Question What application to use for monitoring system and network activity?

[Can't Decide]

I noticed "DoSVC" and "Crytographic Service" had internet connection on "Resource Monitor". I don't know the connection is it from Microsoft or is it safe(checked the ip on VT with no detection). And I'm unsure of what "Crytographic Service" do but I know "DoSVC" is used for Microsoft windows system update but I want to make sure the connection is safe and not used by some bad actor.

Any advise on what application do use for monitoring system and network activity that can identify the connection originate from? That keep data locally and won't send any data to the said company.
If it's firewall application, it need to be able to work well with Firewall Hardening.

 

[Bot]

I would recommend GlassWire. It's a network monitoring tool that visualizes your current and past network activity, checks the safety of your network, and allows you to block potentially harmful connections. It keeps data locally and doesn't share it. For firewall applications, ZoneAlarm Free Firewall works well with Firewall Hardening and provides an extra layer of security.

 

[kailyn]

I noticed "DoSVC" and "Crytographic Service" had internet connection on "Resource Monitor". I don't know the connection is it from Microsoft or is it safe(checked the ip on VT with no detection). And I'm unsure of what "Crytographic Service" do but I know "DoSVC" is used for Microsoft windows system update but I want to make sure the connection is safe and not used by some bad actor.

Any advise on what application do use for monitoring system and network activity that can identify the connection originate from? That keep data locally and won't send any data to the said company.
If it's firewall application, it need to be able to work well with Firewall Hardening.

Portable SysInternals TCPView, NirSoft Curr Ports, System Informer, System Explorer, NoVirusThanks Connection Viewer (trial\paid), etc.

You always have on Windows the ability to check with the following command:

netstat -ban

With PowerShell:

Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess, @{n="ProcessName";e={(Get-Process -Id $_.OwningProcess).ProcessName}}, @{n="UserName";e={(Get-Process -Id $_.OwningProcess -IncludeUserName).UserName}} | Where-Object {$_.State -eq "Established"} | Format-Table -AutoSize -Force

 

[Can't Decide]

Portable SysInternals TCPView, NirSoft Curr Ports, System Informer, System Explorer, NoVirusThanks Connection Viewer (trial\paid), etc.

You always have on Windows the ability to check with the following command:

netstat -ban

With PowerShell:

Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess, @{n="ProcessName";e={(Get-Process -Id $_.OwningProcess).ProcessName}}, @{n="UserName";e={(Get-Process -Id $_.OwningProcess -IncludeUserName).UserName}} | Where-Object {$_.State -eq "Established"} | Format-Table -AutoSize -Force

Thank you for your information.

Does SysInternals TCPView, Process Explorer and others send any data to microsoft?

 

[TairikuOkami]

View TCP/UDP network activity of every application on Windows

LiveTcpUdpWatch is a tool for Windows that displays live information about all TCP and UDP activity on your system.

www.nirsoft.net

LiveTcpUdpWatch vs CurrPorts vs NetworkTrafficView​

This tool may look very similar to other tools of NirSoft - CurrPorts and NetworkTrafficView, but every tool behave differently and uses different technique to extract the network information.

• CurrPorts displays the current table of active TCP connections and TCP/UDP listening ports. but this technique has some disadvantages, for example, if UDP packets are sent from your computer to remote network address, you won't see it with CurrPorts, because with UDP there is no really a connection and the UDP table contains only listening UDP ports. The advantage of CurrPorts is the ability to use it without elevation (Run As Administrator).
• NetworkTrafficView uses network sniffing technique - It analyzes every packet sent/received by your network card and displays extensive summary according to the display mode you choose. The disadvantages of this tool: You have to choose a network card and capture method for activating the network sniffer.
• LiveTcpUdpWatch uses event tracing API to get live information from Windows Kernel about every TCP/UDP packet sent/received on your system. As opposed to CurrPorts, it captures all UDP activity with process information, but without the need of using a network sniffer.

 

[kailyn]

Does SysInternals TCPView, Process Explorer and others send any data to microsoft?

No

 

[lokamoka820]

Wireshark.

 

[EstrellaRhodes]

I've noticed similar activity with DoSVC and Cryptographic Service on my system too. They're both legit Windows services, DoSVC handles system updates and Cryptographic Service deals with encryption and security-related operations. If you want to monitor system and network activity more closely, I'd recommend using tools like Wireshark for network analysis and Process Monitor for system monitoring. Both keep data locally and are pretty powerful. For firewall options that work well with Firewall Hardening, you might try GlassWire or SimpleWall.

 

[Can't Decide]

View TCP/UDP network activity of every application on Windows

LiveTcpUdpWatch is a tool for Windows that displays live information about all TCP and UDP activity on your system.

www.nirsoft.net

Thanks for the advise, I will take a look.

No

That's good to know, because I read their privacy policy at TCPView for Windows - Sysinternals though it put sysinternals doesn't collect any data but at same time beside it have mircosoft privacy policy... so I'm a bit confused about it.

Wireshark.

Thanks for the advise, I will take a look.

I've noticed similar activity with DoSVC and Cryptographic Service on my system too. They're both legit Windows services, DoSVC handles system updates and Cryptographic Service deals with encryption and security-related operations. If you want to monitor system and network activity more closely, I'd recommend using tools like Wireshark for network analysis and Process Monitor for system monitoring. Both keep data locally and are pretty powerful. For firewall options that work well with Firewall Hardening, you might try GlassWire or SimpleWall.

How about Portmaster or Windows Firewall Control? Does it work well with Firewal Hardening?