在.NET代码里调用Network Monitor API.

Microsoft Network Monitor 可以用来监测本地网络活动 , 除了功能丰富的 GUI 界面 , 它还提供了一些 API 供程序员在自己的代码里使用 Network Monitor 的功能 . 程序安装完成后 , 在 API 文件夹里可以找到一个 .cs 文件 , 该文件包含了 Network Monitor API 的托管签名 , 直接将此文件加入到 .NET 工程中即可 .

下面是一个简单的例子 :

CaputureAndSave方法显示了如何捕获和解析 frame, 并且把捕获到的一系列 frame 保存到 test.cap 文件中 .

ReadExistingCapFile方法显示了如何读取已有的 .cap 文件 .

  class NetmonDemo { const UInt32 ERROR_SUCCESS = 0; private static CaptureCallbackDelegate pCaptureCallBack = new CaptureCallbackDelegate(CaptureCallback); private static ParserCallbackDelegate pParserCallback = new ParserCallbackDelegate(ParserCallback); private static IntPtr hCaptureEngine = IntPtr.Zero; private static IntPtr myFrameParser = IntPtr.Zero; [STAThread] public static void Run() { CaputureAndSave(); } static void CaputureAndSave() { UInt32 ret = 0; String capFileName = @"D:/test.cap"; IntPtr capFileHandle = IntPtr.Zero; UInt32 size = 0; ret = NetmonAPI.NmCreateCaptureFile(capFileName, 1000000, NmCaptureFileFlag.Chain, out capFileHandle, out size); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to create capture file: {0}", capFileName); return; } myFrameParser = CreateFrameParser(); if (NetmonAPI.NmOpenCaptureEngine(out hCaptureEngine) == ERROR_SUCCESS) { uint adapterCount; NetmonAPI.NmGetAdapterCount(hCaptureEngine, out adapterCount); Console.WriteLine("there are {0} adapters.", adapterCount); // Retrieves information of the second adapter. UInt32 adapterIndex = 1 ; NM_NIC_ADAPTER_INFO adapterInfo = new NM_NIC_ADAPTER_INFO(); adapterInfo.Size = (UInt16)System.Runtime.InteropServices.Marshal.SizeOf(adapterInfo); UInt32 status = NetmonAPI.NmGetAdapter(hCaptureEngine, adapterIndex, ref adapterInfo); // Configures adapter 1. if (NetmonAPI.NmConfigAdapter(hCaptureEngine, adapterIndex, pCaptureCallBack, capFileHandle, NmCaptureCallbackExitMode.ReturnRemainFrames) == ERROR_SUCCESS) { NetmonAPI.NmStartCapture(hCaptureEngine, adapterIndex, NmCaptureMode.LocalOnly); Console.WriteLine("Tracing begins, press any key to stop"); Console.Read(); NetmonAPI.NmStopCapture(hCaptureEngine, adapterIndex); NetmonAPI.NmCloseHandle(hCaptureEngine); hCaptureEngine = IntPtr.Zero; NetmonAPI.NmCloseHandle(capFileHandle); capFileHandle = IntPtr.Zero; } } } static void ReadExistingCapFile() { myFrameParser = CreateFrameParser(); IntPtr capFile; UInt32 ret = NetmonAPI.NmOpenCaptureFile("D://myfile.cap", out capFile); UInt32 frameCount = 0; ret = NetmonAPI.NmGetFrameCount(capFile, out frameCount); for (UInt32 i = 0; i < frameCount; i++) { IntPtr pframe; ret = NetmonAPI.NmGetFrame(capFile, i, out pframe); IntPtr parsedFrame, insFrame; ret = NetmonAPI.NmParseFrame(myFrameParser, pframe, i, NmFrameParsingOption.FrameConversationInfoRequired, out parsedFrame, out insFrame); unsafe { IntPtr buff = Marshal.AllocHGlobal(1000); uint returnLen = 0; NmPropertyValueType value; ret = NetmonAPI.NmGetPropertyById(myFrameParser, 0, 1000, (byte*)buff, out returnLen, out value, 0, new CNmPropertyStorageKey[1]); Console.WriteLine(Marshal.PtrToStringUni(buff)); Console.WriteLine("-"); } } } static void CaptureCallback(IntPtr