A monitoring tool operates just before packets are sent out from a client computer. The monitoring tool identifies the destination of data being sent and determines whether the destination is a trusted site. The monitoring tool may also check the data itself. If the data is unencrypted, the tool may perform a string or binary pattern search on the data. However, if the data is encrypted the monitoring tool may check for the amount of data being sent. The monitoring tool may then warn the user or an administrator if the data being sent appears to be uncharacteristically high. The monitoring tool may also take corrective action, such as blocking the transmission or disabling the offending program. Alternatively, the monitoring tool may attempt to alter the final destination of the data to the client computer itself. If the program still works, the program may continue to operate.