Click here to Skip to main content
15,891,951 members
Articles / Desktop Programming / Windows Forms

NDIS MONITOR .NET 32-bit v1.00

Rate me:
Please Sign up or sign in to vote.
4.81/5 (36 votes)
27 Apr 20078 min read 176.3K   9.9K   90  
NDIS Monitor allows to catch and log the exchange of packet data between NDIS miniport drivers and network protocol modules that occurs in kernel space.
using System;
using NdisMonitor;

class UserHook
{
	//
	// Called when a new packet arrives.
	//
	public bool ProcessNextPacket( ProcessNextPacketFn impl, LogFn log, RawPacket rp, NdisHookStubs.NEXT_PACKET np, int ord, DateTime tm )
	{
		//
		// Call the extension implementation.
		//
		// Here you can setup a filter for the new packets, for example. You can discard the
		// packets in which you are not interested, according to the source or destination
		// port, the IP protocol etc. etc. These are few examples:
		//
		// === EXAMPLE # 1 ===
		//   if ( rp is EthernetPacket && ((EthernetPacket)rp)._tranHeader is TranProt_TCP )
		//   {
		//     TranProt_TCP		tcp = (TranProt_TCP) ((EthernetPacket)rp)._tranHeader;
		//     if ( tcp._srcPort == 80 && np._bDirection == 0 /*RECV*/ )
		//       return impl( rp, np, ord, tm );
		//   }
		//   return false;
		//
		return impl( rp, np, ord, tm );
	}

	//
	// Called when the user enters a command in the output window.
	//
	public bool UserCommand( UserCommandFn impl, LogFn log, string s )
	{
		//
		// Call the extension implementation.
		// Here you can filter/manipulate/discard the string of the command entered.
		//
		return impl( s );
	}
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


Written By
Web Developer
Italy Italy
Vito is a former videogame programmer. Now, Vito is the founder and CEO of VPC Technologies, a company that specializes in online services. VPC Technologies also provides consulting, developing and training services to several italian companies and government agencies in the field of kernel, component, enterprise and tridimensional software, for the Microsoft Windows platform.

Vito has attended as a speaker several italian conferences and events on development and security, such as the Microsoft Security Roadshow 2006.

Vito is the man behind GoToTerminal, a secure, reliable and innovative web technology to control remote Microsoft Windows, Telnet and VNC servers over the internet. He is also the author of BugChecker, an independent research project to create the only clone of SoftICE to date, NDIS Monitor, MapGen and Image Downloader.

For more information, you can visit Vito Plantamura's technical website at www.VitoPlantamura.com.

Comments and Discussions