Find URL that a process, application or script is requesting

I can see the established network connection a program creates with TCPview, netstat or Resource Monitor but I’m trying to see the URL a program initially reaches out to.

For instance, this URL will download Flash: http://download.macromedia.com/get/flashplayer/current/licensing/win/install_flash_player_14_active_x.exe

But will establish a connection like this in TCPview:

wscript.exe 2472    TCP myAddress.comcast.net.  3361    a23-218-85-192.deploy.static.akamaitechnologies.com http    ESTABLISHED 1   255 4,201   15,261,332      2,604,220       748

In this instance I can just open the VBscript and see the URL, but with someone else’s application I can see only the established connection that results, not the HTTP address.

While this could probably be done with something like a packet sniffer, that seems a bit extreme for my needs. Does anyone know of any utilities or trick to get at the requested http address an application sends out?

Try netstat maybe:

netstat -abf 5 > activity.txt

let it capture a couple of minutes then read the text file

for packet sniffers otherwise, maybe fiddler (free packet sniffer but handy) might help you – you could of course install wireshark as well.