How to detect opened sockets in Windows?

Question

In Windows XP (SP2 if necessary), is there any way to detect, from a userspace application, that a TCP/UDP socket (from any process) has opened? I know of the GetExtendedTcpTable() and GetExtendedUdpTable() functions, but they only detect currently opened sockets. Some sockets close immediately after they're opened that the only way I'd be able to detect their existence is by being notified when they open.

If no such a mechanism exists in userspace, I'm willing to go into kernel space to get this functionality. Are there any documented/undocumented features that could do this?

Answer 1

You will likely need to write a WinSock LSP or SPI driver in order to detect that without having to hook every running process directly.