How to sniff local outgoing network traffic in .NET without using PCap?

Question

Hi there,

I'd like to somehow hook into the local system's network stack to capture outgoing network packets without using Winpcap. Unfortunately it tends to crash my system every now and then.

Is there a way to "sniff" outgoing traffic of the local system from a user space process written in a .NET language?

Thanks a lot!

Hendrik

Answer 1

What you want is the Network Monitor API. Here's a C# example of how to use the APIs: NMCaptureData. More here and here.

Answer 2

Yes, the System.Net classes have tracing capability built in. All you have to do is configure it in your app.exe.config file. It is explained well in this MSDN Library article.

Answer 3

I use smsniff from NIRSOFT. You need to be admin on the machine to sniff any traffic.

http://www.nirsoft.net/utils/smsniff.html

I have never seen .net used to sniff traffic. But maybe NetMon from Microsoft has a COM interface you call from .Net

But as always you need to be admin to sniff traffic, since it is needed to put the NIC in promiscuous mode.