Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Snooping on winsock calls

Posted on 1998-04-04
1
Medium Priority
?
339 Views
Last Modified: 2013-12-03
I want to intercept another application's calls to various winsock functions.  Specifically I want to know what is being communicated between the client and server.  So ideally I'd like to be able to see the parameters to the send and receive functions for a given application.  It is important to note I did not write the application I want to snoop on.  It is a win32 program.  But I need to learn how it communicates so my app can be compatible.  I have no idea how to do this.  Any ideas?

A program able to do this would be just as helpful.  but so far the only program I can find to do this is TracePlus95.  I do not have a spare $150.
0
Comment
Question by:LukeSkywalker
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 4

Accepted Solution

by:
tflai earned 400 total points
ID: 1412536
There are several ways that can be done to intersect TCP/UDP communication:
1.  DLL replacement on WINSOCK32.DLL.  Easy but may not be a safe way to do it:  http://www.macam98.ac.il/vmis/wspy.htm
2.  DLL injection technique using Win32 Debugger mechanism.  Take a look at the product provided at:  http://www.win-tech.com/toolkit.htm
3.  Hook MSTCP at VxD level using TDI-client interface.  There is an example provided in VToolsD called HOOKTDI:  http://www.vireo.com
4.  Write a network snooper using a promiscuous NDIS protocol driver that binds to all the adapters.  Difficult as you have to filter out all the different packet headers, DIX, 802.3, etc.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have ever found yourself doing a repetitive action with the mouse and keyboard, and if you have even a little programming experience, there is a good chance that you can use a text editor to whip together a sort of macro to automate the proce…
zlib is a free compression library (a DLL) on which the popular gzip utility is built.  In this article, we'll see how to use the zlib functions to compress and decompress data in memory; that is, without needing to use a temporary file.  We'll be c…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question