Capturing Outgoing Network Traffic with the IPMonitor Component

The IPMonitor component can capture network traffic in two ways on Windows:

When outgoing packets must be captured reliably, use the Npcap mode.

Capturing with Npcap

To use the Npcap mode, install Npcap on the system (in WinPcap API-compatible mode, so that wpcap.dll is available to applications), and set UseWinPCap to true before calling the Activate method. The interface to capture on is selected using the SelectedInterface configuration setting, which is the index of the interface in the list returned by the ListInterface configuration setting.

IPMonitor ipmonitor = new IPMonitor();
ipmonitor.Config("UseWinPCap=true");

// List the interfaces that are visible to the Npcap driver, and select the one to capture on.
Console.WriteLine(ipmonitor.Config("ListInterface"));
ipmonitor.Config("SelectedInterface=0");

ipmonitor.OnIPPacket += (s, e) =>
{
  Console.WriteLine(e.SourceAddress + ":" + e.SourcePort + " -> " + e.DestinationAddress + ":" + e.DestinationPort + " (protocol " + e.IPProtocol + ")");
};

ipmonitor.Activate();
while (ipmonitor.Active)
{
  ipmonitor.DoEvents();
}

The Npcap mode is available only on Windows.

Analyzing an Existing Capture

Traffic can also be captured with another tool (e.g., Wireshark, or the pktmon tool included with Windows), saved as a pcap or pcapng file, and then processed with the ParsePcapFile method. The IPPacket event fires for each packet in the file, in the same way as for live traffic.

ipmonitor.ParsePcapFile("C:\captures\traffic.pcapng");

Requirements and Limitations

• Capturing traffic in raw socket mode requires administrator privileges.
• When ReceiveAllMode is 1 (the default), the network interface is placed in promiscuous mode. Some network interfaces (in particular, many wireless adapters) do not support promiscuous mode.
• On a switched network, the switch forwards only the traffic that is addressed to the computer (in addition to broadcast and multicast traffic), so traffic between other computers is not visible even in promiscuous mode. To monitor other traffic, use a port mirroring (SPAN) port on the switch.
• The raw socket mode captures only IPv4 and IPv6 packets. Other packets (e.g., ARP packets) are not captured.

Note that older versions of the IPMonitor component supported only the raw socket mode, and outgoing traffic was captured on Windows XP by enabling the Windows personal firewall (Internet Connection Firewall) on the network connection.