Identify source session condaction nw activity

[Guest Nilesh]

Hi,

 

I am trying to distinguish a network connection, particularly SMB

connection, based on its source Terminal Session.

 

Using network management APIs I can distinguish it based on User, however it

is possible that the same user can logon to two different TS sessions at same

time.

 

At TDI or NDIS level I am not able to find any identifier to distinguish

between different TS session.

 

Is there any way to do this either in user or kernel mode?

 

Thank in advance..

Nilesh