• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 282
  • Last Modified:

Monitor Sockets

Hello,

How can I monitor ALL outing sockets from my computer,
And get:
 * what program sent the socket
 * Where to its senging
 * port of the socket
 * And The message
0
S_Warrior
Asked:
S_Warrior
1 Solution
 
Lee_NoverCommented:
0
 
ivobauerCommented:
Hi, listenning...
0
 
barbourwillCommented:
There is a windows function called GetTcpTable which gets info on all incoming and outgiong TCP connections/connection requests and open ports.
0
Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

 
S_WarriorAuthor Commented:
barbourwill:

What Unit have the GetTcpTable?
0
 
barbourwillCommented:
its not in any of the delphi units, heres some of the prototypes etc:

  const
    MIB_TCP_STATE_CLOSED = 1;
    MIB_TCP_STATE_LISTEN = 2;
    MIB_TCP_STATE_SYN_SENT = 3;
    MIB_TCP_STATE_SYN_RCVD = 4;
    MIB_TCP_STATE_ESTAB = 5;
    MIB_TCP_STATE_FIN_WAIT1 = 6;
    MIB_TCP_STATE_FIN_WAIT2 = 7;
    MIB_TCP_STATE_CLOSE_WAIT = 8;
    MIB_TCP_STATE_CLOSING = 9;
    MIB_TCP_STATE_LAST_ACK = 10;
    MIB_TCP_STATE_TIME_WAIT = 11;
    MIB_TCP_STATE_DELETE_TCB = 12;

  type
    PMIB_TCPROW=^TMIB_TCPROW;
    TMIB_TCPROW = record
      dwState : LongWord; //state of the connection
      dwLocalAddr : TLongWordBytes; //address on local computer
      dwLocalPort : TLongWordBytes; //port number on local computer
      dwRemoteAddr : TLongWordBytes; //address on remote computer
      dwRemotePort : TLongWordBytes; //port number on remote computer
    end;
    PMIB_TCPTABLE=^TMIB_TCPTABLE;
    TMIB_TCPTABLE = record
      dwNumEntries : LongWord; //number of entries in the table
      table : array[0..150] of TMIB_TCPROW; //array of TCP connections
    end;

    {api declarations}
    function GetTcpTable (pTcpTable: Pointer; var pdwSize : Longword; bOrder : LongWord): LongWord;stdcall;
    function GetTcpTable; external 'iphlpapi.dll' name 'GetTcpTable';
   
0
 
barbourwillCommented:
i'm not sure how you get to see the actual data being transmitted, you probably need to hook winsock or something.


0
 
S_WarriorAuthor Commented:
barbourwill:
what is TLongWordBytes?
0
 
pnh73Commented:
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Accept answer from barbourwill

Please leave any comments here within the next seven days.
 
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!
 
Paul (pnh73)
EE Cleanup Volunteer
0
 
MindphaserCommented:
Force accepted, PAQ & refund
(The expert never came back for further assistance)

** Mindphaser - Community Support Moderator **
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now