Click here to Skip to main content
15,867,704 members
Articles / Programming Languages / C#

Packet Sniffing with Winpcap Functions Ported to a .NET Library

Rate me:
Please Sign up or sign in to vote.
4.83/5 (54 votes)
25 Mar 2009GPL32 min read 571.1K   15K   146   104
Using Winpcap functions in the .NET Framework
Sample Image - dotnetwinpcap.jpg

Introduction

Winpcap has been the de facto library in packet capture applications, but the problem is that it is only natively available for C++ and C.

This is an attempt to port some of the crucial Winpcap functions for the .NET environment. The demonstration project here is written in C#.

First of all, you need to install Winpcap from winpcap's Web site and then extract the project zip file. Be sure to reference dotnetwinpcap.dll in the project if not already so.

Methods Available

  • C#
    static ArrayList FindAllDevs()

    Returns an ArrayList of Device objects, each describing an Ethernet interface on the system.

  • C#
    bool Open(string source, int snaplen, int flags, int read_timeout)

    Opens an Ethernet interface with source as the name of the interface obtained from a Device object, snaplen is the max number of bytes to be captured from each packet, flags=1 means promiscuous mode, read_timeout is the blocking time of ReadNext before it returns.

  • C#
    PCAP_NEXT_EX_STATE ReadNext( out PacketHeader p, out byte[] packet_data)

    Reads a next packet and return the packet details (size and timestamp) to object p, and packet raw data in packet_data (array of bytes).

  • C#
    void StopDump()

    Stops dumping of capture data to a file.

  • C#
    bool StartDump(string filename) 

    Starts dumping of capture data to a file.

  • C#
    bool SetMinToCopy(int size)

    Sets the minimum number of bytes required to be received by the driver before OnReceivePacket fires. Lowering this can increase response time, but increases system calls which lowers program efficiency.

  • C#
    bool SetKernelBuffer(int bytes)

    Sets the number of bytes in the driver kernel buffer for packet capture. Increase this to avoid packet loss and improve performance. Default is 1 MB.

  • C#
    void StartListen()

    Starts listening for packets.

  • C#
    void StopListen()

    Stops listening for packets.

  • C#
    void Close()

    Stops all operations and releases all resources.

  • C#
    bool SendPacket(byte[] rawdata)

    Sends bytes contained in rawdata over the wire. The ethernet checksum will be automatically added prior to sending the packet. Returns true if send is successful, false otherwise.

Properties

  • C#
    bool IsListening

    true if the dotnetWinpcap object is listening, false otherwise.

  • C#
    string LastError

    Returns the last error encountered by the library, if any.

Event Support

C#
delegate void ReceivePacket (object sender, PacketHeader p, byte[] s);
event ReceivePacket OnReceivePacket;

Once StartListen() is called, OnReceivePacket will start to fire on every packet encountered, until StopListen() is called, or Close() is called.

Delegate objects of the above signature may be attached to the OnReceivePacket event to receive notification and perform further processing, as demonstrated in the demo source code.

History

  • 28th May, 2003: Initial post
  • 25th Aug 2003 - Updated source code
  • 28th June, 2008: Updated source code
  • 24th March, 2009: Updated source code to include client code as requested by Ashin

License

This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)


Written By
Australia Australia
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions

 
GeneralRe: Mail me the source code pls Pin
punkbuster6-Feb-06 11:55
punkbuster6-Feb-06 11:55 
GeneralRe: Mail me the source code pls Pin
ranchu panchu17-Jun-07 19:16
ranchu panchu17-Jun-07 19:16 
Questiondotnetwinpcap? Pin
bujia3-Oct-05 23:31
bujia3-Oct-05 23:31 
Generaldissecting IP packets in c# Pin
jose17058314-Sep-05 5:38
jose17058314-Sep-05 5:38 
Question17how to write an IDS? Pin
Member 216236312-Aug-05 3:05
Member 216236312-Aug-05 3:05 
QuestionContinue Project? Pin
eugenevd1-Aug-05 3:39
eugenevd1-Aug-05 3:39 
AnswerRe: Continue Project? Pin
windrago26-Feb-06 20:26
windrago26-Feb-06 20:26 
QuestionCommercial use? Pin
linevty0422-Jul-05 9:44
linevty0422-Jul-05 9:44 
GeneralMilliseconds Pin
skipi8316-Jun-05 6:41
skipi8316-Jun-05 6:41 
GeneralHeader informaton Pin
skipi836-Jun-05 14:18
skipi836-Jun-05 14:18 
GeneralRe: Header informaton Pin
orelero29-Dec-05 5:40
orelero29-Dec-05 5:40 
GeneralUsing Winpcap in MS VC++.NET Pin
Member 192319229-Apr-05 4:49
Member 192319229-Apr-05 4:49 
Generaltranslate to vb.net Pin
mvmelle26-Apr-05 23:43
mvmelle26-Apr-05 23:43 
GeneralRe: translate to vb.net Pin
hollowlife198711-Apr-06 13:50
hollowlife198711-Apr-06 13:50 
GeneralAssembling Packets Pin
RickLeinecker14-Mar-05 14:42
RickLeinecker14-Mar-05 14:42 
QuestionMinor logic move? Pin
David Vallner5-Mar-05 16:30
sussDavid Vallner5-Mar-05 16:30 
GeneralSource code of dotnetwinpcap please!! Pin
Thomas Chris15-Dec-04 8:50
sussThomas Chris15-Dec-04 8:50 
GeneralRe: Source code of dotnetwinpcap please!! Pin
Tony Antonucci30-Jul-05 19:00
Tony Antonucci30-Jul-05 19:00 
Generalthere is only one IP binds to the network adpter Pin
liuwanli8-Dec-04 3:55
liuwanli8-Dec-04 3:55 
QuestionCan I Get The source code of dotnetWinpcap.dll Pin
Eiba24-Oct-04 23:56
Eiba24-Oct-04 23:56 
GeneralFramework 1.1 Pin
Member 72049528-Jul-04 9:08
Member 72049528-Jul-04 9:08 
GeneralExcellent Work Pin
Lojikl11-Jun-04 4:00
Lojikl11-Jun-04 4:00 
GeneralRead the content without saving to a file Pin
dinushag12-May-04 23:07
dinushag12-May-04 23:07 
GeneralRe: Read the content without saving to a file Pin
13-May-04 13:42
suss13-May-04 13:42 
GeneralRe: Read the content without saving to a file Pin
dinushag20-May-04 20:35
dinushag20-May-04 20:35 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.