Member Avatar for amuarica

I'am trying to develop a notification program to notify user on my
network that their computer have a worm . The program that I want to develop a can monitor port 135 on windows OS . The system will monitor port 135 on one computer and see wheter there is a computer that tried to connect to this computer by using that port . If there is a computer that trying to connect by using this port , the program will notify a user that their computer maybe have a worm .

From your opinion , what programming technique that suitable for this program . Is there anybody can guide me in developing this program . Thank you very much

  • 3 Contributors
  • 3 Replies
  • 132 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by DanceInstructor

Dani AI

Generated

asked about detecting remote attempts to connect to TCP port 135. For a learning project there are two practical paths: a user‑mode packet sniffer (noninvasive, good for detection/alerting) or an OS/kernel filtering solution (blocking, more complex and requires driver work). touched on using existing host protection; this is often the easiest operational choice, but packet capture is the best way to learn how connection attempts actually look on the wire. was right that low‑level network detail belongs in networking discussions, but a C# program can do useful sniffing via existing libraries.

A recommended learning stack: install Npcap (replacement for WinPcap) and use the SharpPcap + PacketDotNet libraries in C#. Capture TCP traffic to the local machine and inspect TCP flags (SYN, ACK) and source addresses. Npcap requires admin rights and, if monitoring localhost, must be installed with loopback support. See Npcap and SharpPcap.

A minimal C# sniff example (SharpPcap + PacketDotNet):

using System;
using SharpPcap;
using PacketDotNet;

class Port135Monitor
{
    static void Main()
    {
        var devices = CaptureDeviceList.Instance;
        if (devices.Count == 0) { Console.WriteLine("No devices found."); return; }

        var dev = devices[0];
        dev.OnPacketArrival += new PacketArrivalEventHandler(Device_OnPacketArrival);
        dev.Open(DeviceMode.Promiscuous, 1000);
        dev.Filter = "tcp port 135";
        dev.StartCapture();

        Console.WriteLine("Listening for TCP to port 135 on " + dev.Description);
        Console.ReadLine();

        dev.StopCapture();
        dev.Close();
    }

    private static void Device_OnPacketArrival(object sender, CaptureEventArgs e)
    {
        var packet = Packet.ParsePacket(e.Packet.LinkLayerType, e.Packet.Data);
        var ip = IpPacket.GetEncapsulated(packet);
        var tcp = TcpPacket.GetEncapsulated(packet);
        if (ip != null && tcp != null && tcp.Syn && !tcp.Ack)
            Console.WriteLine("{0} -> {1} SYN to port 135", ip.SourceAddress, ip.DestinationAddress);
    }
}

Practical notes and next steps: run elevated; install Npcap with loopback if localhost capture is required; choose the correct adapter (loopback vs physical); look for heuristics (many distinct source IPs in seconds, repeated SYNs from same host) to reduce false positives. For production blocking or deep inspection consider the Windows Filtering Platform (WFP) or a network IDS/IPS at the gateway (Snort/Suricata). Obtain proper authorization before monitoring network traffic.

Recommended Answers

All 3 Replies

Member Avatar for floris

To be honest, I think installing a firewall like sygate personal firewall will do better and costs nothing. It allows you to control each port and manage the way probes are handled.

Member Avatar for amuarica

Yes , I know by installing firewall is better and cost nothing . But this is just for educational purpose . I want to learn the programming technique for that program . Can anybody here help me ?

Member Avatar for DanceInstructor

I might be wrong but this post would probably be more appropriate for the c++ forum (or some similar language) or maybe the networking forum.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.