14

e.g. recent versions of TCPView has such functionality: showing bytes sent/received per TCP connection (counting starts when TCPView is launched). is it possible w/o packet sniffering? does windows provides any API for this? I haven't found such Performance Counter

how to enumerate all connections are described here

EDIT: does TDI help to receive per-socket transfer statistics? NetBIOS? any links where to dig?

Andriy Tylychko
  • 15,967
  • 6
  • 64
  • 112
  • I have this question as a favorite, I won't provide this answer, but simply a comment to guide, but have you looked at http://msdn.microsoft.com/en-us/library/aa394291%28v=vs.85%29.aspx ? – Anders Jan 17 '11 at 21:14
  • @Anders: as I got, it's system wide info, not per TCP connection, right? – Andriy Tylychko Jan 17 '11 at 22:34
  • Seems that way. Have you found anything else? – Anders Jan 23 '11 at 14:51
  • I googled and found this question because TCPView is not showing me sent/received bytes in 64 bit Win7. Several other people have reported this but no solution has ever been posted. Since you guys are elbows deep in the internals, any ideas why this could be happening? – Christian Shay Feb 01 '13 at 04:34
  • I don't find this functionality, could you show me which version is? – Tri Apr 14 '21 at 12:42

6 Answers6

7

all, I have basically fully reverse tcpview 3.0.2 and implement the same feature as its according to what I have learnt.

tcpview use ETW for monitoring network activity.

The key APIs are StartTrace, OpenTrace, ProcessTrace.

Use the KERNEL_LOGGER_NAME and enable EVENT_TRACE_FLAG_NETWORK_TCPIP flags.

Then you can retrieve network activity data from EventCallback, then parse it as TcpIp_TypeGroup1 and other structures. According to the document, these structures are only supported from vista. However you can call and use it in xp(guess from reverse) and 2003(My environment is 2003, no test on xp). Certainly you have to define all these structures by yourself.

From vista, win provides some APIs for retrieving every connections statistic information. Such as GetPerTcpConnectionEStats, GetPerUdpConnectionEStats, you can get more details from MSDN.

Also, from vista, you can use RAW Socket to finish the same work(more precise I think). Before vista, RAW Socket can't retrieve SEND packets, it's a pity.

xjdrew
  • 373
  • 4
  • 13
4

I want to implement this function also, so I reverse tcpview 3.0.2.

I found, tcpview use a WMI performance counter MSNT_TcpIpInformation.

But MSNT_TcpIpInformation is not supported in xp and 2003 officially.

here is the description, you can reference to. http://www.scriptinternals.com/new/us/support/Internal/WMI_MSNT_TcpIpInformation.htm

by the way, MSNT_TcpIpInformation have no information about packets, so tcpview just increment sent and revd packets everytime. here is the disassemble:

CPU Disasm
Address   Hex dump          Command                                           Comments
0040B41B  |.  83E8 02       SUB EAX,2                                         ; Switch (cases 2..3, 3 exits)
0040B41E  |.  74 29         JE SHORT 0040B449
0040B420  |.  83E8 01       SUB EAX,1
0040B423  |.  75 40         JNE SHORT 0040B465
0040B425  |.  8B57 1C       MOV EDX,DWORD PTR DS:[EDI+1C]                     ; Case 3 of switch Tcpview.40B41B
0040B428  |.  0196 90060000 ADD DWORD PTR DS:[ESI+690],EDX
0040B42E  |.  119E 94060000 ADC DWORD PTR DS:[ESI+694],EBX
0040B434  |.  8386 C0060000 ADD DWORD PTR DS:[ESI+6C0],1
0040B43B  |.  119E C4060000 ADC DWORD PTR DS:[ESI+6C4],EBX
0040B441  |.  5E            POP ESI
0040B442  |.  5F            POP EDI
0040B443  |.  5D            POP EBP
0040B444  |.  5B            POP EBX
0040B445  |.  83C4 3C       ADD ESP,3C
0040B448  |.  C3            RETN
0040B449  |>  8B47 1C       MOV EAX,DWORD PTR DS:[EDI+1C]                     ; Case 2 of switch Tcpview.40B41B
0040B44C  |.  0186 78060000 ADD DWORD PTR DS:[ESI+678],EAX
0040B452  |.  119E 7C060000 ADC DWORD PTR DS:[ESI+67C],EBX
0040B458  |.  8386 A8060000 ADD DWORD PTR DS:[ESI+6A8],1
0040B45F  |.  119E AC060000 ADC DWORD PTR DS:[ESI+6AC],EBX
0040B465  |>  5E            POP ESI                                           ; Default case of switch Tcpview.40B41B
0040B466  |.  5F            POP EDI
xjdrew
  • 373
  • 4
  • 13
  • 1
    interesting. "is not supported in xp and 2003 officially". but it's supported, right? what about vista/w7? – Andriy Tylychko Jan 26 '11 at 12:29
  • from vista, windows provides some APIs for get every connections statistics. such as GetPerTcpConnectionEStats, GetUdpTcpConnectionEStats, you can get more information from MSDN. – xjdrew Jan 28 '11 at 08:36
  • @xjdrew: There is no ``GetPerUdpConnectionEStats()`` as far as I can tell. See also: https://stackoverflow.com/q/49588029/385513 – u17 Mar 31 '18 at 16:36
3

