Getting Process ID of process that sent packet

[stsf]

Hey guys, I was wondering – is it possible to get the process ID of the process that sent out the packet when we process the packet in user mode (similar to how we get the MAC address, IP’s, ports, etc )?

I’m using the NdisApiWrapper in a C# project, and I can see that the NdisApiWrapper itself uses the Win32 API, which seems like the type of thing that would be used for that.

Thanks in advance.

[Vadim Smirnov]

You can use IP Helper API to retrieve current connections table and starting Windows XP this table also contains process ID. You can use IP/Port information from the packet to find the corresponding connection in that table and thus identify the process.

[Author]

Posts