packet sniffing in windows.
Results 1 to 8 of 8

Thread: packet sniffing in windows.

  1. #1

    Angry packet sniffing in windows.

    Hi,
    i planned to do packet sniffing for my curriculam project
    and i am able to do in linux using
    netinet/ but i donno how to do in windows
    some of the versions not allowing raw socket,
    sock_packet,how can i write program in linux,
    thanx in advance.

    - lok.

  2. #2
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,403
    Look for windump (windows version of tcpdump) and there's a windows version of Ethereal.

    Edit: Ah. Misunderstood you. Take alook at WinPcap. It's the windows version of libpcap, a unix packet capture library (ethereal uses it too).
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #3
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    You'll need to install WinPCap, the Windows Packet Capture driver for those programs too. After that it's all pretty seamless.
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  4. #4
    Hi thank you all.
    I knew about winpcap. But i want to is there any library routines provide by microsoft to access low
    level sockets.(i.e., how winpcap works.... is it a device driver or prg. if prg then which function it will use
    to capture the packes.

    -lok

  5. #5
    Senior Member
    Join Date
    Apr 2003
    Posts
    147
    LibnetNT It's what nemesis uses, and some others. Should be just what you need.

    http://www.eeye.com/html/Research/Tools/libnetnt.html

    ~UpperCell.

  6. #6
    Hi UpperCell,
    Ya this libnetnt is talking about the packet capturing ...still he need winpcap..

    I want to know windows provide any api to capture the packet in link layer..

    or we have to write our device driver to catch those things..

    thank you.

    -lok

  7. #7
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,403
    Take a look at IDelaydC. It's part of the Network Monitor.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  8. #8
    Senior Member
    Join Date
    Jul 2002
    Posts
    339
    Hi, you can use winpcap to capture packets as suggested by some members.

    Make sure that you download and install the Developer's Pack version. The latest version is 3.1 beta but you may want to stay at 3.0. Then read the documentation (included in the Dev's Pack). Or read it online here:
    http://winpcap.polito.it/docs/man/html/index.html

    If you're impatient, go straight to "Opening an adapter and capturing the packets" or
    http://winpcap.polito.it/docs/man/ht...cap__tut3.html

    It explains nicely (with a sample program) how to open a device (interface) and capture the transiting packets. Use pcap_findalldevs() to find all available devices, pcap_open_live() to open a device, and pcap_loop() to start capturing.

    Hope this helps.

    Peace always,
    <jdenny>
    Always listen to experts. They\'ll tell you what can\'t be done and why. Then go and do it. -- Robert Heinlein
    I\'m basically a very lazy person who likes to get credit for things other people actually do. -- Linus Torvalds


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides