How to sniff local outgoing network traffic in .NET without using PCap?

Question

I'd like to somehow hook into the local system's network stack to capture outgoing network packets without using Winpcap. Unfortunately it tends to crash my system every now and then.

Is there a way to "sniff" outgoing traffic of the local system from a user space process written in a .NET language?

Solution 1

What you want is the Network Monitor API. More here and here.

Solution 2

I use smsniff from NIRSOFT. You need to be admin on the machine to sniff any traffic.

http://www.nirsoft.net/utils/smsniff.html

I have never seen .net used to sniff traffic. But maybe NetMon from Microsoft has a COM interface you call from .Net

But as always you need to be admin to sniff traffic, since it is needed to put the NIC in promiscuous mode.

Comments

[Hendrik Wiese]

Getting admin rights shouldn't be an issue since the program I'm working on is primarily for my own use. Well, if someone else would like to have a proggy that traces HTTP requests to specific filetypes and, after finding such a request, offers a way to actually download those files (like videos, mp4, flv) I'm sure I can make it public somewhere down the road. I don't want to go through the all the mess of writing a fully functional HTTP proxy, so sniffing is the only alternative.

[ggonsalv]

Try fiddler as a HTTP debugging proxy. IT rulez fiddler2.com/fiddler2

[Hendrik Wiese]

Yes, Fiddler is great. I'm using FiddlerCore to trace the HTTP requests with my application by now. But I'd really like to capture them independently from the proxy settings of the browsers.

[Diego Vieira]

Hi Mike, link for NMCaptureData is dead. Thanks

[Mike Atlas]

Too bad, I updated my post to something I found that looks relevant (another example of a C# project using the NM API).