Вот, бери программу и смотри.

On Windows NT and Windows 2000, simply execute the TDImon program file (TDImon.exe) and TDImon will immediately start capturing TCP/IP activity. Note that if you run TDImon on Windows NT/2000 TDImon.exe must be located on a non-network drive and you must have administrative privilege. On Windows NT and Windows 2000 TDImon will only show remote addressed for endpoints opened after it has started. However, if you purchase and install TCPView Pro from Winternals Software (www.winternals.com), the TDImon driver, which is shared between TCPView Pro and TDImon, is installed at boot time so that you see all remote addresses.