WhoYouCalling is a Windows command-line tool that captures and correlates full packet capture (.pcap) files per process by monitoring network activity using Windows Event Tracing (ETW).
Records an executable's network activity into a Full Packet Capture file (.pcap) and much more.
This tool is designed for security professionals, researchers, and system administrators who need detailed network activity monitoring per process on Windows. It simplifies incident response, malware analysis, and network forensics by automatically generating filtered pcap files for each monitored process, including DNS query insights.
WhoYouCalling does not capture lower network layer protocols such as ICMP or ARP, nor does it monitor server socket/listening port activity. It complements but does not replace tools like ProcMon for file system or access right monitoring. Users should run it with appropriate permissions to access ETW and packet capture capabilities.