20

I'd like to capture all traffic from one particular .exe application. I tried to follow this guide with only the one application running on a windows 10 VM, but the VM was very slow and crashed a plenty of times.

Is there any other way to capture the traffic?

layton
  • 311

3 Answers3

20

You can use Fiddler. Just download and install the CA root cert and you should be good to go.

Helpful information on how to do this -

https://audministrator.wordpress.com/2016/03/21/fiddler-how-to-capture-non-web-browser-traffic/

sandyp
  • 342
4

You might start with something like TCPview to determine the source and destination IPs/ports/protocols. Then you can find and isolate the specific stream in Wireshark to look at the actual packets

https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview https://www.wireshark.org/

You shouldn't need a VM for this approach

1

Your guide is pointing to intercept traffic. I think you just need to capture the traffic, not intercepting and modifying them.

Fidder most probably will meet with your need as sandyp answered. However, it captures only HTTP, HTTPS, and FTP protocols. Just to extend Matt G's answer, If you want to capture other protocols as well, you might use more advanced sniffing tools such as Wireshark. Wireshark is a very well known tool, so you can find guides and examples very easily on the internet.

It may seem more difficult to use than using Fiddler. Wireshark captures whole network traffic ( not only application layer, but other layers too ) You need to use right IP address, protocol , packet ( whatever you need to ) for filtering. Wireshark Filtering

You can use Wireshark, just in case you need an advanced capturing.

In addition, decrypting SSL is also possible in Wireshark How to Decrypt SSL and TLS Traffic Using Wireshark