TCP/IP Monitoring in .NET

[Randal]

Does anyone have a code sample of how one would "listen"
to a TCP/IP session between an application on the local
machine and a remote host.

I'm looking for code that would allow me to specify a
local IP and a local port which is already in use by
another application (outside of my control) and simply
watch the traffic.

I know there are open source packet analyzers available
that use special network drivers, use of permiscuous
network mode, etc., etc. But I'm not looking to watch
any traffic except to and from my local machine on a
known port and I am hoping that this is less complicated
and that .NET's rich netwoking classes will lend a hand.

The two biggest issues that exist are the fact that
windows sockets does not like an port/ip pair bound to
two different sockets. I can sidestep this issue by
using SetSocketOption and SocketOptionNam e.ReuseAddress,
but I have found that simply binding to the address is
not sufficient to create the desired effect.

Any help?

[Peter Huang [MSFT]]

Hi Randal,

You may try to see the SetSocketOption function.
But if the other application use the socket as SocketOptionNam e
=ExclusiveAddre ssUse
Then you can not use SetSocketOption to set your socket as
SocketOptionNam e = ReuseAddress which allows the socket to be bound to an
address that is already in use.

Did I answer your question?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Randal" <ra****@nospam. com>
Sender: "Randal" <ra****@nospam. com>
Subject: TCP/IP Monitoring in .NET
Date: Thu, 25 Sep 2003 14:38:50 -0700
Lines: 24
Message-ID: <0b************ *************** *@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcODrWig9CK3faw TTni7PrRRY/Zqww==
Newsgroups: microsoft.publi c.dotnet.genera l
Path: cpmsftngxa06.ph x.gbl
Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.genera l:109938
NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.publi c.dotnet.genera l

Does anyone have a code sample of how one would "listen"
to a TCP/IP session between an application on the local
machine and a remote host.

I'm looking for code that would allow me to specify a
local IP and a local port which is already in use by
another application (outside of my control) and simply
watch the traffic.

I know there are open source packet analyzers available
that use special network drivers, use of permiscuous
network mode, etc., etc. But I'm not looking to watch
any traffic except to and from my local machine on a
known port and I am hoping that this is less complicated
and that .NET's rich netwoking classes will lend a hand.

The two biggest issues that exist are the fact that
windows sockets does not like an port/ip pair bound to
two different sockets. I can sidestep this issue by
using SetSocketOption and SocketOptionNam e.ReuseAddress,
but I have found that simply binding to the address is
not sufficient to create the desired effect.

Any help?

[Zane Thomas [.NET/C# MVP]]

Randal,

Does anyone have a code sample of how one would "listen"
to a TCP/IP session between an application on the local
machine and a remote host.

Take a look at this: http://www.mentalis.org/soft/projects/pmon/

fyi: IIRC it's w2k and later only
--
Abderaware
Fine Components For .NET
Turn on, tune in, download.
zane a@t abderaware.com

[Randal]

Exactly what I was looking for! Thanks a million, Zane.

-----Original Message-----
Randal,

Does anyone have a code sample of how one would "listen"to a TCP/IP session between an application on the local
machine and a remote host.
Take a look at this:

http://www.mentalis.org/soft/projects/pmon/
fyi: IIRC it's w2k and later only
--
Abderaware
Fine Components For .NET
Turn on, tune in, download.
zane a@t abderaware.com
.

[Randal]

As noted in my post, I am already using SetSocketOption
with the ReuseAddress option, but I was looking for some
of the specifics of extracting the information, since the
underlying socket is already connected. The issue is
that Socket.Receive cannot be used without the new socket
being connected. I am trying to figure out the specifics
of making a "connection " to the connection that already
exists by the original application.

-----Original Message-----
Hi Randal,

You may try to see the SetSocketOption function.
But if the other application use the socket as SocketOptionNam e=ExclusiveAddr essUse
Then you can not use SetSocketOption to set your socket asSocketOptionNa me = ReuseAddress which allows the socket to be bound to anaddress that is already in use.

Did I answer your question?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
--------------------

Content-Class: urn:content-classes:message
From: "Randal" <ra****@nospam. com>
Sender: "Randal" <ra****@nospam. com>
Subject: TCP/IP Monitoring in .NET
Date: Thu, 25 Sep 2003 14:38:50 -0700
Lines: 24
Message-ID: <0b************ *************** *@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcODrWig9CK3faw TTni7PrRRY/Zqww==
Newsgroups: microsoft.publi c.dotnet.genera l
Path: cpmsftngxa06.ph x.gbl
Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.genera l:109938NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.publi c.dotnet.genera l

Does anyone have a code sample of how one would "listen"to a TCP/IP session between an application on the local
machine and a remote host.

