Track if connection to certain URL gets established on Windows

Posted on

QUESTION :

I found with the analysis tool fiddler that a program establishes sometimes a connection to an extern server. Now, the goal is to track continuously in the background if there is a connection established to this certain URL and possible make actions (like writing a log) afterwards. Is that possible with tools already on board in Windows 8.1/10, or do I need additional tools?

ANSWER :

I would do it using Wireshark. Get the IP of the URL you want to monitor and filter for that, and have Wireshark log only packets pertaining specifically to that IP addy:

  1. Set a Capture Filter for the scan: host 172.18.5.4 #replace IP with your target.
  2. Dump your capture data to a file with the dumpcap command.
  3. Set Wireshark (or better yet, its command-line counterpart, TShark) to run as a Windows Service (if that method is outdated, try doing this instead).

Leave a Reply

Your email address will not be published. Required fields are marked *