cthu1hu wrote:
If anyone has any other innovative ideas on how to use this, please don't hesitate to share.
I'd like a setup like linux's tail where I could watch specific ports.
Would be l33t.
OK, this is probably a bit more broad than being specifically what you want cthu1hu but you can already get something like what you are thinking of using the built-in M$ program
NETSTAT.
Typing '
netstat /?' at a command prompt displays the following:
Code:
Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-b] [-e] [-n] [-o] [-p proto] [-r] [-s] [-v] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
-v When used in conjunction with -b, will display sequence of
components involved in creating the connection or listening
port for all executables.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.
You can redirect the output from the default device (the command prompt screen) to a file using '
> [path to the file]'
EXAMPLES:The command:
netstat -e > c:\netstat.txt
creates an ASCII text file named 'netstat.txt' with contents similar to the following:
Code:
Interface Statistics
Received Sent
Bytes 25614373 16304926
Unicast packets 56349 53451
Non-unicast packets 232 238
Discards 0 0
Errors 0 1
Unknown protocols 0
If you run it with an interval on the end of the command it will append the file on the interval. For example:
netstat -e 1 > c:\netstat.txt
creates an ASCII text file named 'netstat.txt' with contents similar to the following (appended once every second):
Code:
Interface Statistics
Received Sent
Bytes 27108330 17261864
Unicast packets 61562 58507
Non-unicast packets 254 260
Discards 0 0
Errors 0 1
Unknown protocols 0
Interface Statistics
Received Sent
Bytes 27108330 17261864
Unicast packets 61562 58507
Non-unicast packets 254 260
Discards 0 0
Errors 0 1
Unknown protocols 0
Interface Statistics
Received Sent
Bytes 27108330 17261864
Unicast packets 61562 58507
Non-unicast packets 254 260
Discards 0 0
Errors 0 1
Unknown protocols 0
(...etc.)
Now if you set bbLogView to read only the last 10 lines of text from 'netstat.txt' every second you have created network traffic monitor.
To create a port monitor, use the -a argument. For example:
netstat -a 1 > c:\netstat.txt
creates an ASCII text file named 'netstat.txt' with contents similar to the following (appended once every second):
Code:
Active Connections
Proto Local Address Foreign Address State
TCP xerxes:epmap xerxes:0 LISTENING
TCP xerxes:microsoft-ds xerxes:0 LISTENING
TCP xerxes:1028 xerxes:0 LISTENING
TCP xerxes:1044 localhost:1045 ESTABLISHED
TCP xerxes:1045 localhost:1044 ESTABLISHED
TCP xerxes:1048 localhost:1049 ESTABLISHED
TCP xerxes:1049 localhost:1048 ESTABLISHED
TCP xerxes:3210 localhost:12080 ESTABLISHED
TCP xerxes:3214 localhost:12080 ESTABLISHED
TCP xerxes:3218 localhost:12080 ESTABLISHED
TCP xerxes:3239 localhost:12080 ESTABLISHED
TCP xerxes:12025 xerxes:0 LISTENING
TCP xerxes:12080 xerxes:0 LISTENING
TCP xerxes:12080 localhost:3210 ESTABLISHED
TCP xerxes:12080 localhost:3214 ESTABLISHED
TCP xerxes:12080 localhost:3218 ESTABLISHED
TCP xerxes:12080 localhost:3239 ESTABLISHED
TCP xerxes:12110 xerxes:0 LISTENING
TCP xerxes:12119 xerxes:0 LISTENING
TCP xerxes:12143 xerxes:0 LISTENING
TCP xerxes:netbios-ssn xerxes:0 LISTENING
TCP xerxes:3211 eo-in-f104.google.com:http ESTABLISHED
TCP xerxes:3215 eo-in-f104.google.com:http ESTABLISHED
TCP xerxes:3219 wr-in-f99.google.com:http ESTABLISHED
TCP xerxes:3240 kc-in-f104.google.com:http ESTABLISHED
TCP xerxes:netbios-ssn xerxes:0 LISTENING
