Query regarding socket

Home Forums Discussions Support Portal Query regarding socket

This topic contains 1 reply, has 2 voices, and was last updated by  Vadim Smirnov 11 months, 2 weeks ago.

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • #9284

    ANDas
    Participant

    Hello folks,

    I wanted to know whether we can get direct TCP socket in client application instead of IP packet?

    Also, is there any way to get process metadata(process name, pid etc) using winpkfilter?

    Thnaks
    Avi

    #9286

    Vadim Smirnov
    Moderator

    WinpkFilter works at the NDIS level, while socket is a high level abstraction, also for some packets (an example, routed packets) there can be no socket object at all.

    Also, is there any way to get process metadata(process name, pid etc) using winpkfilter?

    Yes, there is a way. You can use IP helper API to query active connections from the system and use protocol/IP/port information to match the packet against the connection and figure out the originating process.

Viewing 2 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.