I know that there are plenty of applications to do this (like procexplorer) but is there anyway to access the winapi (what method/reference is used) to retrieve the network traffic (TCP, UDP, etc) per application or process?
From your comments, I gather you are trying to capture the network traffic generated by the application you are developing from within the application itself. If so, I think this may be a question better suited to StackOverflow since that is a developer community. Such introspection would probably require the use of ETW (Event Tracing for Windows), but again I can't be certain. This question on S.O. may be of some help.
Putting that aside for one moment and focussing on the admin side of things (which is what you tend to get if you ask questions here), I would like to turn your attention to the
If this is of interest, you can do:
to start a capture, and then:
when you are ready. There are other options, so you can see the manual using
Once you have your capture by whatever means, you can then use NetMon to filter on the executable of your application to examine the network traffic generated by it during the period you were monitoring.
Not sure about winapi but "Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions."
You can use
The Libpcap API is designed to be used from
Libpcap run on most Unix-like operating systems, there also a Windows version named Winpcap (
See the documentation of Winpcap.
Sadly a network sniffing tool works at the lowest level of the net stack, trying to catch everything, it's completely unaware of processes running on the OS. It'd be extremely difficult to find out what's originated a certain call. A packet sniffer could eventually figure out (via the port number) a process ID.
These circumstances what can be done using pcap?
In the event that we only want to sniff specific traffic (e.g.: only
The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.
The first thing to understand is the general layout of a pcap sniffer. The flow of code is as follows: