Click here to Skip to main content

Article

RawSocket Class-Create Network Monitoring (Packet Sniffing) Apps

Lyle Brown

Rate me:

4.83/5 (17 votes)

11 Apr 2002

252.9K

3.2K

71

50

A class for creating Network Monitoring Programs

Introduction

This program illustrates the use of the RawSocket class which is written in C#. The class RawSocket is a packet sniffing class that fires notification events when an IP packet is received. This makes using the class simple. Just declare your RawSocket object, instantiate it, and register to be notified when the event fires.

When the event fires, you are sent event arguments which give your program access to everything in the IP packet including things like IP addresses, port numbers, protocols, message lengths, and of course the message contents.

The included Windows form is a simplified example which basically just shows the origination and destination IP addresses for all incoming packets on a listbox control. The Rawsocket class makes creating more sophisticated network monitoring applications easy.

This program relies on Winsock 2 and runs only on Win2000 or WinXP.

Please email comments and improvements to:

Kember Brown
kbrown@internetcds.com

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

Written By

Lyle Brown

Web Developer

United States

Lyle is a computer programmer in Vancouver, Washington.

Comments and Discussions

Gary Brewer2-Apr-03 4:09

2-Apr-03 4:09

Hi
I am working on something similar, but trying to send UDP packets out rather than back in.

I do it as follows -

<br />
Socket sender=new Socket(AddressFamily.InterNetwork,SocketType.Raw,ProtocolType.Raw);<br />
sender.SetSocketOption(SocketOptionLevel.IP,SocketOptionName.HeaderIncluded,1);<br />
sender.SetSocketOption(SocketOptionLevel.IP,SocketOptionName.MulticastInterface,(int)IPAddress.Parse(dest_ip).Address);<br />
sender.Connect(new IPEndPoint(IPAddress.Parse(mcast_addr),0));<br />

then I send the data out using

sender.Send(b,0,len,SocketFlags.None);

Where b is the buffer and is exactly the same as the incoming buffer used in the example in this article.

However, my output data seems to be a larger packet than my input data! Why is this????

Regards,

Gary Confused | :confused:

Confused | :confused:

Anonymous18-Apr-03 5:12

18-Apr-03 5:12

If you want to send 3 bytes of UDP data out to somewhere, then after UDP headers, etc. are added the total byte count will definitely be more than 3 bytes. There is some overhead added by the UDP protocol.

Gary Brewer22-Apr-03 4:54

22-Apr-03 4:54

Anonymous wrote:
If you want to send 3 bytes of UDP data out to somewhere, then after UDP headers, etc. are added the total byte count will definitely be more than 3 bytes. There is some overhead added by the UDP protocol.

Why would there be UDP headers added to the message if I have HeaderIncluded set to true?

Calamitous2-Sep-02 23:00

2-Sep-02 23:00

hi!
Anybody converted this great class or something similar to VB(.net)? if anybody has something pls mail me!

Pyt15-Aug-02 4:25

15-Aug-02 4:25

Hi,

I've tried to use your class to monitor my internet connection, i tried downloading a 808kb file but I don't seem to get it right, I end up reporting a size of 383kb.
I'm just adding the size of all incoming packets and I imagine the total length should at least be the size of the file.

Any idea? Have I got it totally wrong ? Or maybe that class should be used for that?

Thanks for your help.

Re: Packets length

Lyle Smith15-Aug-02 6:39

15-Aug-02 6:39

I created a test program and found the same results. My totals were about half of what they should have been.

I think the packet sniffer is reporting the correct byte count on what it receives, but that it is only receiving about half the packets. The packet sniffer, since it is running on the same machine as the app that is really receiving the packets, is not in sync with the incoming data. I think if you put your sniffer on a fast machine on the same hub (not a switch) so it can listen to all incoming traffic and can easily keep up, it will count the proper number of incoming bytes.

Problems occur when you are sniffing data coming to the same machine.

Let me know if anyone can prove the above. My network is on switches now and I can only receive broadcast traffic on my sniffer.

Lyle.

Re: Packets length

Pyt15-Aug-02 14:55

15-Aug-02 14:55

Thanks for the details Lyle.
I've notice something I found weird myself, the longest packet length I ever received was 1480, when I download that file I had almost only packets with 1480 bytes. Is that normal, I mean I would expect something more like 4096 bytes/packet.
What do you think ?

Pyt

Re: Packets length

Lul Brown19-Aug-02 5:33

19-Aug-02 5:33

The packet length on my machine was the same (1480.) I assumed that was normal (the packet sniffer doesn't control that.) I would have to check out a tcpip book to see what controls the packet length.

Lyle.

Re: Packets length

Carver18-Sep-02 4:25

18-Sep-02 4:25

MTU for ethernet (Maximum TRansmission Unit) is 1536 bytes per packet (or something similar, I should know off the top of my head but sleep depervation has a habit of muddling my head this is the Ethernet spec, RFC xxxxx Smile | :)

Smile | :)

I just dl'd the source and haven't had a chance to thoroughly look through it but...

MTU is controlled via ICMP messages exchanged between hosts / intermediate routers and the actual value is determined by the mediums and transports used.

I.E. a hardware ipsec VPN (like a Cisco Router to Router NEtwork to Network VPN) encrypts a packet and encapsulates it in another - total packet size must still be less than 1536 - so - native MTU ends up being 1536 - vpn overhead (effectively the size of the packet header, the original packet is encrypted and becomes the "Data payload" of the new packet) or 1480 or so (PPPoE for dsl is also an encapsulation mechanism, requireing a lower MTU to avoid packet fragmentation...)

