Process Monitor (procmon) does not show some UDP / TCP network activity events, shown in Network Monitor

Question

I observe sometimes a difference between Process Monitor and Network Monitor. Process Monitor does not show some UDP / TCP network events.

Here is an example:

net use * \\test12345.domain.local\test

shows in Netmon as:

shows in Process Monitor:

Why is the NetBIOS nameservice (:137) communication is missing in Process Monitor?

(I've tested it on several virtual and physical Windows PCs, like Windows Server 2008 R2, Windows 7, and Windows Server 2008.)

Solution 1

System is deactivated by the default filter (exclude system events). Delete the filter and these events will show up.

Solution 2

Shot in the dark: Use psexec to run Process Monitor as localsystem.

Comments

[Justin Dearing]

I would ask on the sysinternals forum and for more clues, there is a fork of Wireshark that associates packets with process, if netmon doesn't. It might be that the 137 network traffic happens at the kernel level from a Localsystem level access.

[Peter Mortensen]

What is "localsystem"? A Windows user account? Or something else? Can you add a reference?