如何实现类似网络监视器的功能！(100分)

要求：监视所有访问本机文件的用户，以日志的形式记录访问者的相关资料（访问时间，离开时间，访问文件等）。
如何实现，望大虾们赐教！谢谢。

Windows系统有一套系统服务，端口可能小于1000,接管网络文件服务的端口，就可以监视了

能否详细点？谢谢！

对每个登录用户以IP为身份标志记录，其时间可以判断连接来确定系统时间定，
访问文件的问题用API函数可以简单实现，要想更好的效果就用COM进行系统功能扩展或者用VXD。
然后所有的储存到一个Log文件中即可！

< Network Services Information >
echo Service: port 7 using tcp
discard Service: port 9 using tcp
systat Service: port 11 using tcp
daytime Service: port 13 using tcp
netstat Service: port 15 using tcp
qotd Service: port 17 using tcp
chargen Service: port 19 using tcp
ftp-data Service: port 20 using tcp
ftp Service: port 21 using tcp
telnet Service: port 23 using tcp
smtp Service: port 25 using tcp
time Service: port 37 using tcp
rlp Service: port 39 using udp
name Service: port 42 using tcp
whois Service: port 43 using tcp
domain Service: port 53 using tcp
mtp Service: port 57 using tcp
bootp Service: port 67 using udp
tftp Service: port 69 using udp
rje Service: port 77 using tcp
finger Service: port 79 using tcp
link Service: port 87 using tcp
supdup Service: port 95 using tcp
hostnames Service: port 101 using tcp
iso-tsap Service: port 102 using tcp
dictionary Service: port 103 using tcp
x400-snd Service: port 104 using tcp
csnet-ns Service: port 105 using tcp
pop Service: port 109 using tcp
pop3 Service: port 110 using tcp
portmap Service: port 111 using tcp
auth Service: port 113 using tcp
sftp Service: port 115 using tcp
path Service: port 117 using tcp
nntp Service: port 119 using tcp
ntp Service: port 123 using udp
nbname Service: port 137 using udp
nbdatagram Service: port 138 using udp
nbsession Service: port 139 using tcp
NeWS Service: port 144 using tcp
sgmp Service: port 153 using udp
tcprepo Service: port 158 using tcp
snmp Service: port 161 using udp
snmp-trap Service: port 162 using udp
print-srv Service: port 170 using tcp
vmnet Service: port 175 using tcp
load Service: port 315 using udp
vmnet0 Service: port 400 using tcp
sytek Service: port 500 using udp
biff Service: port 512 using udp
login Service: port 513 using tcp
shell Service: port 514 using tcp
printer Service: port 515 using tcp
talk Service: port 517 using udp
ntalk Service: port 518 using udp
efs Service: port 520 using tcp
timed Service: port 525 using udp
tempo Service: port 526 using tcp
courier Service: port 530 using tcp
conference Service: port 531 using tcp
netnews Service: port 532 using tcp
netwall Service: port 533 using udp
uucp Service: port 540 using tcp
klogin Service: port 543 using tcp
kshell Service: port 544 using tcp
new-rwho Service: port 550 using udp
remotefs Service: port 556 using tcp
rmonitor Service: port 560 using udp
monitor Service: port 561 using udp
garcon Service: port 600 using tcp
maitrd Service: port 601 using tcp
busboy Service: port 602 using tcp
acctmaster Service: port 700 using udp
acctslave Service: port 701 using udp
acct Service: port 702 using udp
acctlogin Service: port 703 using udp
acctprinter Service: port 704 using udp
acctinfo Service: port 705 using udp
acctslave2 Service: port 706 using udp
acctdisk Service: port 707 using udp
kerberos Service: port 750 using tcp
kerberos_master Service: port 751 using tcp
passwd_server Service: port 752 using udp
userreg_server Service: port 753 using udp
krb_prop Service: port 754 using tcp
erlogin Service: port 888 using tcp