17-Jun-02 9:45

17-Jun-02 9:45

Is there a bug with SIO_RCVALL? The program works for all INCOMING information. But the program doesn't seem to catch all OUTGOING information. For instance, when testing with AOL IM, it caught all incoming information, but not the outgoing messages from me.
Any ideas about this?

Re: Bug SIO_RCVALL

Lyle Brown18-Jun-02 10:56

18-Jun-02 10:56

I don't know how to catch outgoing packets as well as incoming.

I have a C sniffer and a .NET sniffer and they both work the same way....they only capture incoming packets. You could put the sniffer on another machine of course and then capture your AOL IM packets from your machine.

Lyle Brown

Re: Bug SIO_RCVALL

summo17-Jan-03 5:19

17-Jan-03 5:19

I am having a problem with using this SIO_RCVALL. please if you can send me the code of using this function of wsaioctl Api also please if you can tell me why do we use raw sockets for capturing packets.
sorry i am not been able to answer your question rather I have put my own.
Please help me, I am relatively new to Vc++.

Reply me soon

Re: Bug SIO_RCVALL

Anonymous30-Jan-03 19:42

30-Jan-03 19:42

There is C code examples at:

http://www.56chevy.com/web/DownLoads.html

This has full source to a c sniffer.

Lyle.

Re: Bug SIO_RCVALL

SpaceQ18-Nov-03 21:55

18-Nov-03 21:55

optval = SIO_RCVALL;
if (WSAIoctl(s, dwIoControlCode, &optval, sizeof(optval),
NULL, 0, &dwBytesRet, NULL, NULL) == SOCKET_ERROR)
{
printf("WSAIotcl(%d) failed; %d\n", dwIoControlCode,
WSAGetLastError());
return -1;
}

And Yes Microsoft has a bug. It might happen that sometimes you would not see outgoing ip packets.
First i was altering in all ways WSAIoctl it didnt happened and then i wfound out that it happened when i altered my winsock providers layers (i use sporder.exe to confirm this.).. but i didnt get deep enough to tell exactly what is causing it .. anyway from that time i stoped using raw socket as they are not reliable .. back to device drivers? Smile | :)

Smile | :)

How about a C++ version?

McGarrah15-Apr-02 3:14

15-Apr-02 3:14

Love to see a version in C++. Just haven't had time to dig into C# yet.

Re: How about a C++ version?

Amit Dey15-Apr-02 6:03

15-Apr-02 6:03

There used to be a nice article and code for a raw IP sniffer in the Internet section that I cannot see right now. ?
Anyway maybe you'd find the tcpip library at www.komodia.com useful. I know I did! Big Grin | :-D

Big Grin | :-D

#define MOSTLY_LEAN_AND_MEAN

Re: How about a C++ version?

Lyle Brown15-Apr-02 8:42

15-Apr-02 8:42

Here is a link to a version written in C.

http://www.56chevy.com/web/DownLoads.html

Eek! | :eek:

Eek! | :eek:

Kember Brown

Re: How about a C++ version?

5.5 cents25-Nov-03 21:28

5.5 cents

25-Nov-03 21:28

If you are looking for a nifty utility (no compilation required), here try mine out
http://www.soft-trek.com.au/prjIpTicker.asp
http://www.soft-trek.com.au/ipticker.zip

Nick Parker13-Apr-02 1:55

13-Apr-02 1:55

I really enjoyed this article, however it was a little sparse on comments, would you possibly explain what is going on here:

<code>
int SIO_RCVALL = unchecked((int)0x98000001);<p>
</code><code>
IPHeader * head = (IPHeader *) fixed_buf;
e.HeaderLength=(uint)(head->ip_verlen & 0x0F) << 2;<p>
</code><code>
temp_version =(uint)(head->ip_verlen & 0xF0) >> 4;<p>
</code><code>
temp_ip_srcaddr = head->ip_srcaddr;
temp_ip_destaddr = head->ip_destaddr;<p>
</code>

Otherwise this was a great article, Thanks

Nick Parker

Re: Unexplained

Lyle Brown13-Apr-02 13:30

13-Apr-02 13:30

SIO_RCVALL is just a special number sent to winsock to put it into promiscuous mode (where the network card listens for everything...not just packets meant for your computer.)

"head" is a pointer to the IP packet header start byte. Next we find the header length (usually 20 bytes), then the version number (usually 4 these days right....), then we grab the from and to IP addresses.

For this code to make sense you have to be looking at how the IP header is laid out. Basically the IP header is a bunch of bytes and in certain positions is certain info....you just have to pick off what you want. (There are some bit ANDS and some shifts to help pick the right bytes.)

Thanks for the comments.

Kember.

Kember Brown

Something's missing

Jason Douglas12-Apr-02 9:29

12-Apr-02 9:29

The HTML is a bit screwed up at the top there, and I don't see any downloadable source code. I'm extremely interested to see your implementation of the RawSocket class in C# as I have created a version myself.

I have a need to communicate using raw structures between Windows/C# and Linux/C++. I've got a very rudimentary, but working, version. I'm sure this implementation must be better than my own, and I'd really like to see the code!

Thanks,
Jason

Re: Something's missing

Nish Nishant12-Apr-02 17:50

12-Apr-02 17:50

http://www.codeproject.com/useritems/NetworkMonitor/NetworkMonitor_src.zip

Nish

One little CD gone,
Then two CDs gone,
Then 5 more gone,
For a total 7 gones,
If I was a CD R,
I'd wanna cry,
Cause I'd be just a goner,
For a nasty CD burner.
[funny how frustration wakes up the poet in me]

General News Suggestion Question Bug Answer Joke Praise Rant Admin

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Go to top