Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an application which communicates with some server. I want to know what the IP of this server is. How can I capture all the traffic from a specific application and not just all the traffic like Wireshark does?

share|improve this question
    
What operating system are you using? How much do you know about the application? Do you know if it uses specific ports? –  James Polley Dec 28 '09 at 10:41
    
Windows Server 2008 R2/Windows 7 I don't know anything about port numbers. It is IP (TCP/UDP) traffic. –  melco-man Dec 28 '09 at 10:44
1  
So, to clarify. You want to see the Process ID at least. But something like netstat -aon won't do it because you want to see for unsuccessful connection attempts too. (I don't know of anything, and you'll be lucky if somebody does, but can you clarify that is what you want?) –  barlop Dec 25 '12 at 23:28
    
Would you know where the application will attempt to connect to? I am thinking you could use wireshark and use filters to drill down to destination host/IP? –  emtunc Mar 9 '13 at 12:47
    
Also, depending on the type of application it is, you could force it to go through a proxy and use something like fiddler to capture the traffic of that application. Never tried it but can't see why it would not work. It may be as simple as changing IE proxy settings to fiddler proxy (port 8888 by default) or as difficult as re-compiling the app to use the proxy or somehow forcing the app to use the proxy - I am sure there are apps out there that can do that. –  emtunc Mar 9 '13 at 12:58
show 1 more comment

3 Answers

Microsoft Network Monitor might allow you to say "capture only packets sent to and from this application".

share|improve this answer
add comment

On windows, TCPView should do what you need: it can show you all the TCP and UDP connections that a particular program has open.

However, I think this is only going to be helpful if the program is opening a connection and leaving it open; they're not going to show you all network traffic by a particular program. It's possible, for instance, that it makes a very brief phone-home call as it loads, but the connection is gone by the time you run TCPView.

Process Monitor may help with getting more detail, but I haven't used it so I'm not sure how much it captures about network sockets.

share|improve this answer
1  
TCPView will only help with established connections. I need to see even unsuccessful TCP connection attempts. –  melco-man Dec 28 '09 at 10:59
    
In that case, I'm out of ideas. Probably worth adding that to the question though. –  James Polley Dec 28 '09 at 11:23
add comment

The easiest one to use is Fiddler 2. It is a debugger that allows you to view HTTP,HTTPS and FTP (both if configured) requests with any application on your PC.

After you install it, to target a specific application simply click and hold the menu item "Any Process" then drag the cursor to the open window and release it. It will only show that targeted application until you right-click on the menu item that now reads the targeted process in red text to release it.

http://fiddler2.com/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.