A method of tracing data on a network that detects receive and send events
in a protocol stack is provided. The method provides key information for
capacity planners for correctly charging network traffic to the
individual services and applications. The TCP/IP stack is instrumented at
the transport layer, so that Input/Output Request packets (IRP)
representing sends and receives can be detected as they pass through the
stack. When such packets are detected an appropriate send or receive
event is recorded in a trace log.