8

I have an application which is a windows service. It accesses a number of other services using TCP/IP. E.g. sql server databases, informix databases, mail servers, etc.

For instance it will also access multiple SQL server instances on different servers.

In the course of a day if I want to log all of the different services it has connected to how would I do that?

If I use TCPView I can see all the information I want, e.g. remote address, port, but it is a real time view, so the data is not saved.

Improve this question

4 Answers 4

Reset to default
8

Process Monitor will do exactly what you are looking for

enter image description here

Once you have your filters set up be sure you to go to File->Backing Files... and choose a file to save the logs to, otherwise it will start deleting old logs once it runs out of virtual memory or close the program.

Be sure to restart the program once you set a new backing source, the change does not take affect till you close and reopen the program!

Improve this answer
1
  • I've been using process monitor, but had no idea it could do network stuff too. Exactly what I was after.
    – peter
    Jul 22, 2013 at 1:31
5

I think Wireshark would do exactly what you want.

You can use its powerful filters to choose only tcp traffic from certain ports or ip. In short you can let it run and collect only the data that is important to you. You can see packet-level communication for everything that goes through your network adapter.

Improve this answer
0
3

If you are running Windows, you can setup scheduled job which runs script:

netstat -t > C:\your_output_path

your_output_path file can contain variable %time% and %date% so that every time script runs it outputs data to a file with time and date in its name.

If you install tool like UnixUtils you will be able to use grep and gawk command to filter out records which you do not need and leave only desirable once. For example, to get PostgreSQL connection you would do

netstat -t | grep 5432

Run this script as frequent as you want and you will have bunch of files with running record of your connection during the time.

Improve this answer
1
  • Netstat -t shows TCP sessions, but does not let you know what local process "owns" the session (has the socket open). You can use -o to display the PID, but that alone doesn't help much, as netstat itself won't map the PID to a human-readable process name, and the PIDs get recycled... Also consider using -n to skip reverse DNS resolutions while listing. Since Windows 7, there's a standard Windows utility called "resmon.exe" , which provides a current snapshot of TCP sessions, including a human name of the process that owns the TCP session. But it's a GUI-only util and cannot log into a file.
    – frr
    Aug 27, 2019 at 7:29
0

I've just noticed an older SysInternals util called TCPview which apparently is accompanied by a console version... like a netstat for TCP on steroids.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .