Programmatically getting per-process network statistics on Windows?

I wrote a solution to this.

A TDI filter driver to collect the stats, a service which communicates with the driver and gets the stats once per second. Since the filter is at the TDI layer, I know which sockets belong to which applications. The service is a server for this data, offering it via shared memory to arbitrary third party clients via an API I wrote. I wrote a GUI and a command line client.

You can also bandwidth shape sends (per interface and/or application and/or socket) and watch data passing over a socket in real time, in a window.

You will need to use the IPHelper API.

Here is a good article detailing its use from .NET: http://www.codeproject.com/KB/IP/iphlpapi.aspx

Enjoy.

After quite of research here's what I've come up with:

1. There are a number of posts in various forums asking for this same info.
2. The only possible programmatic solution I saw was to use Event Tracing for Windows (ETW). That would take a small book to explain/understand.
3. The PERF counters, which can be obtained from the registry, are not Powershell friendly. They use data structures that are designed to be consumed by C/C++ programs. URL of a pretty complete example: http://msdn.microsoft.com/en-us/library/windows/desktop/aa372138(v=vs.85).aspx
4. SysInternals has TCPVIEW which shows network usage by process. When you start it most processes don't show any usage. It appears to only collect usage info for the time period it is running. Which lends weight to the idea that ETW is being used.
5. If I browsed websites with IE9, I would see processes being created in TCPVIEW. In most cases the processes would disappear (terminate) within a minute or so - along with the stats of the process.
6. Similarly to ProcessExplorer, when processes are created they are highlighted green, and when they are destroyed they are highlighted red.
7. Red highlighted processes disappear after the next Update. Update frequency can be 1, 2, or 5 seconds. However there is a registry settings, HKEY_CURRENT_USER\Software\Sysinternals\TCPView\Settings which can be modified to set other refresh frequencies. If is a DWORD at offset 0x98, and is in milliseconds.
8. TCPVIEW has a "Save"/"Save As" menu item. The output is a space delimited text file that has the per process usage stats that are currently displayed in the GUI. Below is a sample line from the file. The numbers at the end of the line are received pkts/sec, received bytes/sec, transmitted pkts/sec and bytes/sec, (not necessarily in that order) iexplore.exe 864 TCP tin 61207 a96-17-203-64.deploy.akamaitechnologies.com http ESTABLISHED 2 12,928 8 9,420

So...

A possible solution is to use TCPVIEW and control it via key strokes generated programmatically from a script. You could set the refresh interval to 1, 10, 30, etc. minutes and have the script send the keystrokes to make TCPVIEW save the output in a file. You'd probably want the script to send the keystrokes at half or a third of the refresh interval, to make sure you are getting a snapshot that is at least as long as 1/2 or 2/3 of the refresh interval. You could import the file using Import-CSV, and easily manipulate it within the script.

Or...

You could get masochistic and use ETW.

Or...

You could go off the deep end and port Linux's proc file system (which, as you noted, is a lot easier to use from scripts) to Windows :-)