Generally, packet capture tools use the WinPcap library to capture packets:
Winpcap (Windows Packet Capture) is the next free, public network access system for the Windows platform. The purpose of developing Winpcap is to provide Win32 applications with access to the underlying network. It is used for direct network programming under Windows system.
Winpcap provides a powerful programming interface that is easily portable between operating systems and is easy for programmers to develop. What kind of programs need to use Winpcap Winpcap is used for network analysis, troubleshooting, network security monitoring, and more. Winpcap is particularly suitable for the following classic areas: 1. Network and protocol analysis 2. Network monitoring 3. Communication log recording 4、traffic generators 5. User-level bridges and routes 6. Network intrusion detection system (NIDS) 7. Network scanning 8. Safety tools There are some aspects that Winpcap can't do. It does not rely on the host's TCP/IP protocol to send and receive packets. This means that it cannot block and cannot process communication data between programs in the same host. It can only "sniff" packets on a physical line. Therefore, it does not work with traffic shapers, QoS scheduling, and personal firewalls. Winpcap internals Winpcap is a Win32 platform for packet capture and analysis. Includes a kernel-level packet filter, an underlying DLL (packet.dll) and an advanced system-independent DLL (Wpcap.dll) However, I can't call WinPcap well in C#, and then I want to write a packet capture tool, so I can only write it in SharpPcap.
SharpPcap is a . NET environment, developed based on the well-known pcap/WinPcap library. Provides capture, inject, analyze, and build capabilities for both C# and VB NET development languages. The functions implemented are:
It can grab TCP and UDP packets, as well as packets from other machines, that is, ARP
Then, you can set the filter criteria
Demo and source code download:
Tourists, if you want to see the hidden content of this post, please Reply
|