2

I know that there are plenty of applications to do this (like procexplorer) but is there anyway to access the winapi (what method/reference is used) to retrieve the network traffic (TCP, UDP, etc) per application or process?

3 Answers 3

2

From your comments, I gather you are trying to capture the network traffic generated by the application you are developing from within the application itself. If so, I think this may be a question better suited to StackOverflow since that is a developer community. Such introspection would probably require the use of ETW (Event Tracing for Windows), but again I can't be certain. This question on S.O. may be of some help.

Putting that aside for one moment and focussing on the admin side of things (which is what you tend to get if you ask questions here), I would like to turn your attention to the netsh trace command and Microsoft Network Monitor (Netmon). You can capture directly from NetMon at the time you want to do it, or you can give yourself more flexibility with the netsh trace command by triggering it automatically.

If this is of interest, you can do:

netsh trace start capture=yes traceFile=c:\tracefolder\tracename.etl

to start a capture, and then:

netsh trace stop

when you are ready. There are other options, so you can see the manual using netsh trace /?

Once you have your capture by whatever means, you can then use NetMon to filter on the executable of your application to examine the network traffic generated by it during the period you were monitoring.

0

Not sure about winapi but "Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions."

1
  • Thanks, but I am looking to integrate the data into my application. I am trying to find a solution via programatically. I know there has to be a reference in the winapi somewhere.
    – xlharambe
    Jul 12, 2013 at 3:15
0

You can use libpcap. Libpcap is an open source library that provides a high level interface to network packet capture system.

The Libpcap API is designed to be used from C and C++, however there are many wrappers that allow its use from languages like Perl,Python, Java, C#, Ruby.

Libpcap run on most Unix-like operating systems, there also a Windows version named Winpcap (Windows Packet Capture).

See the documentation of Winpcap.


Update

Sadly a network sniffing tool works at the lowest level of the net stack, trying to catch everything, it's completely unaware of processes running on the OS. It'd be extremely difficult to find out what's originated a certain call. A packet sniffer could eventually figure out (via the port number) a process ID.

These circumstances what can be done using pcap?

In the event that we only want to sniff specific traffic (e.g.: only TCP/IP packets, only packets going to port 23, etc) we must create a rule set, compile it, and apply it. This is a three phase process, all of which is closely related. The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)

The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.


Update 2

The first thing to understand is the general layout of a pcap sniffer. The flow of code is as follows:

  1. We begin by determining which interface we want to sniff on. In Linux this may be something like eth0, in BSD it may be xl1, etc. We can either define this device in a string, or we can ask pcap to provide us with the name of an interface that will do the job.

  2. Initialize pcap. This is where we actually tell pcap what device we are sniffing on. We can, if we want to, sniff on multiple devices. How do we differentiate between them? Using file handles. Just like opening a file for reading or writing, we must name our sniffing session so we can tell it apart from other such sessions.

  3. In the event that we only want to sniff specific traffic (eg.: only TCP/IP packets, only packets going to port 23, etc) we must create a rule set, "compile" it, and apply it. This is a three phase process, all of which is closely related. The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)

    The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.

  4. Finally, we tell pcap to enter it's primary execution loop. In this state, pcap waits until it has received however many packets we want it to. Every time it gets a new packet in, it calls another function that we have already defined.

    The function that it calls can do anything we want; it can dissect the packet and print it to the user, it can save it in a file, or it can do nothing at all.

  5. After our sniffing needs are satisfied, we close our session and are complete.

2
  • How do I get the network traffic per application?
    – xlharambe
    Jul 14, 2013 at 20:47
  • What function must be called within the program? Is there any documentation that has this on pcap?
    – xlharambe
    Jul 17, 2013 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .