如何计算每个 TCP 连接（系统范围）发送和接收的字节数？
例如，最新版本的 TCPView 具有这样的功能：显示每个 TCP 连接发送/接收的字节（启动 TCPView 时开始计数）。是否可以不进行数据包嗅探？ windows为此提供了任何API吗？我还没有找到这样的性能计数器
编辑：TDI 是否有助于接收每个套接字的传输统计信息？网络BIOS？任何链接在哪里挖掘？
e.g. recent versions of TCPView has such functionality: showing bytes sent/received per TCP connection (counting starts when TCPView is launched). is it possible w/o packet sniffering? does windows provides any API for this? I haven't found such Performance Counter
how to enumerate all connections are described here
EDIT: does TDI help to receive per-socket transfer statistics? NetBIOS? any links where to dig?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
所有，我基本上完全逆向了 tcpview 3.0.2 并根据我所学到的实现了与其相同的功能。
tcpview 使用 ETW 监视网络活动。
关键 API 是 StartTrace、OpenTrace、ProcessTrace。
使用 KERNEL_LOGGER_NAME 并启用 EVENT_TRACE_FLAG_NETWORK_TCPIP 标志。
然后，您可以从 EventCallback 检索网络活动数据，然后将其解析为 TcpIp_TypeGroup1 和其他结构。根据文档，这些结构仅支持vista。不过你可以在xp（逆向猜测）和2003（我的环境是2003，xp上没有测试）中调用并使用它。当然，所有这些结构都必须由您自己定义。
从vista开始，win提供了一些API来检索每个连接的统计信息。如GetPerTcpConnectionEStats、GetPerUdpConnectionEStats，您可以从MSDN获取更多详细信息。
另外，从 vista 中，您可以使用 RAW Socket 来完成相同的工作（我认为更精确）。在vista之前，RAW Socket无法检索SEND数据包，很遗憾。
all, I have basically fully reverse tcpview 3.0.2 and implement the same feature as its according to what I have learnt.
tcpview use ETW for monitoring network activity.
The key APIs are StartTrace, OpenTrace, ProcessTrace.
Use the KERNEL_LOGGER_NAME and enable EVENT_TRACE_FLAG_NETWORK_TCPIP flags.
Then you can retrieve network activity data from EventCallback, then parse it as TcpIp_TypeGroup1 and other structures. According to the document, these structures are only supported from vista. However you can call and use it in xp(guess from reverse) and 2003(My environment is 2003, no test on xp). Certainly you have to define all these structures by yourself.
From vista, win provides some APIs for retrieving every connections statistic information. Such as GetPerTcpConnectionEStats, GetPerUdpConnectionEStats, you can get more details from MSDN.
Also, from vista, you can use RAW Socket to finish the same work(more precise I think). Before vista, RAW Socket can't retrieve SEND packets, it's a pity.
我也想实现这个功能，所以我逆向tcpview 3.0.2。
我发现，tcpview使用了一个WMI性能计数器MSNT_TcpIpInformation。
但MSNT_TcpIpInformation在xp和2003中正式不支持。
这里有说明，你可以参考一下。
http://www.scriptinternals.com/new/us/support/Internal /WMI_MSNT_TcpIpInformation.htm
顺便说一句，MSNT_TcpIpInformation 没有有关数据包的信息，因此 tcpview 每次都会递增已发送和已转发的数据包。
这是反汇编：
I want to implement this function also, so I reverse tcpview 3.0.2.
I found, tcpview use a WMI performance counter MSNT_TcpIpInformation.
But MSNT_TcpIpInformation is not supported in xp and 2003 officially.
here is the description, you can reference to.
http://www.scriptinternals.com/new/us/support/Internal/WMI_MSNT_TcpIpInformation.htm
by the way, MSNT_TcpIpInformation have no information about packets, so tcpview just increment sent and revd packets everytime.
here is the disassemble:
检查 WinSock LSP 示例项目，网址为 http://connect.microsoft.com/WNDP/Downloads
将在 nonifslsp\sockinfo.cpp 中找到一个示例，其中“说明如何开发能够对通过 TCP/IP 套接字传输的所有字节进行计数的分层服务提供程序。”
Check the WinSock LSP Sample project at http://connect.microsoft.com/WNDP/Downloads
You will find a sample in nonifslsp\sockinfo.cpp which "illustrates how to develop a layered service provider that is capable of counting all bytes transmitted through a TCP/IP socket."
netstat (netstatp) 的 sysinternals 版本可以执行此操作。 IIRC，它使用 SNMP 来收集信息。搜索网络并找到您喜欢的版本。文件名为 netstatp.c 和 netstatp.h
据我所知，Sysinternals 不再发布 netstatp。
您还可以访问此处并获取 tcpview 和/或 tcpconv 其中之一可用以源形式。
The sysinternals version of netstat (netstatp) does this. IIRC, it uses SNMP to gather its info. Search the net and find a version you're comfortable with. The file names are netstatp.c and netstatp.h
Sysinternals no longer publishes netstatp that I am aware of.
You can also go here and get tcpview and/or tcpconv one of which is available in source form.
查看 BitMeterOS 的源代码，它可以在 xp+ 上运行。你们还想看看 TCPDump/Libpcap 。这两个都监视网络网络流量，libpcap 可能会是你想要的，尽管
还有 Winpcap，一个更多的窗口面向“版本”，可以在此处找到有关网络流量统计的简单教程，您还会对此感兴趣，用于基于连接进行过滤this 表示原始数据包的大小。
Have a look at the source code for BitMeterOS, it works on xp+. you many also want to look at TCPDump/Libpcap as well. both of these monitor network network traffic, libpcap will probably be what your after though
there is also Winpcap, a more windows orientated 'version', a simple tutorial on network traffic stats can be found here, you'll also be interested in this for filtering based on connection and this for the size of the raw packets.
我最好的选择是挂钩“发送”API 调用并记录每次发送的金额。虽然这看起来确实不值得，但我很确定它会起作用。祝你好运！
My best bet would be hooking the "send" API calls and recording the amount sent each time. Although this really doesn't seem worth it, I'm pretty sure it would work. Good luck!