Network Traffic per process/application windows

Question

I know that there are plenty of applications to do this (like procexplorer) but is there anyway to access the winapi (what method/reference is used) to retrieve the network traffic (TCP, UDP, etc) per application or process?

Solution

From your comments, I gather you are trying to capture the network traffic generated by the application you are developing from within the application itself. If so, I think this may be a question better suited to StackOverflow since that is a developer community. Such introspection would probably require the use of ETW (Event Tracing for Windows), but again I can't be certain. This question on S.O. may be of some help.

Putting that aside for one moment and focussing on the admin side of things (which is what you tend to get if you ask questions here), I would like to turn your attention to the netsh trace command and Microsoft Network Monitor (Netmon). You can capture directly from NetMon at the time you want to do it, or you can give yourself more flexibility with the netsh trace command by triggering it automatically.

If this is of interest, you can do:

netsh trace start capture=yes traceFile=c:\tracefolder\tracename.etl

to start a capture, and then:

netsh trace stop

when you are ready. There are other options, so you can see the manual using netsh trace /?

Once you have your capture by whatever means, you can then use NetMon to filter on the executable of your application to examine the network traffic generated by it during the period you were monitoring.

Comments

[xlharambe]

Thanks, but I am looking to integrate the data into my application. I am trying to find a solution via programatically. I know there has to be a reference in the winapi somewhere.

[xlharambe]

How do I get the network traffic per application?

[xlharambe]

What function must be called within the program? Is there any documentation that has this on pcap?