TCP xerxes:netbios-ssn xerxes:0 LISTENING
UDP xerxes:microsoft-ds *:*
UDP xerxes:isakmp *:*
UDP xerxes:1025 *:*
UDP xerxes:1143 *:*
UDP xerxes:1144 *:*
UDP xerxes:1147 *:*
UDP xerxes:4500 *:*
UDP xerxes:ntp *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
Active Connections
Proto Local Address Foreign Address State
TCP xerxes:epmap xerxes:0 LISTENING
TCP xerxes:microsoft-ds xerxes:0 LISTENING
TCP xerxes:1028 xerxes:0 LISTENING
TCP xerxes:1044 localhost:1045 ESTABLISHED
TCP xerxes:1045 localhost:1044 ESTABLISHED
TCP xerxes:1048 localhost:1049 ESTABLISHED
TCP xerxes:1049 localhost:1048 ESTABLISHED
TCP xerxes:3210 localhost:12080 ESTABLISHED
TCP xerxes:3214 localhost:12080 ESTABLISHED
TCP xerxes:3218 localhost:12080 ESTABLISHED
TCP xerxes:3239 localhost:12080 ESTABLISHED
TCP xerxes:12025 xerxes:0 LISTENING
TCP xerxes:12080 xerxes:0 LISTENING
TCP xerxes:12080 localhost:3210 ESTABLISHED
TCP xerxes:12080 localhost:3214 ESTABLISHED
TCP xerxes:12080 localhost:3218 ESTABLISHED
TCP xerxes:12080 localhost:3239 ESTABLISHED
TCP xerxes:12110 xerxes:0 LISTENING
TCP xerxes:12119 xerxes:0 LISTENING
TCP xerxes:12143 xerxes:0 LISTENING
TCP xerxes:netbios-ssn xerxes:0 LISTENING
TCP xerxes:3211 eo-in-f104.google.com:http ESTABLISHED
TCP xerxes:3215 eo-in-f104.google.com:http ESTABLISHED
TCP xerxes:3219 wr-in-f99.google.com:http ESTABLISHED
TCP xerxes:3240 kc-in-f104.google.com:http ESTABLISHED
TCP xerxes:netbios-ssn xerxes:0 LISTENING
TCP xerxes:netbios-ssn xerxes:0 LISTENING
UDP xerxes:microsoft-ds *:*
UDP xerxes:isakmp *:*
UDP xerxes:1025 *:*
UDP xerxes:1143 *:*
UDP xerxes:1144 *:*
UDP xerxes:1147 *:*
UDP xerxes:4500 *:*
UDP xerxes:ntp *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
UDP xerxes:ntp *:*
UDP xerxes:netbios-ns *:*
UDP xerxes:netbios-dgm *:*
UDP xerxes:1900 *:*
(...etc.)
You can slim this down to just the TCP connections by just stipulating the protocal. For example:
netstat -p tcp 1 > c:\netstat.txt
creates an ASCII text file named 'netstat.txt' with contents similar to the following (appended once every second):
Code:
Active Connections
Proto Local Address Foreign Address State
TCP xerxes:1044 localhost:1045 ESTABLISHED
TCP xerxes:1045 localhost:1044 ESTABLISHED
TCP xerxes:1048 localhost:1049 ESTABLISHED
TCP xerxes:1049 localhost:1048 ESTABLISHED
Active Connections
Proto Local Address Foreign Address State
TCP xerxes:1044 localhost:1045 ESTABLISHED
TCP xerxes:1045 localhost:1044 ESTABLISHED
TCP xerxes:1048 localhost:1049 ESTABLISHED
TCP xerxes:1049 localhost:1048 ESTABLISHED
Active Connections
Proto Local Address Foreign Address State
TCP xerxes:1044 localhost:1045 ESTABLISHED
TCP xerxes:1045 localhost:1044 ESTABLISHED
TCP xerxes:1048 localhost:1049 ESTABLISHED
TCP xerxes:1049 localhost:1048 ESTABLISHED
(...etc.)
Further Thoughts
bbLogView opens up a whole new can of worms IMO. Even the most novice student of C\C++ learns how to take the data that is normally sent to STDOUT (the display) and write it to a file. They really don't have to understand a lot about the BBAPI to create a DLL that
blackbox.exe can load and unload. They don't have to create menus or a window or any of the other stuff that most plugins do. Just create a text file and overwrite\append it periodically and have an instance of bbLogView read it.
For instance, creating a digital clock would almost be a no-brainer.
And if someone posted a DLL template for this kind of plugin, even very novice C\C++ students would be thinking up all kinds of data to collect and write to a text file.