Print Page - anyone got idea on TCP Packet to Process Name (or PID) mapping

Title: anyone got idea on TCP Packet to Process Name (or PID) mapping
Post by: leax on June 20, 2006, 06:56 AM

hi
just wondering if anyone know how to "efficiently" map captured TCP/IP packets to their intended owner Process such as war3.exe
right now i m polling APIs thats similar to "netstat -aon" to get a list of connections and matching up the packet IP/Port to that result of netstat, but its kinda slow and depending on the polling interval, some connection just never get detected leaving some packets orphaned of its process owner

so any pros out there would plz shed on light on the topic?

thanks in advance

oh for some background info, i m doing this in vb.net under windows, using raw socket for basic packet sniffing and IPHelper "iphlpapi.dll" WIN32 API for getting netstat informations

Title: Re: anyone got idea on TCP Packet to Process Name (or PID) mapping
Post by: MyndFyre on June 20, 2006, 11:15 AM

How are you capturing packets?

Title: Re: anyone got idea on TCP Packet to Process Name (or PID) mapping
Post by: leax on June 20, 2006, 09:11 PM

System.Net.Sockets
with SocketType set to RAW

Valhalla Legends Archive

Programming => Battle.net Bot Development => Topic started by: leax on June 20, 2006, 06:56 AM