Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a program which I think makes a connection through the internet, but I'm not sure. How can I see what it's connecting to and what kind of data it is sending and receiving?

share|improve this question

5 Answers 5

Windows 7 Resource Monitor can tell you if a program connects to the internet, but in order to find out what data it's sending or receiving, you will need to use something like Wireshark, as Pulse said.

Resource Monitor

To open Resource Monitor, either enter it in Start Menu search or go to Task Manager>Performance Tab. Resource Monitor has multiple tabs, i.e. Overview, CPU, Memory, Disk and Network. You need the Network tab.

share|improve this answer

The only way you will be able to see information related to the data being sent and received, would be by using a protocol analyser such as Wireshark However, if the data is encrypted you'll not get a great deal of information.

If you simply wish to establish if a connection is being made, then this information should be available in your firewall logs. Alternatively, you could use something like currports which is easy to use, graphical network monitor.

If you don't wish to download another utility, open a command prompt and type netstat -abno and look through the data for the executable you think may be connecting.

share|improve this answer

I use Tcpview from sysinternals.com (don't need to install it, only execute).

It is a very simple way to see all connections and which programs are using it.

It does not show the kind of data is sent, but you can have some idea using ProcessExplorer, also from sysinternals.com, seeing the thread properties (in bottom panel, enabled pressing button with "engine" icon).

share|improve this answer

TCP View is a Microsoft utility which will show all connections active on your system, including the application which owns the connection, the port, and the remote endpoint. Listening sockets are listed also.

share|improve this answer

I generally use netstat -abn in a command prompt window. Using -b requires elevated permissions and is not optional in your case. It is what results in the executable's name being added to the output.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.