could be many windows with same names and different names and the same with process. I got so much process names I want to my script works with all, so i want standardize.
      All of this processes uses DirectX or OpenGL so then If I check this window/process uses these libraries I will be sure thats the right process
    • TryWare90Days
      By TryWare90Days
      I'm trying to kill a malware process, that I can't remove with my www.sophus.com/hom antivirus.

      The malware is known as coinminer,config and my Sophus only creates popups of blocking the malware.

      I know that the malware is constantly launching a svchost *32.exe processes, where the svchost.exe processes are from my Windows 7 operating system.
      I have with no luck tried to do this:
      Global $_bStatus = False
      While $_bStatus = False
                 Global $_iPid
                 Global $_sActiveTitleNew = "svchost *32.exe"
                 $_iPid = WinGetProcess($_sActiveTitleNew)
                 If $_iPid <> -1 Then $_bStatus = ProcessClose($_iPid)   
      Wend
      EXIT
       
      But the $_iPid doesn't ever show anything else than  -1, even if I can see the svchost *32.exe process in my TaskManager
       
      YES - I know I shouldn't EXIT after killing the first malware detection, but it is easier to explain the above for you, so I can get a solution.
    • nacerbaaziz
      By nacerbaaziz
      Hello my friends
      I have an inquiry after your permission
      I found a function to get the special line commands for any operation
      It requires the name of the process to be searched
      I want to use it to know the process
      Is this possible with this function
      Here is the code
       
      Func commandLineGet($proc, $strComputer=".")
      dim $array[1]
      local $ArrayNumber
      local $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & $strComputer & "\root\cimv2")
      local $oProcessColl = $oWMI.ExecQuery("Select * from Win32_Process where Name= " & '"'& $Proc & '"')
      local $Process
      For $Process In $oProcessColl
      $Process = $Process.Commandline
          ReDim $Array[UBound($Array)+1]
      $ArrayNumber = UBound($Array)-1
      $array[$ArrayNumber] = $Process
      Next
      $ArrayNumber = UBound($Array)-1
      $array[0] = $ArrayNumber
      return $array
      EndFunc
    • ur
      By ur
      with the below code, I am keeping waiting for a particular file and waiting in the background.
      While $i <> 10 Sleep(60000) If FileExists(@ScriptDir&"\Binaries.ini") then --some processing-- $i = 10 endif WEnd I thought keeping the Sleep will freeze the process from resources but the CPU being uilized.But it is taking 47%.
      How to free this CPU usage also.?

    • badcoder123
      By badcoder123
      Anyone know how to access the information circled in the photo?
       

×