Click here to Skip to main content
15,867,568 members
Articles / Desktop Programming / MFC
Article

EnetstatX

Rate me:
Please Sign up or sign in to vote.
4.42/5 (26 votes)
9 Jun 20041 min read 116.9K   4K   41   34
Enhance netstat and packet filtering.

Sample Image - EnetstatX_img.jpg

Introduction

This article represents an update to my previous one "Enhance netstat". What's new regarding EnetstatX? It has packet filtering capabilities, sniffing using raw sock (disabled from menu, but could be enabled and extended by developers) and pop-up taskbar notifier concerning incoming and outgoing connections.

Description

What it does and base functionalities?

We have three base functionalities:

  • TCP connection manager
  • UDP connection manager
  • Packet filtering
  • Packet sniffing

How it does it?

  • TCP & UDP connection manager is using the following APIs:
     // Gets extended TCP Connection/UDP Listener Table //
     // ! Note -> imported function from iphlpapi.dll          //
    typedef DWORD (WINAPI *pAllocateAndGetTcpExTableFromStack)(
         IN OUT PMIB_TCPTABLE_EX *pTcpTableEx, 
         IN BOOL,
         IN HANDLE,
         IN DWORD, 
         IN DWORD);
    
    typedef DWORD (WINAPI *pAllocateAndGetUdpExTableFromStack) (
         IN OUT PMIB_UDPTABLE_EX *pUdpTableEx , 
         IN BOOL,
         IN HANDLE,
         IN DWORD,
         IN DWORD);
    
    class content: CTCPTable and CUDPClass
    
  • Packet filtering is using the following APIs (iphlpapi.lib):
             PfCreateInterface
             PfAddFiltersToInterface
             PfBindInterfaceToIPAddress
             PfUnBindInterface
             PfRemoveFiltersFromInterface
             PfDeleteInterface
    
             class content: CFilter
  • Packet sniffing is using raw socket capabilities:
             // Create a raw socket 
             socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    
             // Set sock option
             setsockopt( 
                  m_hSniffSocket, 
                  SOL_SOCKET,
                  SO_RCVTIMEO,
                  (const char *)&rcvtimeo,
                  sizeof(rcvtimeo))
    
             class content: CFilter

How to use it?

Hmmm ... Run it, and there will be no problem. The graphical interface is intuitive, I hope ;).

Note: WinXP supported only.

Conclusion

In the final step, I would like to tell you guys that maybe there will be an update to this article regarding design part. I didn't have much time to do it, but if one of you are interested to cooperate or to continue this project, I can give you some ideas, and if necessary all my support. What more can be done? I was thinking that it could be nice to have a "passive OS fingerprinting" module that can detect the OS of connected computers. Another module can be to focus on "report and statistics" with compare capabilities and "what's new about my connection activities" ...

Enjoy!

y0d4

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


Written By
Web Developer
Romania Romania
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions

 
QuestionAlways 87!!! Pin
eRRaTuM16-Mar-08 4:33
eRRaTuM16-Mar-08 4:33 
AnswerRe: Always 87!!! Pin
eRRaTuM16-Mar-08 7:15
eRRaTuM16-Mar-08 7:15 
GeneralPacket capture Pin
Jan Stetka16-May-07 0:29
Jan Stetka16-May-07 0:29 
GeneralCompilation of project onVS 2005 Pin
chigo5814-Apr-06 5:02
chigo5814-Apr-06 5:02 
GeneralRe: Compilation of project onVS 2005 Pin
chigo5814-Apr-06 5:08
chigo5814-Apr-06 5:08 
QuestionHow to block and allow the packets so it can act as a firewall Pin
saravananvv9-Jun-05 2:57
saravananvv9-Jun-05 2:57 
QuestionHow to list process and port on window98? Pin
dungbkhn16-May-05 15:57
dungbkhn16-May-05 15:57 
AnswerRe: How to list process and port on window98? Pin
y0da17-May-05 19:56
y0da17-May-05 19:56 
GeneralRe: How to list process and port on window98? Pin
dungbkhn18-May-05 4:57
dungbkhn18-May-05 4:57 
Generalsniff grayed Pin
Friedhelm Schuetz11-May-05 22:48
Friedhelm Schuetz11-May-05 22:48 
GeneralRe: sniff grayed Pin
y0da11-May-05 23:18
y0da11-May-05 23:18 
Hi,
You can activate it only programmatically. This feature is not released because is not working properly and hence it uses raw sock which is not supported by default in xp sp2.
It was left as an open feature.

"A pint of sweat, saves a gallon of blood."
- General George S. Patton (1885-1945)
Generalconnection status Pin
Anonymous21-Apr-05 16:50
Anonymous21-Apr-05 16:50 
Generaladding full path Pin
Member 39200425-Jan-05 19:39
Member 39200425-Jan-05 19:39 
QuestionHow to do this work on Win98 Pin
Anonymous27-Dec-04 16:01
Anonymous27-Dec-04 16:01 
GeneralNo path /res in source Pin
NielsR15-Sep-04 4:22
NielsR15-Sep-04 4:22 
GeneralRe: No path /res in source Pin
y0da15-Sep-04 5:05
y0da15-Sep-04 5:05 
Generalrunning EnestatX on Win2000 Pin
y0da13-Jun-04 21:30
y0da13-Jun-04 21:30 
GeneralRe: running EnestatX on Win2000 Pin
TaknuMone14-Jun-04 2:21
TaknuMone14-Jun-04 2:21 
GeneralRe: running EnestatX on Win2000 Pin
Member 39528514-Jun-04 10:19
Member 39528514-Jun-04 10:19 
GeneralRe: running EnestatX on Win2000 Pin
NielsR15-Sep-04 7:15
NielsR15-Sep-04 7:15 
GeneralRe: running EnestatX on Win2000 Pin
zcy_beijing30-Jun-05 18:12
zcy_beijing30-Jun-05 18:12 
GeneralRe: running EnestatX on Win2000 Pin
silencew5-Jul-05 8:09
silencew5-Jul-05 8:09 
GeneralGot it to compile on w2k but... Pin
TaknuMone12-Jun-04 15:29
TaknuMone12-Jun-04 15:29 
GeneralI'm waiting to give this a 5, but... Pin
prcarp10-Jun-04 10:47
prcarp10-Jun-04 10:47 
General... partially fixed Pin
prcarp10-Jun-04 11:10
prcarp10-Jun-04 11:10 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.