henrypp / simplewall

Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
GNU General Public License v3.0
6.07k stars 481 forks source link

[Feature] Show PID in packets log. #1823

Closed bashimao closed 2 months ago

bashimao commented 2 months ago

Checklist

App version

3.8.2

Problem you are trying to solve

The packets log is a great tool to understand what is going on. However, it only shows the name of the process, but not its PID. So if there are multiple processes with the same name, let's say for example svhost.exe, it is currently impossible to identify which instance of the executable made the request.

Suggested solution

Add a column PID to the packets log.

Screenshots / Drawings / Technical details

No response

henrypp commented 2 months ago

dup: #1047, #88

and where/how i can get PID? sshot-001

bashimao commented 2 months ago

@henrypp: Originally, I thought that you probably get the PID reported by the FW and then resolve it into a name. At least that would have sounded logical to me.

Now that I looked at the API, I see your problem. Beside the appId field in the FWPM_NET_EVENT_HEADERx there is not much. And that one seems to point to the name of the executable.

As said, I am surprised the API is constructed like this. Boggles me. Still, being able to tell apart processes in the log would be a super useful feature.

henrypp commented 2 months ago

Now that I looked at the API, I see your problem. Beside the appId field in the FWPM_NET_EVENT_HEADERx there is not much. And that one seems to point to the name of the executable.

only executable path, not anymore, or you give a example how to get PID from FWPM_NET_EVENT_HEADERx?