Home› Software› procpcap
procpcap cover: three process IDs, one of them linked to an orange .pcapng box

procpcap logoprocpcap

Per-process packet capture for Windows
Price
Free
Version
1.0.1
Platform
Windows x64
License
MIT
Free & Open Source Packet Capture Wireshark WinDivert C++20
Wireshark captures a whole network interface. It cannot show you one program’s traffic on its own, because Windows does not tag packets with a process once they reach the network layer. procpcap does that tagging. It watches the WinDivert FLOW layer to learn which process owns each connection, and keeps only the packets that belong to the process you picked. The result is a standard pcapng that Wireshark opens directly. Every packet carries a comment with the owning process id and name, so the mapping survives in the file. It reads traffic and does not modify, block or inject it. It is the first step in the netcode chapters of The Game Hacker’s Handbook: capture one game’s packets, then read them.
Free
Command-line tool for Windows x64, with WinDivert included. Extract the zip anywhere
↓ Download from GitHub View Source on GitHub
Developer
Game Reversal Club
Open Source Software

See all software from this developer

What You Get

Run procpcap from an Administrator prompt and this is what it prints. The stats line updates once a second until you press Ctrl+C. This is real output, from a capture of Firefox browsing for two and a half minutes on Windows 10. 

PS> procpcap --name firefox -o procpcap-test.pcapng
seeded 13 existing flow(s) from the connection table.
      0 pkt/s          0 B/s      27 endpoints  entropy 5.70  (15148 packets)
capture stopped. 15148 packets written.

The first line is the seeding step: 13 flows Firefox already had open when the capture began. Without it, those connections would be missed. The stats line is the last one printed, after Ctrl+C. All 15,148 packets in the file carry the comment pid 28988 firefox.exe: 11,634 IPv6 and 3,514 IPv4, to 28 addresses.

How It Works

Two WinDivert handles
A FLOW-layer handle, opened SNIFF | RECV_ONLY, reports which process owns each 5-tuple as connections open and close. A second handle sniffs IP packets at the network layer. A packet is written only when it matches a flow owned by a process you picked.
Sees connections already open
The FLOW layer only reports flows created after it starts. So procpcap seeds its flow table at startup from the Windows TCP and UDP tables, for IPv4 and IPv6. UDP has no remote in that table, so UDP is seeded on local port.
Safe under reuse
The flow table is keyed on the 5-tuple and the flow’s start time. A late close event for an old flow cannot remove a new flow that reused the same 5-tuple. The process name is the one recorded when the flow opened, so a reused process id is not mis-attributed.
A short wait for early packets
A packet can arrive before its connection is matched to a process. procpcap holds it for up to 100 ms and writes it when the match comes in. If no match comes in by then, the packet is dropped. Every packet keeps its own timestamp.
Plain pcapng
The interface block is LINKTYPE_RAW, because WinDivert delivers bare IP packets with no link-layer header. The owner goes in each packet’s comment, shown in Wireshark’s packet details pane. -w - streams the same format to stdout for wireshark -k -i -.
Entropy in the stats line
Once a second procpcap prints packets and bytes per second, distinct endpoints and mean payload entropy. High entropy means the payload is encrypted or compressed. Low entropy means there is something to read, and the Lua dissector template in examples\ is where to start.

Item Specifics

Name
procpcap
Author
Heath Howren (“Cyborg Elf”)
Version
1.0.1 (2026)
Type
Command-line tool: per-process packet capture to pcapng
Platform
Windows, x64. Captures on the local host only
License
MIT License
Price
Free
Language
C++20
Output
pcapng, LINKTYPE_RAW, with pid <n> <name> in every packet’s comment
Dependencies
WinDivert 2.2.2, used unmodified (dual LGPLv3 or GPLv2). Catch2 for the tests
Distribution
procpcap-v1.0.1-x64.zip: procpcap.exe, WinDivert.dll, WinDivert64.sys, WinDivert’s license and a Lua dissector template
Requirements
An Administrator prompt, and a WinDivert driver that Windows will load. No VC++ redistributable: the C runtime is linked statically
Tests
50 unit tests, run in CI with no driver and no Administrator. Live capture is a manual release check
Source Code
github.com/HeathHowren/procpcap

Features

Capture by process id (--pid)
Capture by name substring (--name)
Child processes with --children
Several processes in one capture
Process id and name on every packet
Open connections seeded at startup
Safe under process id reuse
Safe under 5-tuple reuse
TCP and UDP
IPv4 and IPv6
Standard pcapng output
LINKTYPE_RAW interface block
Stream to Wireshark with -w -
Live packets and bytes per second
Distinct endpoint count
Mean payload entropy
Wireshark Lua dissector template
Read-only: no modify, block or inject
WinDivert included in the zip
Static C runtime
50 unit tests, run in CI

Before You Download

Intended use. procpcap is a diagnostic capture tool for your own machine and your own traffic: your own programs, single-player games, and the Handbook’s lab targets. It only reads packets. It does not modify, block or inject them. Capturing traffic you are not authorized to see may be illegal where you live. This is a research tool.

Administrator is required. WinDivert loads a kernel driver, which needs an elevated prompt. procpcap says so and exits if it is not elevated. WinDivert.dll and WinDivert64.sys must sit next to procpcap.exe. The release zip puts them there.

The WinDivert driver can be blocked. WinDivert64.sys is a signed but third-party driver. Antivirus software flags it often. Windows can refuse to load it when Memory Integrity (HVCI) or Smart App Control is on. If the driver will not load, procpcap reports the error. You may have to allow the driver in your security software, or turn those features off, to use it. procpcap.exe itself is unsigned. Build it from source if you would rather not take a binary on trust.

What it does not do. It does not reassemble TCP streams; that is Wireshark’s job once the file is open. It captures on the local host only. Packets are written in the order procpcap attributes them, not strictly in time order. In the Firefox capture above, the largest step back was 25 ms. Run Wireshark’s reordercap on the file if a tool needs it sorted.