a method , system , apparatus , and computer program product are presented for a dynamically locatable packet analyzer spread across a distributed network of endpoints for determining packet generating applications is provided . in particular , the analyzer determines which ports are being used by which applications in order to verify that only intended packets are being sent and received by endpoints . the analyzer also provides novice packet snooping by not requiring administrators to configure operating system specific , packet specific or port specific information . the analyzer also provides snooping per application type on endpoints , rather than packet type or port only .