hCaptureEngine, UInt32 ulAdapterIndex, IntPtr pCallerContext, IntPtr hFrame) { uint length = 0; unsafe { IntPtr buff = Marshal.AllocHGlobal(100); NetmonAPI.NmGetRawFrame(hFrame, 100, (byte*)buff, out length); } NetmonAPI.NmAddFrame(pCallerContext, hFrame); Console.WriteLine(length); //if (pCallerContext != IntPtr.Zero) //{ // NetmonAPI.NmAddFrame(pCallerContext, hFrame); //} DumpProcessName(hFrame); } static void ParserCallback(IntPtr pCallerContext, UInt32 ulStatusCode, String lpDescription, NmCallbackMsgType ulType) { Console.WriteLine(lpDescription); } static IntPtr CreateFrameParser() { UInt32 ret = 0; IntPtr pCallerContext = IntPtr.Zero; IntPtr nplParser = IntPtr.Zero; ret = NetmonAPI.NmLoadNplParser(null, NmNplParserLoadingOption.NmAppendRegisteredNplSets, pParserCallback, pCallerContext, out nplParser); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to load NPL Parser"); return myFrameParser; } IntPtr frameParserConfig = IntPtr.Zero; ret = NetmonAPI.NmCreateFrameParserConfiguration(nplParser, pParserCallback, pCallerContext, out frameParserConfig); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to load frame parser configuration."); return myFrameParser; } ret = NetmonAPI.NmConfigConversation(frameParserConfig, NmConversationConfigOption.None, true); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to config conversation."); return myFrameParser; } ret = NetmonAPI.NmConfigReassembly(frameParserConfig, NmReassemblyConfigOption.None, true); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to config reassembly."); return myFrameParser; } UInt32 propertyId = 0; string propertyName = "Conversation.ProcessName"; ret = NetmonAPI.NmAddProperty(frameParserConfig, propertyName, out propertyId); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to add property: {0}", propertyName); return myFrameParser; } //propertyName = "Conversation.ProcessName"; //ret = NetmonAPI.NmAddProperty(frameParserConfig, propertyName, out propertyId); //if (ret != ERROR_SUCCESS) //{ // Console.WriteLine("Failed to add property: {0}", propertyName); // return myFrameParser; //} ret = NetmonAPI.NmCreateFrameParser(frameParserConfig, out myFrameParser, NmFrameParserOptimizeOption.ParserOptimizeNone); if (ret != ERROR_SUCCESS) { Console.WriteLine("Failed to create parser."); NetmonAPI.NmCloseHandle(frameParserConfig); return myFrameParser; } return myFrameParser; } static void DumpProcessName(IntPtr hFrame) { IntPtr parsedFrame, insertedRawFrame; uint ret = NetmonAPI.NmParseFrame(myFrameParser, hFrame, 0, NmFrameParsingOption.FrameConversationInfoRequired, out parsedFrame, out insertedRawFrame); uint propertyID = 0; //NM_NPL_PROPERTY_INFO pInfo = new NM_NPL_PROPERTY_INFO(); //ret = NetmonAPI.NmGetPropertyInfo(myFrameParser, propertyID, ref pInfo); unsafe { IntPtr buff = Marshal.AllocHGlobal(1000); uint returnLen = 0; NmPropertyValueType value; ret = NetmonAPI.NmGetPropertyById(myFrameParser, propertyID, 1000, (byte*)buff, out returnLen, out value, 0, new CNmPropertyStorageKey[1]); //Console.Write("-"); Console.WriteLine(Marshal.PtrToStringUni(buff)); } } }