How can I monitor new IPv4 connections in C#

Question

I need to monitor any new IPv4 connection made by a computer. The information I need is the process ID making the connection as well as the IP address the process is connecting to. I would need a callback function that gets called as soon as a new connection is discovered.

I have tried using ETW with Microsoft-Windows-Kernel-Network, but I only get integer representations of some daddr and saddr that I can't seem to map back to an IP address. Any help would be appreciated.

have you played a bit with TraceEvent and the Microsoft-Windows-TCPIP provider? Does it work? — magicandre1981, Jul 20 '16 at 07:46

score 3 · Accepted Answer · answered Jun 09 '16 at 14:59

You should use the Microsoft-Windows-TCPIP provider. You can use TraceEvent to create a Realtime session, and TraceEvent has a KernelSourceParser which allows you to parse for IP data

_kernelTraceEventParser = new KernelTraceEventParser(_source);
_kernelTraceEventParser.TcpIpConnect += KernelParserOnTcpIpConnect;



private void KernelParserOnTcpIpConnect(TcpIpConnectTraceData tcpIpConnectTraceData)
{
     lokalAddress = tcpIpConnectTraceData.saddr + ":" + tcpIpConnectTraceData.sport;
     serverAddress = tcpIpConnectTraceData.daddr + ":" + tcpIpConnectTraceData.dport;
}

Because TcpIpConnectTraceData is inherit from TraceEvent class you have access to ProcessName and ProcessID.

Is there any way to filter private data transfers? – Mehdi Dehghani Jun 16 '22 at 04:58 — Mehdi Dehghani, Jun 16 '22 at 04:58
I have no idea as I never tried this. – magicandre1981 Jun 16 '22 at 05:37 — magicandre1981, Jun 16 '22 at 05:37

Tomaz Stih · Answer 2 · 2016-06-09T09:02:16.177

0

The function you are seeking for is called GetTcpTable, partial implementation in C# is available here. The latter also obtains the process so it completely fulfills you requirements.

It also seems to be available without inter-op as part of newer .NET implementations.

edited Jun 09 '16 at 09:02

answered Jun 09 '16 at 08:53

Tomaz Stih

529
3
10

How can I monitor new IPv4 connections in C#

2 Answers2