One of our apps is calling a third-party webservice which has recently been switched to a different URI. We need to investigate this to try and see where the old address is being used (the code/config has been modified to the new one already). Is there a quick and lightweight way of logging any outbound HTTP requests the server is making?
Its an ASP.Net application running on Windows 2008 Server with IIS 7.
Best Answer
Install http://www.winpcap.org/windump/ on the server, and run it with the following flags:
windump -w "C:\Temp\tcpdump.log" dst host {old IP address} dst port 80
You can leave the running for a day or so, then look at the log. Using -w will write out the raw packets, so that you can see exactly what is being sent (and thus, hopefully, what is sending it).
Please note that I've only used tcpdump, the program that windump is based off of, so if there are differences between them, you may have to adjust the flags. But there are a lot of tcpdump tutorials out there, to guide you in the right direction.