I'm looking for code that would allow me to specify a
local IP and a local port which is already in use by
another application (outside of my control) and simply
watch the traffic.

I know there are open source packet analyzers available
that use special network drivers, use of permiscuous
network mode, etc., etc. But I'm not looking to watch
any traffic except to and from my local machine on a
known port and I am hoping that this is less complicatedand that .NET's rich netwoking classes will lend a hand.

The two biggest issues that exist are the fact that
windows sockets does not like an port/ip pair bound to
two different sockets. I can sidestep this issue by
using SetSocketOption and SocketOptionNam e.ReuseAddress,but I have found that simply binding to the address is
not sufficient to create the desired effect.

Any help?

.

[Zane Thomas [.NET/C# MVP]]

Randal,

Does anyone have a code sample of how one would "listen"
to a TCP/IP session between an application on the local
machine and a remote host.

Take a look at this: http://www.mentalis.org/soft/projects/pmon/

fyi: IIRC it's w2k and later only
--
Abderaware
Fine Components For .NET
Turn on, tune in, download.
zane a@t abderaware.com

[Peter Huang [MSFT]]

Hi Randal,

You may try to see the SetSocketOption function. By default, when you new a
socket, it will use the ExclusiveAddres sUse option,
i.e. you can not use SetSocketOption to set your socket as
SocketOptionNam e = ReuseAddress which allows the socket to be bound to an
address that is already in use.
To let the ReuseAddress work, you may need to set the two application all
with ReuseAddress option.
e.g.
Socket listener = new Socket(AddressF amily.InterNetw ork,SocketType. Stream,
ProtocolType.Tc p );
listener.SetSoc ketOption(Socke tOptionLevel.So cket,SocketOpti onName.ReuseAdd r
ess,1);

But, when the latter running application running the SetSocketOption and
bind to the socket, the first running application will no longer get data.
Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Randal" <ra****@nospam. com>
Sender: "Randal" <ra****@nospam. com>
References: <0b************ *************** *@phx.gbl> <nK************ **@cpmsftngxa06 .phx.gbl>Subject: RE: TCP/IP Monitoring in .NET
Date: Fri, 26 Sep 2003 14:09:55 -0700
Lines: 84
Message-ID: <1e************ *************** *@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcOEcojs7W6hWfK 5SUSj1TgJuJCktQ ==
Newsgroups: microsoft.publi c.dotnet.genera l
Path: cpmsftngxa06.ph x.gbl
Xref: cpmsftngxa06.ph x.gbl microsoft.publi c.dotnet.genera l:110074
NNTP-Posting-Host: TK2MSFTNGXA08 10.40.1.160
X-Tomcat-NG: microsoft.publi c.dotnet.genera l

As noted in my post, I am already using SetSocketOption
with the ReuseAddress option, but I was looking for some
of the specifics of extracting the information, since the
underlying socket is already connected. The issue is
that Socket.Receive cannot be used without the new socket
being connected. I am trying to figure out the specifics
of making a "connection " to the connection that already
exists by the original application.

-----Original Message-----
Hi Randal,

You may try to see the SetSocketOption function.
But if the other application use the socket as

SocketOptionNa me

=ExclusiveAdd ressUse
Then you can not use SetSocketOption to set your socket

as

SocketOptionN ame = ReuseAddress which allows the socket

to be bound to an

address that is already in use.

Did I answer your question?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and

confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Randal" <ra****@nospam. com>
Sender: "Randal" <ra****@nospam. com>
Subject: TCP/IP Monitoring in .NET
Date: Thu, 25 Sep 2003 14:38:50 -0700
Lines: 24
Message-ID: <0b************ *************** *@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcODrWig9CK3faw TTni7PrRRY/Zqww==
Newsgroups : microsoft.publi c.dotnet.genera l
Path: cpmsftngxa06.ph x.gbl
Xref: cpmsftngxa06.ph x.gblmicrosoft.publ ic.dotnet.gener al:109938NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.publi c.dotnet.genera l

Does anyone have a code sample of how onewould "listen"to a TCP/IP session between an application on the local
machine and a remote host.

I'm looking for code that would allow me to specify a
local IP and a local port which is already in use by
another application (outside of my control) and simply
watch the traffic.

I know there are open source packet analyzers available
that use special network drivers, use of permiscuous
network mode, etc., etc. But I'm not looking to watch
any traffic except to and from my local machine on a
known port and I am hoping that this is lesscomplicatedand that .NET's rich netwoking classes will lend a hand.

The two biggest issues that exist are the fact that
windows sockets does not like an port/ip pair bound to
two different sockets. I can sidestep this issue by
using SetSocketOption andSocketOptionNa me.ReuseAddress ,but I have found that simply binding to the address is
not sufficient to create the desired effect.

Any help?

.