一、 方法论
二、工具
（1） 全协议分析工具
-
wireshark window和linux都适用，还有通过process id来分析的修改版本，下载地址为PAINT Download
-
Microsoft Network Monitor(NetMon) is a free network packet capturing software from Microsoft. It looks up the TCB (TCP Control Block) in semi-real-time to attribute network packets to processes. It can, however, only attribute TCP traffic and not UDP traffic. Another NetMon limitation is that it only periodically queries the TCB due to performance constraints. It’s possible for a TCP connection to exist between the TCB polls and cause a false-negative.
-
Process Monitoris another Microsoft (SysInternals) tool. It logs virtually all attributable application activities including network activities. However, it can only attribute network connection activity and does no
