How to monitor what app connects to what/where/when server? A firewall? open source, for windows 10

I have never used it, but I think windows firewall can log successful connections with application in the event log and then it's just a question of some powershell wizardry to fish out what you want.

https://serverfault.com/questions/3...-have-the-ability-to-log-which-exe-is-blocked

Something like the answer in that, but with success:enable I think.

 

Something like pfsense won't tell you what applications are connecting where.

I think you can configure windows firewall to log all traffic. Once you have that done you probably want to use something like the elastic stack to make sense of all the data.

https://www.syspanda.com/index.php/2017/10/04/collecting-sending-windows-firewall-event-logs-elk/

Or use glasswire and be like Linus
(No clue if that software actually works)

 

Wireshark has been around forever and has a Windows version. I've not used Wireshark for quite a few years but was a heavy user at one time. Of course, the downside to any monitoring tool running in the same OS as the program you wish to monitor, is if that program is deliberately trying to conceal it's network activity, there are ways to do this. Applications do not have to use the OS TCP/IP stack.

If this is the situation then an external device is what you may need. Some routers let you monitor traffic, otherwise a cheap RaspberryPi as a router/gateway monitor can be setup inexpensively.