CODEWITHSUNDEEP
windowswinapi
Konrads
Konrads

Reputation: 2274

How to hook into Windows network events

I would like to hook into certain windows network events, such as new incoming and outgoing connections.

What are the options? wmic, windows API?

Upvotes: 3

Views: 3424

Answers (3)

Mohammad Nikravan
Mohammad Nikravan

Reputation: 1809

Here is some tools to filter,modify,read packet in windows:

  1. WinDivert Free open source project work on Windows 7, 2008 or upper. network layer.
  2. WinpkFilter 3.0 Commercial, Windows XP and upper. datalink layer
  3. pcausa, Commercial. datalink layer
  4. Windows Filtering Platform Packet Modification Sample A sample to create callout driver that WinDivert use, you should now to implement kernel driver. network layer.

Upvotes: 1

user2058002
user2058002

Reputation:

You could inject a DLL that hooks send() and recv() into every process. The DLL would then also hook CreateProcess to inject itself into processes created in the future.

Upvotes: 2

Casper
Casper

Reputation: 34308

You could take a look at WinPcap:
http://www.winpcap.org/

"WinPcap is an open source library for packet capture and network analysis for the Win32 platforms."
http://www.winpcap.org/docs/docs_412/html/main.html

This is the library that programs like Wireshark uses to do all it's capturing with. http://www.winpcap.org/misc/features.htm

Upvotes: 3

Related Questions