Home/ Questions/Q 3238988
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T17:55:02+00:00

In Windows XP (SP2 if necessary), is there any way to detect, from a

  • 0

In Windows XP (SP2 if necessary), is there any way to detect, from a userspace application, that a TCP/UDP socket (from any process) has opened? I know of the GetExtendedTcpTable() and GetExtendedUdpTable() functions, but they only detect currently opened sockets. Some sockets close immediately after they’re opened that the only way I’d be able to detect their existence is by being notified when they open.

If no such a mechanism exists in userspace, I’m willing to go into kernel space to get this functionality. Are there any documented/undocumented features that could do this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You will likely need to write a WinSock LSP or SPI driver in order to detect that without having to hook every running process directly.

    • 0