vb.net. Extracting SQL traffic from network sniffing

Hi Experts, I have taken code snippets from books and the internet and plagurised my way into running code that displays TCP network traffic in a windows form. I would like to display only the SQL traffic (layer 5) and pass it to a client via System.Net.Sockets.
Everything works, but I cannot find a way to extract just the SQL from the TCP.

For now I'd like to just display the SQL in the windows list box "lbPackets" -- Any ideas?

The example code that I have used as my base for the TCP sniffing is shown below: (taken from "Network Programming.Net with C# and VB.Net 2004, ISBN: 1-55558-315-6)

Public Sub Run()
        Control.CheckForIllegalCrossThreadCalls = False
        Dim len_receive_buf As Integer = 4096
        Dim len_send_buf As Integer = 4096
        Dim receive_buf() As Byte = New Byte(len_receive_buf) {}
        Dim send_buf() As Byte = New Byte(len_send_buf) {}
        Dim cout_receive_bytes As Integer
        Dim socket As Socket = New Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP)
        socket.Blocking = False
        Dim IPHost As IPHostEntry = Dns.GetHostEntry(Dns.GetHostName())
        socket.Bind(New IPEndPoint(IPAddress.Parse(IPHost.AddressList(0).ToString()), 0))
        socket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1)
        Dim bIN As Byte() = New Byte() {1, 0, 0, 0}
        Dim bOUT As Byte() = New Byte() {0, 0, 0, 0}
        Dim SIO_RCVALL As Integer = &H98000001
        Dim ret_code As Integer = socket.IOControl(SIO_RCVALL, bIN, bOUT)
            Dim ar As IAsyncResult = socket.BeginReceive(receive_buf, 0, len_receive_buf, SocketFlags.None, Nothing, Me)
            cout_receive_bytes = socket.EndReceive(ar)
            Receive(receive_buf, cout_receive_bytes)
    End Sub
    Public Sub Receive(ByVal buf As Byte(), ByVal len As Integer)
        If buf(9) = 6 Then
            lbPackets.Items.Add(Encoding.ASCII.GetString(buf).Replace(Chr(0), " "))
        End If
    End Sub

Open in new window

Who is Participating?
jamesspoConnect With a Mentor Author Commented:
OK - If ound the answer last night thannks to a few hours with Wireshark.

Just look for the TDS data in the TCP packet. Queries are identifed with bytes 0101 and responses 0104.

Easy.... (grrrr)
David L. HansenProgrammer AnalystCommented:
why do you want to be "sniffing a network"?????
jamesspoAuthor Commented:
I'm not trying to "sniff the network". The sample code that I have attached does that already. I'm asking "How do I extract SQL from the TCP capture"?

If it really matters to you I am trying to collect SQL on-the-fly, to determine performance characteristics and query quality, without using SQL profiling or logging.

Thanks for your interest.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.