如何捕获局域网哪个计算机对服务器上的共享目录进行了文件操作

Question

如何捕获局域网哪个计算机对服务器上的共享目录进行了文件操作,包括那台计算机ip地址或是用户名，有没有相关控件或是API函数.

Answer 1

不是簡單的api 可完成的!!應該有好几種做法!!
一種, 就是用 sniffer 之類的, 但實現起來比較難!另外一種, 就是, windows的提供一些網絡管理的api, 可操作!
大概是這樣, 現成的代碼就沒有

Answer 2

监控port应该可以实现吧，具体倒没有做过。
帮你UP

Answer 3

可以参考一下下面的程序：
procedure TMain.GetTcpUdpInfo();                //Get the tcp/udp info
var
   TcpInfoTable, UdpInfoTable: TTcpInfo;
   hTrapEvent: THandle;
   hIdentifier, Oid: TAsnObjectIdentifier;
   VarBindList: TSnmpVarBindList;
   VarBind: TSnmpVarBind;
   errorStatus, errorIndex: TAsnInteger32;
   currentEntry, newEntry: PTcpInfo;
   currentIndex: UINT;
   localaddr, localport, remoteaddr,remoteport: string;
begin
     if not SnmpExtensionInit(GetTickCount, @hTrapEvent, @hIdentifier) then Exit;
     { TCP connections }
     FillChar(Oid, SizeOf(Oid), 0);
     FillChar(VarBindList, SizeOf(VarBindList), 0);
     FillChar(VarBind, SizeOf(VarBind), 0);
     Oid.idLength := 10;
     Oid.ids := @TcpIdentifiers;
     SnmpUtilOidAppend(@VarBind.name, @Oid);
     VarBind.value.asnType := ASN_NULL;
     VarBindList.list := @VarBind;
     VarBindList.len := 1;
     FillChar(TcpInfoTable, SizeOf(TcpInfoTable), 0);
     TcpInfoTable.prev := @TcpInfoTable;
     TcpInfoTable.next := @TcpInfoTable;
     currentIndex := 1;
     currentEntry := @TcpInfoTable;
     while True do
     begin
          if not SnmpExtensionQuery(SNMP_PDU_GETNEXT,
                                    @VarBindList,
                                    @errorStatus,
                                    @errorIndex) then Exit;
          if VarBind.name.idLength < 10 then Break;
          if currentIndex <> PIds(VarBind.name.ids)^[9] then
          begin
               currentEntry := TcpInfoTable.next;
               currentIndex := PIds(VarBind.name.ids)^[9];
          end;
          case currentIndex of
            1: begin
                    newEntry := PTcpInfo(AllocMem(SizeOf(TTcpInfo)));
                    newEntry^.prev := currentEntry;
                    newEntry^.next := @TcpInfoTable;
                    currentEntry^.next := newEntry;
                    currentEntry := newEntry;
                    currentEntry^.state := VarBind.value.number;
               end;
            2: begin
                    currentEntry^.localip := (PUINT(VarBind.value.address.stream))^;
                    currentEntry := currentEntry^.next;
               end;
            3: begin
                    currentEntry^.localport := VarBind.value.number;
                    currentEntry := currentEntry^.next;
               end;
            4: begin
                    currentEntry^.remoteip := (PUINT(VarBind.value.address.stream))^;
                    currentEntry := currentEntry^.next;
               end;
            5: begin
                    currentEntry^.remoteport := VarBind.value.number;
                    currentEntry := currentEntry^.next;
               end;
          end;
     end;
     with tvtcpudp.Items do
     begin
          BeginUpdate;
          Clear;
          EndUpdate;
     end;
     currentEntry := TcpInfoTable.next;
     while currentEntry <> @TcpInfoTable do
     begin
          localaddr := Format('%s',
                             [GetHost(True, currentEntry^.localip)]);
          localport := Format('%s',
                              [GetPort(currentEntry^.localport, 'tcp')]);
          if currentEntry^.remoteip = 0 then
             remoteaddr := Format('%s: %s',
                                 [GetHost(False, currentEntry^.remoteip), '0'])
          else
             remoteaddr := Format('%s',
                                 [GetHost(False, currentEntry^.remoteip)]);             remoteport := Format('%s',
                                  [GetPort(currentEntry^.remoteport, 'tcp')]);             
          with tvtcpudp.Items.Add do
          begin
               ImageIndex := 0;
               Caption := 'TCP';
               SubItems.Add(localaddr);
               SubItems.Add(localport);               
               SubItems.Add(remoteaddr);
               if (currentEntry^.state =2) then SubItems.Add('')
               else SubItems.Add(remoteport);
               SubItems.Add(TcpState[currentEntry^.state]);
          end;
          currentEntry := currentEntry^.next;
     end;
     { UDP connections }
          FillChar(Oid, SizeOf(Oid), 0);
          FillChar(VarBindList, SizeOf(VarBindList), 0);
          FillChar(VarBind, SizeOf(VarBind), 0);
          Oid.idLength := 10;
          Oid.ids := @UdpIdentifiers;
          SnmpUtilOidAppend(@VarBind.name, @Oid);
          VarBind.value.asnType := ASN_NULL;
          VarBindList.list := @VarBind;
          VarBindList.len := 1;
          FillChar(UdpInfoTable, SizeOf(UdpInfoTable), 0);
          UdpInfoTable.prev := @UdpInfoTable;
          UdpInfoTable.next := @UdpInfoTable;
          currentIndex := 1;
          currentEntry := @UdpInfoTable;
          while True do
          begin
               if not SnmpExtensionQuery(SNMP_PDU_GETNEXT,
                                         @VarBindList,
                                         @errorStatus,
                                         @errorIndex) then Exit;
               if VarBind.name.idLength < 10 then Break;
               if currentIndex <> PIds(VarBind.name.ids)^[9] then
               begin
                    currentEntry := UdpInfoTable.next;
                    currentIndex := PIds(VarBind.name.ids)^[9];
               end;
               case currentIndex of
                 1: begin
                         newEntry := PTcpInfo(AllocMem(SizeOf(TTcpInfo)));
                         newEntry^.prev := currentEntry;
                         newEntry^.next := @UdpInfoTable;
                         currentEntry^.next := newEntry;
                         currentEntry := newEntry;
                         currentEntry^.localip := (PUINT(VarBind.value.address.stream))^;
                    end;
                 2: begin
                         currentEntry^.localport := VarBind.value.number;
                         currentEntry := currentEntry^.next;
                    end;
               end;
          end;
          currentEntry := UdpInfoTable.next;
          while currentEntry <> @UdpInfoTable do
          begin
               localaddr := Format('%s',
                                  [GetHost(True, currentEntry^.localip)]);               localport := Format('%s', [GetPort(currentEntry^.localport, 'udp')]);
               remoteaddr := '*.*.*.*: *';
               with tvtcpudp.Items.Add do
               begin
                    ImageIndex := 8;
                    Caption := 'UDP';
                    SubItems.Add(localaddr);
                    SubItems.Add(localport);
                    SubItems.Add(remoteaddr);
                    SubItems.Add('*');
                    SubItems.Add('');
               end;
               currentEntry := currentEntry^.next;
          end;
          sbStatus.Panels[0].Text := M_TCPUDP;
end;