open procmon from sysinternals
add a filter with your process name
and take a look at stack trace
if you have configured symbols then you get a pretty good overview
a small python server and client (mod from wiki.python)
:\>cat server.py
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('127.0.0.1', 5005))
s.listen(1)
conn, addr = s.accept()
print 'Connection address:', addr
while 1:
data = conn.recv(20)
if not data: break
print "received data:", data
conn.send(data) # echo
conn.close()
:\>cat client.py
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 5005))
s.send("Hello, World!")
data = s.recv(1024)
s.close()
print "received data:", data
:\>
procmon filtering only network activity of python.exe

executing the server and client

procmon captured these network events

and here is the call stack for the First TcpConnectEvent
Frame, Module, Location
00, ntkrnlpa.exe, EtwpTraceNetwork + 0x55
01, tcpip.sys, TcpTraceConnectionEstablishment + 0xdc
02, tcpip.sys, TcpCreateAndConnectTcbComplete + 0x576
03, tcpip.sys, TcpSynchronizeTcbDelivery + 0x28
04, tcpip.sys, TcpTcbCarefulDatagram + 0x47e
05, tcpip.sys, TcpTcbReceive + 0x228
06, tcpip.sys, TcpMatchReceive + 0x237
07, tcpip.sys, TcpPreValidatedReceive + 0x293
8, tcpip.sys, TcpReceive + 0x2d
9, tcpip.sys, TcpNlClientReceiveDatagrams + 0x12
10, tcpip.sys, IppDeliverListToProtocol + 0x49
11, tcpip.sys, IppProcessDeliverList + 0x2a
12, tcpip.sys, IppReceiveHeaderBatch + 0x1fb
13, tcpip.sys, IppLoopbackTransmit + 0x226
14, tcpip.sys, IppLoopbackEnqueue + 0x13d
15, tcpip.sys, IppDispatchSendPacketHelper + 0xf6
16, tcpip.sys, IppPacketizeDatagrams + 0x8d6
17, tcpip.sys, IppSendDatagramsCommon + 0x652
18, tcpip.sys, IpNlpSendDatagrams + 0x4b
19, tcpip.sys, IppSlowSendDatagram + 0x31
20, tcpip.sys, IpNlpFastSendDatagram + 0x1067
21, tcpip.sys, TcpTcbSend + 0x787
22, tcpip.sys, TcpCreateAndConnectTcbRateLimitComplete + 0x6d2
23, tcpip.sys, TcpCreateAndConnectTcbInspectConnectComplete + 0x20d
24, tcpip.sys, TcpContinueCreateAndConnect + 0x69b
25, tcpip.sys, TcpCreateAndConnectTcbInspectConnectRequestComplete + 0xf8
26, tcpip.sys, TcpCreateAndConnectTcbWorkQueueRoutine + 0x4df
27, tcpip.sys, TcpCreateAndConnectTcb + 0x82a
28, afd.sys, AfdConnect + 0x826
29, afd.sys, AfdDispatchDeviceControl + 0x3b
30, ntkrnlpa.exe, IofCallDriver + 0x63
31, aswArPot.sys, aswArPot.sys + 0xfef3
32, ntkrnlpa.exe, IofCallDriver + 0x63
33, ntkrnlpa.exe, IopSynchronousServiceTail + 0x1f8
34, ntkrnlpa.exe, IopXxxControlFile + 0x6aa
35, ntkrnlpa.exe, NtDeviceIoControlFile + 0x2a
36, ntkrnlpa.exe, KiSystemServicePostCall
37, ntdll.dll, ZwDeviceIoControlFile + 0xc
38, mswsock.dll, SockDoConnectReal + 0x29e
39, mswsock.dll, SockDoConnect + 0x3a1
40, mswsock.dll, WSPConnect + 0x1f <<------
41, ws2_32.dll, connect + 0x52 <<<<----
42, _socket.pyd, init_sockobject + 0xf78 <<--parent
43, _socket.pyd, init_sockobject + 0x10f2
44, python27.dll, PyCFunction_Call + 0xe3
45, python27.dll, PyEval_GetFuncDesc + 0xb0a
46, python27.dll, PyEval_EvalFrameEx + 0x247b
47, python27.dll, PyEval_EvalCodeEx + 0x7dc
48, python27.dll, PyFunction_SetClosure + 0x9a1
49, python27.dll, PyObject_Call + 0x4c
50, python27.dll, python27.dll + 0x7ac5
51, python27.dll, PyObject_Call + 0x4c
52, python27.dll, PyEval_GetFuncDesc + 0x834
53, python27.dll, PyEval_GetFuncDesc + 0x3d5
54, python27.dll, PyEval_EvalFrameEx + 0x23cf
55, python27.dll, PyEval_EvalCodeEx + 0x7dc
56, python27.dll, PyRun_FileExFlags + 0xcf
57, python27.dll, PyRun_FileExFlags + 0x6e
58, python27.dll, PyRun_SimpleFileExFlags + 0x201
59, python27.dll, PyRun_AnyFileExFlags + 0x57
60, python27.dll, Py_Main + 0xa4c
61, python.exe, python.exe + 0x1180
62, kernel32.dll, BaseThreadInitThunk + 0xe
63, ntdll.dll, __RtlUserThreadStart + 0x70
64, ntdll.dll, _RtlUserThreadStart + 0x1b
send
andWSASend
are the common APIs for sending TCP packets. Note that some apps will import by ordinal, so you won't see the name in the import table.WSAStartup()
function. 2. Open that subroutine in graph mode. 3. Analyse that subroutine and it's child subroutines also in graph mode.