Capturing Another Application's Network Traffic

[aldente]

I could not log in to my account for quite a long time, so that's why it took me so long to answer.

Here are the answers to your questions:

- Do you have general admin access?

Sure. But I wanted to design my tool so it works without administrator rights. That seems to be impossibile though...

- Are you interested in the packets' data or in the packets themself?

I want to access the packets content.

- How will the program you're capturing data from access the network?

WinSocks.

- Will the program run at Ring-3 or Ring-0?

It's a normal usermode-application.

- Will the data be encrypted?

No, just unencrypted TCP-data.

- How much traffic do you expect to be captured?

Very little.

- What transport and communication protocol will be used?

Only TCP.


In the meantime I tried a network sniffer based on raw sockets and filtered out just the traffic of the target application. Anyway, the CPU-load of this sniffer is quite high when there are other applications which produce network traffic (a 250 kb/s download makes a 3-4% CPU load in the sniffer tool).
Installing a driver for the sniffing application is NOT an option, so WinPCap can't be used.

Any other ideas of howto get the traffic besides from raw sockets?
How about some winsock-tricks?

In this case you might want to try "Ultra Network Sniffer" (http://www.gjpsoft.com/UltraNetSniffer/).

It only needs admin rights once to install the driver and it captures traffic based on applications.

And if you don't intend to buy the application ( ), you might want to skip the strong RSA-1024 registration system and find the implementation error.

[aldente]

As I said, I don't want any solution which requires a driver!

To ensure you got me right: I don't want any network sniffer for myself, CommView is just perfect for that purpose and I don't need anything else.

I wan't a solution which I can easily integrate into my own tool, and I don't want to distribute any drivers with my tool!

But I already wrote that in the first sentence of the first post of this thread!