Monitor a process's network usage?

Question

Is there a way in C# or C/C++ & Win32 to monitor a certain process's network usage (Without that application being built by you obviously)? I would like to monitor just 1 process for like an hour or so, then return the bytes used by only that process, such as limewire for example.

Is it possible? I know netstat -e on windows will tell you total bytes sent/received, but that is for all processes.

edit: If i can't return just one processes usage, how can i get the bytes sent/received by the entire system? as netstat displays except i just want the integers.

eg:

netstat -e

                           Received            Sent

Bytes                    2111568926      1133174989
Unicast packets             3016480         2711006
Non-unicast packets            3122            1100
Discards                          0               0
Errors                            0               0
Unknown protocols                 0

I just want to get 2 variables, like rec = 2111568926 and sent = 1133174989

Answer 1

You could use WinPcap for this or write your own device driver. I don't think there are any per process perfmon counters you can leverage.

Answer 2

[ 2021 edit: links are dead as the Network Monitor is discontinued after Windows XP. ]

It's possible, but if I'm not mistaken you'll have to create a network driver to filter all network traffic and than figure out which process created the traffic.

Microsoft has an free application for it called Microsoft Network Monitor 3.2 (download). According to the release notes it also has an api to use.

Network Monitor API: Create your own applications that capture, parse and analyze network traffic!

Here is a blog post about these API's.

In my opinion you should use this API (or another API such as WinPcap) to filter the traffic instead of writing your own device driver.

Answer 3

I asked the same question on MSDN forum and get answer. Frankly speaking have tried it. I.e. tried but not so hard)) It was suggested to use ETW. I did not realize how to consume ETW events properly. http://social.msdn.microsoft.com/Forums/en-US/perfmon/thread/b82da95a-1c18-49ce-9bfa-e3d79ec40907