18

I have an application which communicates with some server. I want to know what the IP of this server is. How can I capture all the traffic from a specific application and not just all the traffic like Wireshark does?

7
  • What operating system are you using? How much do you know about the application? Do you know if it uses specific ports? Dec 28, 2009 at 10:41
  • Windows Server 2008 R2/Windows 7 I don't know anything about port numbers. It is IP (TCP/UDP) traffic.
    – melco-man
    Dec 28, 2009 at 10:44
  • 1
    So, to clarify. You want to see the Process ID at least. But something like netstat -aon won't do it because you want to see for unsuccessful connection attempts too. (I don't know of anything, and you'll be lucky if somebody does, but can you clarify that is what you want?)
    – barlop
    Dec 25, 2012 at 23:28
  • Would you know where the application will attempt to connect to? I am thinking you could use wireshark and use filters to drill down to destination host/IP?
    – emtunc
    Mar 9, 2013 at 12:47
  • Also, depending on the type of application it is, you could force it to go through a proxy and use something like fiddler to capture the traffic of that application. Never tried it but can't see why it would not work. It may be as simple as changing IE proxy settings to fiddler proxy (port 8888 by default) or as difficult as re-compiling the app to use the proxy or somehow forcing the app to use the proxy - I am sure there are apps out there that can do that.
    – emtunc
    Mar 9, 2013 at 12:58

6 Answers 6

10

It is possible to capture all network traffic for a given application by intercepting Windows Sockets API calls. These are the tools that may help.

  1. Proxocket written by Luigi Auriemma. It intercepts API calls and saves captured traffic as Wireshark-ready .cap file in tcpdump format. Nothing is more explanatory than an image provided by Luigi himself: Screenshot

  2. NirSoft has SocketSniff application which allows one to capture a traffic of a specific process. A picture is worth a thousand words as well: Screenshot

Sadly, mentioned tools would likely not support 64-bit applications. However it is possible to write a custom interceptor using mhook library supporting both 32-bit and 64-bit API.

4
  • 2
    +1 for NirSoft freeware tools that are incredibly good, and usually portable (single .exe) and small (< 500 KB). Very talented developer there!
    – Basj
    Feb 3, 2018 at 13:21
  • What about on Linux? Feb 21, 2020 at 8:50
  • @AaronFranke strace might help. See here: askubuntu.com/a/12465/505090
    – PF4Public
    Feb 22, 2020 at 12:17
  • +1 for Nirsoft! Great tools!
    – GTodorov
    Sep 18, 2020 at 19:15
3

The easiest one to use is Fiddler 2. It is a debugger that allows you to view HTTP,HTTPS and FTP (both if configured) requests with any application on your PC.

After you install it, to target a specific application simply click and hold the menu item "Any Process" then drag the cursor to the open window and release it. It will only show that targeted application until you right-click on the menu item that now reads the targeted process in red text to release it.

http://fiddler2.com/

1
  • 2
    How to use Fiddler for non HTTP/FTP requests?
    – Pacerier
    Jul 24, 2015 at 17:57
2

Microsoft Network Monitor might allow you to say "capture only packets sent to and from this application".

2
  • -1 for a vague and mostly guesswork answer.
    – Cylindric
    May 6, 2018 at 7:20
  • What about on Linux? Feb 21, 2020 at 8:50
1

I believe that Capsa should be able to do the things that you're looking for.

chinese free edition enter image description here

english trial editon

enter image description here

Here's an overview from their own site:

Portable Network Analyzer Freeware for Your LAN Network Capsa Free is a network analyzer freeware for Ethernet monitoring, troubleshooting and analysis. It provides users with great experience to learn how to monitor network activities, pinpoint network problems, enhance network security. Capsa Free is a special edition of Capsa Network Analyzer for students, teachers and computer geeks to learn protocols and networking technology knowledge.

It has the following relevant features:

  • Monitor your network traffic
  • Capture http,https,udp,tcp traffics and categorized by name of processes.
  • Analyse the detail information within a packet in hex format.

You could download the enterprise version with subscription.

Alternativly,you could download a permanent free version (but in chinese language).

P.S. I'm just a student major in CS,and not affiliated with the product ,and I'm sure I have followed how to recommend software in answers.I'm caucious because my answer have once been flagged as a spam(Post here).And hope this time my answer would help you.

0

On windows, TCPView should do what you need: it can show you all the TCP and UDP connections that a particular program has open.

However, I think this is only going to be helpful if the program is opening a connection and leaving it open; they're not going to show you all network traffic by a particular program. It's possible, for instance, that it makes a very brief phone-home call as it loads, but the connection is gone by the time you run TCPView.

Process Monitor may help with getting more detail, but I haven't used it so I'm not sure how much it captures about network sockets.

2
  • 4
    TCPView will only help with established connections. I need to see even unsuccessful TCP connection attempts.
    – melco-man
    Dec 28, 2009 at 10:59
  • 2
    In that case, I'm out of ideas. Probably worth adding that to the question though. Dec 28, 2009 at 11:23
0

proxifier : https://www.proxifier.com
That's good program to set up proxy for your sepcial application on windows OS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.