Abstract: Network protocol communications used by an application are captured and analyzed. Routines corresponding to particular calls that an application invokes in implementing a targeted network communication protocol are hooked. A stub is called, which retains a current state of the application in a memory location that will not be compromised, and calls second stage code that makes the call on behalf of the application. Information corresponding to the performance of the call is captured and may be variously analyzed. Upon a completion of call, control is returned to the stub, which restores and adjusts the application state to reflect the actual performance of the particular call. The stub can also restore the application and allow the call to proceed transparently to the application, should the monitoring process be terminated prior to completion of the call. In one embodiment, TCP/IP protocol communications are monitored by hooking socket calls made by an application.