in Development

Handling Network Connections

Talking again about my virus there was another nice thing it was doing, the virus opened IE windows redirecting to an antivirus page (it was an ironic virus).

The cool thing is that it only tried to do it when I was connected to my router, setting the browser to work offline was not enough since it tried to connect anyway in the background, but when I had my cable disconnected the virus didn’t try. So I guess the virus was monitoring the network status.

To reproduce this I think the best would be to use WMI, because it provides us all kind of information regarding the system including this one. I’ve build a very simple class that catches the WMI events and throws a custom event notifying that the cable is connected or disconnected.

If you want to build an application that makes use of it you only need to create the handlers for the events NetworkConnect and NetworkDisconnect, and use the methods Start and Stop for monitoring the network, I think they are quite descriptive. Don’t forget to call Dispose when are finished with the NetworkManager.

   1: public class NetworkEventArgs
   2: {
   3:     string instanceName;
   4:  
   5:     public string InstanceName
   6:     {
   7:         get { return instanceName; }
   8:     }
   9:  
  10:     public NetworkEventArgs(string name)
  11:     {
  12:         instanceName = name;
  13:     }
  14: }
  15:  
  16: public class NetworkManager : IDisposable
  17: {
  18:     private ManagementEventWatcher wmiDisconnect;
  19:     private ManagementEventWatcher wmiConnect;
  20:  
  21:     public delegate void NetworkEventHandler(object sender, NetworkEventArgs e);
  22:  
  23:     public event NetworkEventHandler NetworkDisconnect;
  24:     public event NetworkEventHandler NetworkConnect;
  25:  
  26:     private bool disposed;
  27:  
  28:     #region Constructor
  29:     public NetworkManager()
  30:     {
  31:         wmiDisconnect = new ManagementEventWatcher(
  32:                 "SELECT * FROM MSNdis_StatusMediaDisconnect");
  33:         wmiConnect = new ManagementEventWatcher(
  34:                 "SELECT * FROM MSNdis_StatusMediaConnect");
  35:  
  36:         wmiDisconnect.Scope = new ManagementScope(@"root\WMI");
  37:         wmiConnect.Scope = new ManagementScope(@"root\WMI");
  38:  
  39:         wmiDisconnect.EventArrived += new EventArrivedEventHandler(WMIDisconnect_EventArrived);
  40:         wmiConnect.EventArrived += new EventArrivedEventHandler(WMIConnect_EventArrived);
  41:     }
  42:     #endregion Stop
  43:  
  44:     #region Wmi Events
  45:     private void WMIDisconnect_EventArrived(object sender, EventArrivedEventArgs e)
  46:     {
  47:         string instanceName = e.NewEvent.Properties["InstanceName"].Value as string;
  48:  
  49:         OnNetworkDisconnect(instanceName);
  50:     }
  51:  
  52:     private void WMIConnect_EventArrived(object sender, EventArrivedEventArgs e)
  53:     {
  54:         string instanceName = e.NewEvent.Properties["InstanceName"].Value as string;
  55:  
  56:         OnNetworkConnect(instanceName);
  57:     }
  58:     #endregion Wmi Events
  59:  
  60:     #region Event Firing
  61:     protected void OnNetworkConnect(string instanceName)
  62:     {
  63:         NetworkEventHandler networkConnect = NetworkConnect;
  64:  
  65:         if (networkConnect != null)
  66:             NetworkConnect(this, new NetworkEventArgs(instanceName));
  67:     }
  68:  
  69:     protected void OnNetworkDisconnect(string instanceName)
  70:     {
  71:         NetworkEventHandler networkDisconnect = NetworkDisconnect;
  72:  
  73:         if (networkDisconnect != null)
  74:             NetworkDisconnect(this, new NetworkEventArgs(instanceName));
  75:     }
  76:     #endregion Event Firing
  77:  
  78:     #region Start
  79:     public void Start()
  80:     {
  81:         if (disposed)
  82:             throw new ObjectDisposedException("NetworkManager");
  83:  
  84:         wmiDisconnect.Start();
  85:         wmiConnect.Start();
  86:     }
  87:     #endregion Start
  88:     
  89:     #region Stop
  90:     public void Stop()
  91:     {
  92:         if (disposed)
  93:             throw new ObjectDisposedException("NetworkManager");
  94:  
  95:         wmiDisconnect.Stop();
  96:         wmiConnect.Stop();
  97:     }
  98:     #endregion Stop
  99:  
 100:     #region Dispose Related
 101:     public void Dispose()
 102:     {
 103:         Dispose(true);
 104:  
 105:         GC.SuppressFinalize(this);
 106:     }
 107:  
 108:     protected virtual void Dispose(bool disposing)
 109:     {
 110:         if (!this.disposed)
 111:         {
 112:             if (disposing)
 113:             {
 114:                 Stop();
 115:  
 116:                 wmiConnect.Dispose();
 117:                 wmiDisconnect.Dispose();
 118:             }
 119:             disposed = true;
 120:         }
 121:     }
 122:  
 123:     ~NetworkManager()
 124:     {
 125:         Dispose(false);
 126:     }
 127:     #endregion Dispose Related
 128: }