I know that there are plenty of applications to do this (like procexplorer) but is there anyway to access the winapi (what method/reference is used) to retrieve the network traffic (TCP, UDP, etc) per application or process?
3 Answers
From your comments, I gather you are trying to capture the network traffic generated by the application you are developing from within the application itself. If so, I think this may be a question better suited to StackOverflow since that is a developer community. Such introspection would probably require the use of ETW (Event Tracing for Windows), but again I can't be certain. This question on S.O. may be of some help.
Putting that aside for one moment and focussing on the admin side of things (which is what you tend to get if you ask questions here), I would like to turn your attention to the netsh trace
command and Microsoft Network Monitor (Netmon). You can capture directly from NetMon at the time you want to do it, or you can give yourself more flexibility with the netsh trace command by triggering it automatically.
If this is of interest, you can do:
netsh trace start capture=yes traceFile=c:\tracefolder\tracename.etl
to start a capture, and then:
netsh trace stop
when you are ready. There are other options, so you can see the manual using netsh trace /?
Once you have your capture by whatever means, you can then use NetMon to filter on the executable of your application to examine the network traffic generated by it during the period you were monitoring.
Not sure about winapi but "Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions."
-
Thanks, but I am looking to integrate the data into my application. I am trying to find a solution via programatically. I know there has to be a reference in the winapi somewhere. Jul 12, 2013 at 3:15
You can use libpcap
. Libpcap is an open source library that provides a high level interface to network packet capture system.
The Libpcap API is designed to be used from C
and C++
, however there are many wrappers that allow its use from languages like Perl
,Python
, Java
, C#
, Ruby
.
Libpcap run on most Unix-like operating systems, there also a Windows version named Winpcap (Win
dows P
acket Cap
ture).
See the documentation of Winpcap.
Update
Sadly a network sniffing tool works at the lowest level of the net stack, trying to catch everything, it's completely unaware of processes running on the OS. It'd be extremely difficult to find out what's originated a certain call. A packet sniffer could eventually figure out (via the port number) a process ID.
These circumstances what can be done using pcap?
In the event that we only want to sniff specific traffic (e.g.: only TCP/IP
packets, only packets going to port 23
, etc) we must create a rule set, compile
it, and apply it.
This is a three phase process, all of which is closely related.
The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)
The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.
Update 2
The first thing to understand is the general layout of a pcap sniffer. The flow of code is as follows:
We begin by determining which interface we want to sniff on. In Linux this may be something like
eth0
, in BSD it may bexl1
, etc. We can either define this device in a string, or we can ask pcap to provide us with the name of an interface that will do the job.Initialize pcap. This is where we actually tell pcap what device we are sniffing on. We can, if we want to, sniff on multiple devices. How do we differentiate between them? Using file handles. Just like opening a file for reading or writing, we must name our sniffing
session
so we can tell it apart from other such sessions.In the event that we only want to sniff specific traffic (eg.: only TCP/IP packets, only packets going to port 23, etc) we must create a rule set, "compile" it, and apply it. This is a three phase process, all of which is closely related. The rule set is kept in a string, and is converted into a format that pcap can read (hence compiling it.)
The compilation is actually just done by calling a function within our program; it does not involve the use of an external application. Then we tell pcap to apply it to whichever session we wish for it to filter.
Finally, we tell pcap to enter it's primary execution loop. In this state, pcap waits until it has received however many packets we want it to. Every time it gets a new packet in, it calls another function that we have already defined.
The function that it calls can do anything we want; it can dissect the packet and print it to the user, it can save it in a file, or it can do nothing at all.
After our sniffing needs are satisfied, we close our session and are complete.
-
-
What function must be called within the program? Is there any documentation that has this on pcap? Jul 17, 2013 at 16:31