NetworkSnoop is a patch which purpose is similiar to SnoopDos but it is aimed at tracing bsdsocket.library calls. This is not a program for an ordinary user - it is not going to improve the functionality of TCP/IP stack. NetworkSnoop is for developers who develop tools which use bsdsocket.library. This tool offers them ability to check eg. content of the buffers of such functions as recv(), send(), content of the system's structures which are used by bsdsocket.library. The developers may also like to check if the function receives proper parameteres and what are they.

This tool can also be used to monitor "uncertain" software:  suspected for spamming, software that sends 
unwanted information in non-specified web places.

-Requirements
any AROS x86 based distros


Requirements are as follows:

-any TCP/IP stack compatible with bsdsocket.library (practically all stacks; bsdsocket.library 
emulation built into WinUAE also works)
-MUI 3.x or newer,
-MUI NList class,
-any tool that uses bsdsocket.library (to test on something)

-How does it work?

As already mentioned, NetworkSnoop patches bsdsocket.library functions and exec.library functions 
(OldOpenLibrary(), OpenLibrary(), CloseLibrary()). The patches are tracing all the calls to the basic 
API of bsdsocket.library (currently NetworkSnoop traces calls of procedures in offsets table of jumps 
within the range of -30 and -300).  It is a common knowledge that each process that uses bsdsocket.library 
has to open the library only for its very own purposes - database of the library is connected with the 
process and can not be shared between other processes.  According to this and in contrary to all the 
others AmigaOS libraries, it is impossible to assemble a single patch for bsdsocket.library as well as 
simply monitor the calls of this library.  It is necessary to assemble patches dynamically into each 
database of bsdsocket.library which was created by exec.libary/OpenLibrary() calls. Basically it 
means that NetworkSnoop must be run BEFORE any tool which has to be monitored.

-What exactly can I do with NetworkSnoop?

You may observe the functions' calls and their parameters (top lister).  In the bottom lister there are 
contents of structures or buffers of functions which assign more complexed parameters. In the second 
tab you can turn on/off patches, choose the name of the process to trace (by default, NetworkSnoop 
traces all the process which in any way are connected with bsdsocket.library), turn on/off saving to 
file information about the buffers of the functions recv()/send() (you can choose between saving to 
progdir or to the directory of the traced process). Every session is logged and can be saved to a text 
file. All the changes take place immediately, including saving the preferences.


Uploaded using: archives.aros-exec.org

 PERMSSN    UID  GID    PACKED    SIZE  RATIO METHOD CRC     STAMP          NAME
---------- ----------- ------- ------- ------ ---------- ------------ -------------
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:13 NetworkSnoop/
-rwxrw-rw- 65534/65534  137280  347211  39.5% -lh5- 8532 Sep  7 05:04 NetworkSnoop/NetworkSnoop
-rwx------ 65534/65534    7212    7232  99.7% -lh5- 87ae Sep  7 07:12 NetworkSnoop/NetworkSnoop.info
-rwx------ 65534/65534    3041    3690  82.4% -lh5- 4780 Sep  7 07:12 NetworkSnoop/NetworkSnoop_AROS.pdf
-rwx------ 65534/65534    1738    3740  46.5% -lh5- 043d Sep  7 07:12 NetworkSnoop/NetworkSnoop_AROS.readme
-rwx------ 65534/65534   34624   72720  47.6% -lh5- 8377 Sep  7 07:12 NetworkSnoop/NetworkSnoop_m68k.exe
-rwx------ 65534/65534    1089    1840  59.2% -lh5- 5666 Sep  7 07:12 NetworkSnoop/NetworkSnoop_m68k.exe.info
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/locale/
-rwx------ 65534/65534    1817    5759  31.6% -lh5- f594 Sep  7 07:12 NetworkSnoop/locale/NS.cd
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/locale/polski/
-rwx------ 65534/65534    2996   10096  29.7% -lh5- 3ecb Sep  7 07:12 NetworkSnoop/locale/polski/NS.ct
-rwx------ 65534/65534    1955    4952  39.5% -lh5- 2faa Sep  7 07:12 NetworkSnoop/locale/polski/NetworkSnoop.catalog
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:15 NetworkSnoop/prefs/
-rwx------ 65534/65534      11      12  91.7% -lh5- 96ad Sep  7 07:15 NetworkSnoop/prefs/af.prefs
-rwx------ 65534/65534      10      90  11.1% -lh5- 6cb6 Sep  7 07:15 NetworkSnoop/prefs/ef.prefs
-rwx------ 65534/65534      12      12 100.0% -lh0- 41cd Sep  7 07:15 NetworkSnoop/prefs/pa.prefs
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/recv+send/
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/recv+send/recv/
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/recv+send/recvfrom/
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/recv+send/send/
drwx------ 65534/65534       0       0 ****** -lhd- 0000 Sep  7 07:12 NetworkSnoop/recv+send/sendto/
---------- ----------- ------- ------- ------ ---------- ------------ -------------
 Total        21 files  191785  457354  41.9%            Sep  7 20:37