Windows Resource Monitors "Network Activity" c++

644 views Asked by At

I'm trying to figure out how to get all network activity for a given process. In the Windows "Resource Monitor" application in the "Network Activity" box, you are able to see all tcp / udp connections, and the data being sent etc. I first tried using the cmd netstat, and was going to parse this but quickly realized it "misses" a whole bunch of udp connections. So that was out. Now I've been looking into using iphlpapi.h in c++ along with its GetExtendedUdpTable function. But even this doesn't seem to be showing all the data that Resource Monitor shows. Can anyone direct me to the proper windows API that can get the same information as seen in the Network Activity tab under Resource Monitor. I've been searching for a while now and everything I've found is extremely old, I'm hoping to use whatever is the current/modern approach. This doesn't have to be backwards compatible, windows 10 only is fine.

Basically my end-goal is to build an app that can geo-locate ip's using a database automatically for a target application (including UDP connections). Now I'm sure there are many libraries/apps out there that can already do this. I'm just wanting to do it as a learning process so I'd like to avoid any libraries/API other than windows provided ones.

This is currently what I've been working with, please forgive the use of poor practices such as using printf and not using static_cast etc. I'll be rewriting everything properly once I've found a way of obtaining the information I'm after.

    MIB_UDPTABLE_OWNER_PID* pUdpTable;
    MIB_UDPROW_OWNER_PID* owner;

    DWORD dwSize;
    DWORD dwResult;

    dwResult = GetExtendedUdpTable(NULL, &dwSize, false, AF_INET, UDP_TABLE_OWNER_PID, 0);
    pUdpTable = (MIB_UDPTABLE_OWNER_PID*)MALLOC(dwSize);
    dwResult = GetExtendedUdpTable(pUdpTable, &dwSize, false, AF_INET, UDP_TABLE_OWNER_PID, 0);

    for (DWORD dwLoop = 0; dwLoop < pUdpTable->dwNumEntries; dwLoop++) {
        owner = &pUdpTable->table[dwLoop];
        printf("%ld ", owner->dwOwningPid);

        HANDLE Handle = OpenProcess(
            PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
            FALSE,
            owner->dwOwningPid
        );
        if (Handle) {
            TCHAR Buffer[MAX_PATH];
            if (GetModuleFileNameEx(Handle, 0, Buffer, MAX_PATH)) {
                printf(Buffer);
                printf("\n");
            } else {
                printf("Error GetModuleFileNameEx : %lu\n", GetLastError());
            }
            CloseHandle(Handle);
        } else {
            printf("Error OpenProcess : %lu\n", GetLastError());
        }
    }

    FREE(pUdpTable);
0

There are 0 answers