Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know that there are plenty of applications to do this (like procexplorer) but is there anyway to access the winapi (what method/reference is used) to retrieve the network traffic (TCP, UDP, etc) per application or process?

share|improve this question

3 Answers 3

From your comments, I gather you are trying to capture the network traffic generated by the application you are developing from within the application itself. If so, I think this may be a question better suited to StackOverflow since that is a developer community. Such introspection would probably require the use of ETW (Event Tracing for Windows), but again I can't be certain. This question on S.O. may be of some help.

Putting that aside for one moment and focussing on the admin side of things (which is what you tend to get if you ask questions here), I would like to turn your attention to the netsh trace command and Microsoft Network Monitor (Netmon). You can capture directly from NetMon at the time you want to do it, or you can give yourself more flexibility with the netsh trace command by triggering it automatically.

If this is of interest, you can do:

netsh trace start capture=yes traceFile=c:\tracefolder\tracename.etl

to start a capture, and then:

netsh trace stop

when you are ready. There are other options, so you can see the manual using netsh trace /?

Once you have your capture by whatever means, you can then use NetMon to filter on the executable of your application to examine the network traffic generated by it during the period you were monitoring.

share|improve this answer

Not sure about winapi but "Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions."

share|improve this answer
    
Thanks, but I am looking to integrate the data into my application. I am trying to find a solution via programatically. I know there has to be a reference in the winapi somewhere. –  enginefree Jul 12 '13 at 3:15

You can use libpcap. Libpcap is an open source library that provides a high level interface to network packet capture system.

The Libpcap API is designed to be used from C and C++, however there are many wrappers that allow its use from languages like Perl,Python, Java, C#, Ruby.

Libpcap run on most Unix-like operating systems, there also a Windows version named Winpcap (Windows Packet Capture).

See the documentation of Winpcap.


Update

Sadly a network sniffing tool works at the lowest level of the net stack, trying to catch everything, it's completely unaware of processes running on the OS. It'd be extremely difficult to find out what's originated a certain call. A packet sniffer could eventually figure out (via the port number) a process ID.

These circumstances what can be done using pcap?

In the event that we only want to sniff specific traffic (e.g.: only TCP/IP packets, only packets going to port 23, etc) we must create a rule set, compile it, and apply it. This is a three phase process, all of which is closely related. The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)

The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.


Update 2

The first thing to understand is the general layout of a pcap sniffer. The flow of code is as follows:

  1. We begin by determining which interface we want to sniff on. In Linux this may be something like eth0, in BSD it may be xl1, etc. We can either define this device in a string, or we can ask pcap to provide us with the name of an interface that will do the job.

  2. Initialize pcap. This is where we actually tell pcap what device we are sniffing on. We can, if we want to, sniff on multiple devices. How do we differentiate between them? Using file handles. Just like opening a file for reading or writing, we must name our sniffing session so we can tell it apart from other such sessions.

  3. In the event that we only want to sniff specific traffic (eg.: only TCP/IP packets, only packets going to port 23, etc) we must create a rule set, "compile" it, and apply it. This is a three phase process, all of which is closely related. The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)

    The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.

  4. Finally, we tell pcap to enter it's primary execution loop. In this state, pcap waits until it has received however many packets we want it to. Every time it gets a new packet in, it calls another function that we have already defined.

    The function that it calls can do anything we want; it can dissect the packet and print it to the user, it can save it in a file, or it can do nothing at all.

  5. After our sniffing needs are satisfied, we close our session and are complete.

share|improve this answer
    
How do I get the network traffic per application? –  enginefree Jul 14 '13 at 20:47
    
What function must be called within the program? Is there any documentation that has this on pcap? –  enginefree Jul 17 '13 at 16:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.