Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5 Implementation
5.1 Introduction
The three components, the event logger, the data archiving system and event viewer,
that have been developed were created using C# and the .NET framework that is
provided by Microsoft. These were chosen for their rapid deployment ability, and they
fully support such things as XML, encryption and socket programming.
5.2 Event Logger
The event logging application will be resident on the client machine, its purpose is to
monitor the file system for files within specified directories being modified. After it
has captured these events it then constructs an XML sting that conatins all the ddetials
of the event, this than has a hash signature tagged onto it. The whole string gets
encrypted and sent to the data archiving system.
5.2.1 Connecting to Server
Figure 20 shows the code that is used for the Client to be able to establish a TCP
connection to the server. The code allows for IP Addresses, Domain Names and local
machine names to be entered for the server, it resolves them by using DNS.
Console.Write("Connecting to server... ");
Byte[] data = new byte[10240];
IPHostEntry host = Dns.GetHostEntry("localhost");
IPAddress ipAddr = host.AddressList[0];
// Specify the port to connect too.
IPEndPoint ipep = new IPEndPoint(ipAddr, 13000);
// Specify the path to watch.
Socket server = new
Socket(AddressFamily.InterNetwork,SocketType.Stream,
ProtocolType.Tcp);
try
{
server.Connect(ipep);
}
catch (SocketException e)
{
Console.WriteLine("Failed!");
Console.WriteLine(e.ToString());
Console.ReadLine();
return;
}
Figure 20: Connecting to a Server
41