2、屏幕监控
当服务器系统发现TCP异常连接时，可通过屏幕监控功能将局域网中被监控工作站的屏幕画面抓取到服务器中并实施相应措施，如对工作站锁机或关机等。此处用到WINSOCK控件，其通讯原理请参阅相关资料，屏幕监控功能用到TCP协议，为了达到更好的效果,可在窗体中加入TIMER控件,设定TIMER事件。
(1) 工作站端
侦听并响应服务器端发出的连接请求和屏幕抓取。其中屏幕抓取功能可通过API函数实现：
Dim a As String
Winsock1.GetData a, vbString
Select Case a
Case "zp"
Picture1.AutoRedraw = True
Picture1.ScaleMode = 1
lDesktop = GetDesktopWindow()
lDC = GetDC(lDesktop)
BitBlt Picture1.hdc, 0, 0, Screen.Width, _
Screen.Height, lDC,0, 0, vbSrcCopy
'获取图像数组
SavePicture Picture1.Image, filename
Winsock1.SendData "okm"
Dim myfile() As Byte
Case "fir" '传第一块图
Open filename For Binary As #1
filelen = LOF(1)
ReDim myfile(1 To blocksize) As Byte
'（const blocksize=3072）
Get #1, , myfile
Winsock1.SendData myfile
curpos = blocksize
Case "next" ‘传其它块
If curpos = filelen Then
Winsock1.SendData "end"
Close #1
Exit Sub
End If
j = curpos + blocksize
If j ＞ filelen Then
j = filelen - curpos
Else
j = blocksize
End If
ReDim myfile(1 To j) As Byte
Get #1, , myfile
Winsock1.SendData myfile
curpos = curpos + j
End Select
注意：以上功能在WINSOCK的DataArrival事件中实现。抓取的图象数据量较大，所以需要分块传输。
(2) 服务器端
DataArrival 事件代码：
Dim receivefile() As Byte
ReDim receivefile(bytesTotal) As Byte
Winsock1.GetData receivefile, vbArray + vbByte
'告诉Winsock控件收到的是字节数组类型的数据
If Chr(receivefile(0)) = "o" And _
Chr(receivefile(1)) = "k" And _
Chr(receivefile(2)) = "m" Then
If Dir$(filename) ＜＞ "" Then Kill filename
' 打开文件，准备存储图像
Open filename For Binary As #1
filelen = 0
Winsock1.SendData "fir"
Exit Sub
End If
If Chr(receivefile(0)) = "e" And _
Chr(receivefile(1)) = "n" And _
Chr(receivefile(2)) = "d" Then
Label1.Caption = "end"
Close #1
Picture1.Picture = LoadPicture(filename) '显示图象
Exit Sub
End If
Put #1, , receivefile
Winsock1.SendData "next"
3、其它功能
主要用到一些API函数，如实现屏幕锁定和解锁操作可使用Enable Window,实现关机功能用ExitWindowsEx, 服务器和工作站之间的信息互送用到WINSOCK控件的UDP协议,具体用法请参阅有关资料。
结束语
通过在基本的网络监控系统增加入侵检测，就能够极大提高网络的整体安全性，使之更灵敏、更智能，大大降低入侵的成功率。
