Advanced controls like WINSOCK cannot be implemented.
This kind of software can be obtained by intercepting network card data, and then the corresponding data can be distinguished by port number discrimination.
In addition, IIS has log files, so just learn and analyze IIS log files directly.