Check the WinSock LSP Sample project at http://connect.microsoft.com/WNDP/Downloads

You will find a sample in nonifslsp\sockinfo.cpp which "illustrates how to develop a layered service provider that is capable of counting all bytes transmitted through a TCP/IP socket."

Maxim Gueivandov
  • 2,370
  • 1
  • 20
  • 33
2

The sysinternals version of netstat (netstatp) does this. IIRC, it uses SNMP to gather its info. Search the net and find a version you're comfortable with. The file names are netstatp.c and netstatp.h
Sysinternals no longer publishes netstatp that I am aware of.

You can also go here and get tcpview and/or tcpconv one of which is available in source form.

JimR
  • 15,513
  • 2
  • 20
  • 26
  • +1. tnx for the info. I didn't find any code related with per-connection bytes sent/received in [netstatp.c](http://www.google.com/url?sa=t&source=web&cd=2&ved=0CBcQFjAB&url=http%3A%2F%2Fsource.sphene.net%2Fsvn%2Fgoim%2Ftrunk%2Fnet.sphene.goim.netstat%2Fnative%2Fsrc%2Fnetstatp.c&ei=y9Q0TeiiCMaeOsK1vLcC&usg=AFQjCNEY07vDNoSm8XcEgwxmvjOHlxZoaQ&sig2=ywN__2eZr7fkMxh_Df0vKw). tcpview is not available in source, and tcpconv doesn't provide such functionality. any additional info what to dig in SNMP? – Andriy Tylychko Jan 18 '11 at 00:16
  • @robin hood:Sorry, I cannot find the old code that sysinternals used to publish. The next time I go to my physical office I'll look to see if it's there. I know you can get the info from SNMP, but I do not know the OIDs. – JimR Jan 18 '11 at 01:41
1

Have a look at the source code for BitMeterOS, it works on xp+. you many also want to look at TCPDump/Libpcap as well. both of these monitor network network traffic, libpcap will probably be what your after though

there is also Winpcap, a more windows orientated 'version', a simple tutorial on network traffic stats can be found here, you'll also be interested in this for filtering based on connection and this for the size of the raw packets.

Necrolis
  • 25,836
  • 3
  • 63
  • 101
  • checked BitMetereOS, looks like its system-wide statistics, not per socket/connection. Winpcap: as I remember it doesn't capture loopback traffic. Pls correct me – Andriy Tylychko Jan 26 '11 at 12:28
  • @Andy T: according to the FAQ, it doesn't, but thats a windows problem: http://www.winpcap.org/misc/faq.htm however, wireshark, which uses winpcap, has a method on how to do it: http://wiki.wireshark.org/CaptureSetup/Loopback though I'd just use a physical loop plug from work :P – Necrolis Jan 26 '11 at 12:59
0

My best bet would be hooking the "send" API calls and recording the amount sent each time. Although this really doesn't seem worth it, I'm pretty sure it would work. Good luck!

returneax
  • 709
  • 1
  • 4
  • 18
  • `SetWindowsHookEx()` can't hook `send()` – Brian Nixon Jan 25 '11 at 01:50
  • Ah yea, I spoke too soon, sorry. Anyway, maybe you would have to look at kernel-mode code as that's where all send()'s end up.. just a thought. – returneax Jan 26 '11 at 06:50
  • No, you shouldn't need to get your hands dirty in the kernel: you can hook `send()` using a layered protocol as a service provider within Windows Sockets, as Maxim's answer referred to. – Brian Nixon Jan 26 '11 at 21:36