looking for good sniffer

commview may fit with you.
Advantages:
1.It can capture specific process,like qq and thunder.
2.auto save packets, save as pcap format, which can be read by wiershark and other opensoure tools based on libpcap lib.
Disadvantages:
1.commercial software
2.the cracked version i tried was unreliable,it will exit when come across with heavy traffic.

Wireshark can capture special port and ip ,but process like qq may have lots of ports,it can't capture all traffic.may be someone can solve this by customed filter :-)

NetworkMonitor which produced by windows, it's output format is private, you cannot anaylase it later. Am i wrong?


P.S Wireshark and Commview can capture packets from MAC/IP/TCP_UDP/APP packets.
If no sniffer can fit you requirment, you can write a program based on winpcap or libpcap to do it.

I hope it helps you