This is on XP. A coworker wiped their windows install and is starting it fresh. A particular program had a custom host entry and now it doesn't work because we didn't back up the host file.. Here's the rub: we know the IP to map the name to, but we don't know the domain name. When we run the program in question, it fails with a generic message. Is there some way we can find out what host name it is trying to resolve?
WireShark should capture the DNS query. You can filter by port 53 or by your DNS host, but you'll see the query for the A record that the program is requesting.
There are two Sysinternals tools that might help with this problem.
TCPView will show current network traffic:
Process Monitor will show all process operations:
You can use TCPView to see all current connections, so when the program attempts to open the connection at issue you should be able to see it issuing DNS queries.
If that doesn't work or goes by too quickly, you can use Process Monitor (filtered to that process specifically) to see all activity by that process. An extra bonus here is that, if the process is looking up the name it's connecting to in the Registry or some configuration file, you may be able to detect it with this tool.