The Open Host Network Packet Process Correlator for Windows

Abstract

The Hone sensors are packet-process correlation engines that log the relationships between applications and the communications they are responsible for. Hone sensors are available for a variety of platforms including Linux, Windows, and MacOSX. Hone sensors are designed to help analysts understand the meaning of communications on a deeper level by associating the origin or destination process to the communication. They do this by tracing communications on a per-packet basis, through the kernel of the operating system to determine their ultimate source/destination on the monitored machine.