How to tell wireshark to only watch outgoing traffic from a specific program?

Question

linux

I run the program in WindowsXP on a virtualbox, which is on Debian. I'm running shark in debian. How to listen only to the traffic that my program generates?

Answer 1

No, if you don’t know exactly what kind of traffic it generates and on which ports.
How will wireshark distinguish it from other traffic?
Listen to the whole thing, and only then figure out who generated it.
Or ensure that only the traffic of the desired program comes from the interface, cut the rest with a firewall.

Answer 2

Not in the current version.
1. There is a very old version with PID Filter
2. You can filter by ports if you know which ones are used.
3. You can use another tool, such as Microsoft Network Monitor .

Answer 3

No way.
Only filter by port if a non-standard port is used. Or look for headers in the stream if it's something generic like 80/443