Find URL that a process, application or script is requesting

Posted on


I can see the established network connection a program creates with TCPview, netstat or Resource Monitor but I’m trying to see the URL a program initially reaches out to.

For instance, this URL will download Flash:

But will establish a connection like this in TCPview:

wscript.exe 2472    TCP  3361 http    ESTABLISHED 1   255 4,201   15,261,332      2,604,220       748

In this instance I can just open the VBscript and see the URL, but with someone else’s application I can see only the established connection that results, not the HTTP address.

While this could probably be done with something like a packet sniffer, that seems a bit extreme for my needs. Does anyone know of any utilities or trick to get at the requested http address an application sends out?


Try netstat maybe:

netstat -abf 5 > activity.txt

let it capture a couple of minutes then read the text file

for packet sniffers otherwise, maybe fiddler (free packet sniffer but handy) might help you – you could of course install wireshark as well.

Leave a Reply

Your email address will not be published. Required fields are marked *