By this I do not mean that it opens multiple connections. I am more interested in how it monitors the browser's activity and recognizes when a file is available for download (a music file, or a video, or whatever).
Is this something that it adds to the browser? Is it somehow scanning all traffic that is going to the PC? Is it acting as a kind of proxy?
There are basically two mechanisms, which depend on whether the IDM-like product installs itself in the operating system or only inside the browser.
In the case where it installs as a full-fledged product through the operating system, then in Windows for example it sets system-wide hooks, the same mechanism that is used by firewalls and anti-virus products, for monitoring network activity from the Internet. For Windows this is described as :
A hook is a mechanism by which an application can intercept events, such as messages, mouse actions, and keystrokes. A function that intercepts a particular type of event is known as a hook procedure. A hook procedure can act on each event it receives, and then modify or discard the event.
In the case that it is installed only in the browser, it uses the same mechanism as used by Greasemonkey for doing Javascript Injection. This requires an add-on/plugin to be installed into the browser, that will scan incoming HTML for downloadable items, and either list them on the side (normally on the browser's status bar), or modify the HTML itself to include a "Download" button near the downloadable element.
