Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is on XP. A coworker wiped their windows install and is starting it fresh. A particular program had a custom host entry and now it doesn't work because we didn't back up the host file.. Here's the rub: we know the IP to map the name to, but we don't know the domain name. When we run the program in question, it fails with a generic message. Is there some way we can find out what host name it is trying to resolve?

share|improve this question
1  
This is exactly the kind of reason the use of the hosts file is discouraged. You should consider adding the appropriate entries to the internal DNS and eliminate this problem permanently. –  John Gardeniers Jul 18 '11 at 4:00
1  
Sounds like the program added the hosts entry, but yeah, I'd still want to move that off of there. Had a client once on a P2P network with hosts file entries for the intranet, billing, ftp site, etc. on everyone's machines! –  gravyface Jul 18 '11 at 12:49

2 Answers 2

up vote 5 down vote accepted

WireShark should capture the DNS query. You can filter by port 53 or by your DNS host, but you'll see the query for the A record that the program is requesting.

share|improve this answer

There are two Sysinternals tools that might help with this problem.

TCPView will show current network traffic:

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.

Process Monitor will show all process operations:

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

You can use TCPView to see all current connections, so when the program attempts to open the connection at issue you should be able to see it issuing DNS queries.

If that doesn't work or goes by too quickly, you can use Process Monitor (filtered to that process specifically) to see all activity by that process. An extra bonus here is that, if the process is looking up the name it's connecting to in the Registry or some configuration file, you may be able to detect it with this tool.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.