Assuming you want to monitor TCP Sockets on the machine, you can use System.Net.NetworkInformation.GetActiveTcpConnections which should give you a list of TCP connections and the current state of each. Which you can call on a regular timer to get updated states of the sockets.
I am more familiar with the Win32 APIs for this, such as GetTcpTable and the less documented GetTcpTableEx, the later also provides the process ID of the process that ownes the local end point. So the above might not give exactly what I believe it does :)
Of course if you need to be notified the very instant before or after a tcp socket is created or it's state changes, that unfortunately would require a kernel mode driver which cannot be written in .NET.
If you really need an event based mechanism, event trace for windows is the way to go. Since you said it's only a preference :) you're best off writing this using the windows api (c/c++).
From .NET 3.5 onwards parts of the event trace are accessible via .NET using the System.Diagnostics.Eventing namespace. I understand that this has been improved in .NET 4.0. I haven't looked into this myself so I don't know whether TCP Connection detection is possible.
I know for sure that you can do what you want with windows api and ETW.
发布评论
评论（2）
假设您想要监视计算机上的 TCP 套接字，您可以使用 System.Net.NetworkInformation.GetActiveTcpConnections，它应该为您提供 TCP 连接的列表以及每个连接的当前状态。您可以调用常规计时器来获取套接字的更新状态。
我对此更熟悉Win32 API，例如GetTcpTable和文档较少的GetTcpTableEx，后者还提供拥有本地端点的进程的进程ID。因此，上面的内容可能无法准确地给出我所认为的内容:)
当然，如果您需要在创建 tcp 套接字之前或之后或其状态更改之前立即收到通知，那么不幸的是，这将需要一个无法编写的内核模式驱动程序在.NET中。
Assuming you want to monitor TCP Sockets on the machine, you can use System.Net.NetworkInformation.GetActiveTcpConnections which should give you a list of TCP connections and the current state of each. Which you can call on a regular timer to get updated states of the sockets.
I am more familiar with the Win32 APIs for this, such as GetTcpTable and the less documented GetTcpTableEx, the later also provides the process ID of the process that ownes the local end point. So the above might not give exactly what I believe it does :)
Of course if you need to be notified the very instant before or after a tcp socket is created or it's state changes, that unfortunately would require a kernel mode driver which cannot be written in .NET.
如果您确实需要基于事件的机制，那么窗口事件跟踪是最佳选择。既然你说这只是一个偏好:)你最好使用 Windows api (c/c++) 来编写它。
http://msdn.microsoft.com/en- us/library/aa964766(v=vs.85).aspx
从 .NET 3.5 开始，可以使用 System.Diagnostics.Eventing 命名空间通过 .NET 访问部分事件跟踪。据我所知，.NET 4.0 对此进行了改进。我自己没有研究过这个，所以我不知道 TCP 连接检测是否可行。
我确信你可以使用 windows api 和 ETW 做你想做的事。
If you really need an event based mechanism, event trace for windows is the way to go. Since you said it's only a preference :) you're best off writing this using the windows api (c/c++).
http://msdn.microsoft.com/en-us/library/aa964766(v=vs.85).aspx
From .NET 3.5 onwards parts of the event trace are accessible via .NET using the System.Diagnostics.Eventing namespace. I understand that this has been improved in .NET 4.0. I haven't looked into this myself so I don't know whether TCP Connection detection is possible.
I know for sure that you can do what you want with windows api and ETW.