Find what URL an EXE file is sending data to

Question

How can I monitor an EXE file when it is running to see what URL it is connecting to? I assume there must be free software out there that can do this fairly easily?

Solution 1

For in depth analysis, Wireshark is your best bet as Phoshi has already mentioned. For a quick look at the URL, you can use netstat from the command line, or TCPView.

C:\Documents and Settings\Administrator>netstat -b

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    john:1969              85.65.97.58.dynamic.barak-online.net:27645
  [deluged.exe]

  TCP    john:1604              vx-in-f100.1e100.net:http  ESTABLISHED  2904
  [firefox.exe]

  TCP    john:1716              79-114-229-43:60126  ESTABLISHED        732
  [deluged.exe]

Solution 2

Try Wireshark - it's just about the best out there.

Solution 3

If you want just the "URL" part, SmartSniff is one of the easiest tools. It can be used as a generic packet sniffer too.

Comments

[ChrisF]

Any firewall that monitors outgoing traffic should tell you. Set the firewall running, then start the program. It's request should be logged and then you can find the URL.

[whitequark]

+1 didn't know about console netstat

[Glen Y.]

+1 for Wireshark as well :)