How do I change a process's socket connection

Question

A process is connecting to a certain ip or domain, but I do not know what it is. The process can't connect to the server. How do I find and change it?

Answer 1

Type netstat at the cmd prompt to see what ports are being used by active processes. Aside from that, you can't change the port being used by the proc to connect (unless you built the app obviously)

Answer 2

TCPView is a nice little utility that will show you all the open connections and endpoints on the local machine.

If the program is connecting using a DNS name (e.g., example.com), you can use the hosts file (c:\windows\system32\drivers\etc\hosts) to make that name map to a different IP address.

If you mean redirect the connection programmatically, that is a lot more complicated. You're not writing malware, are you?

Answer 3

TCPView and netstat work best for connections already established, which isn't the original poster's position.

A better tool for this task is a packet sniffer, which can observe the connection attempt. I recommend Wireshark, which is available for all major platforms.

Details:

1. Install, then start Wireshark
2. Press Ctrl-K to start capturing
3. Select the network interface that you expect the program to use
4. Type "tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn" in the Capture Filter box (no quotes)
5. Start the capture, go make your program try to connect, and then stop the capture.

If you do the last step fast enough on a machine without a lot of other network activity, you will have only one captured packet. Otherwise, you'll have to dig through a list to find the one you want. This packet will show the TCP port the program is trying to use.