watching client-server net communication

[martinhoge]

Hi
I'm currently slightly desperate :cry: , I have got software
for load testing. It contains plugins for particular testing, like
web, sql server, etc.. And it works somehow. ( like Mercury do )
However my boss wants me to extent it, or create plugin with ability to read any plain communication protocol of any client-server application.
He thinks that it should work in a way, that program will somehow
attach to some application ( client ) and will read its communication
with server to simulate it after that.

But how could I do that? I'm totally confused and really
don't have any working ideas about that, except two, but which
I am not sure about. One is to use some Win Api to find app and
its communication. f.e. when I do netstat, I can see connection link
with application process Ids -> so if I could somehow get more
into it.

I also have another idea: To create proxy server, where I could
read communication I hope better.

As I said, I don't have any clue where to start. I have even
problems to google it, because I don't know what exactly look up.
If you knew about anything, please reply.

Thanks

Btw: program is in C#, but I still have ability to use api functions,
or even create some C++ dll to do some stuff for me.

[krush_ter]

Hi,

I think there are two solutions of your task:

1. API hooking (quick and easy way).
You can read about API hooking here:
http://www.codeguru.com/cpp/w-p/system/misc/article.php/c5667/

2. Write and attach your own LSP (Layered Service Provider). This is more complex way.

Both solutions allow you to spy and modify all data traffic between specific client and server.

Of course, you can intercept packets using NDIS or TDI filter driver, but this is hard and buggy way.

Own sniffer can not help because it can not determine what application sends and receives data, also it can skip packets.

Good luck,
Vladimir.

[martinhoge]

Thanks I will take a look at it.

Martin