packet sniffing in windows.

[lokes_ooty]

Hi,
i planned to do packet sniffing for my curriculam project
and i am able to do in linux using
netinet/ but i donno how to do in windows
some of the versions not allowing raw socket,
sock_packet,how can i write program in linux,
thanx in advance.

- lok.

[SirDice]

Look for windump (windows version of tcpdump) and there's a windows version of Ethereal.

Edit: Ah. Misunderstood you. Take alook at WinPcap. It's the windows version of libpcap, a unix packet capture library (ethereal uses it too).

[Tiger Shark]

You'll need to install WinPCap, the Windows Packet Capture driver for those programs too. After that it's all pretty seamless.

[lokes_ooty]

Hi thank you all.
I knew about winpcap. But i want to is there any library routines provide by microsoft to access low
level sockets.(i.e., how winpcap works.... is it a device driver or prg. if prg then which function it will use
to capture the packes.

-lok

[UpperCell]

LibnetNT It's what nemesis uses, and some others. Should be just what you need.

http://www.eeye.com/html/Research/Tools/libnetnt.html

~UpperCell.

[lokes_ooty]

Hi UpperCell,
Ya this libnetnt is talking about the packet capturing ...still he need winpcap..

I want to know windows provide any api to capture the packet in link layer..

or we have to write our device driver to catch those things..

thank you.

-lok

[SirDice]

Take a look at IDelaydC. It's part of the Network Monitor.

[jdenny]

Hi, you can use winpcap to capture packets as suggested by some members.

Make sure that you download and install the Developer's Pack version. The latest version is 3.1 beta but you may want to stay at 3.0. Then read the documentation (included in the Dev's Pack). Or read it online here:
http://winpcap.polito.it/docs/man/html/index.html

If you're impatient, go straight to "Opening an adapter and capturing the packets" or
http://winpcap.polito.it/docs/man/ht...cap__tut3.html

It explains nicely (with a sample program) how to open a device (interface) and capture the transiting packets. Use pcap_findalldevs() to find all available devices, pcap_open_live() to open a device, and pcap_loop() to start capturing.

Hope this helps.

Peace always,
<jdenny>