Get only Incoming Packets

Question

0.00/5 (No votes)

See more:

I only need incoming packets. How do I switch this from promiscuous?

// Set socket to promiscuous mode
   
   if ( WSAIoctl( sniff_socket,
                  SIO_RCVALL,
                  &optval,
                  sizeof(optval),
                  NULL,
                  0,
                  &dwLen,
                  NULL,
                  NULL ) == SOCKET_ERROR )

	{
      exit(-3);
	}

Posted 26-Apr-11 8:28am

Member 7766180

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Hans Dietrich · Answer 1 · 2011-04-26T08:42:00

Solution 1

You probably want to use RCVALL_IPLEVEL IOCTL option.

See here: http://msdn.microsoft.com/en-us/library/ee309610%28v=vs.85%29.aspx[^]

Posted 26-Apr-11 8:42am

Hans Dietrich

Comments

Member 7766180 26-Apr-11 15:03pm

OK I tried it and it's coming up undefined.
if ( WSAIoctl( sniff_socket,
SIO_RCVALL_IPLEVEL,
&optval,
sizeof(optval),
NULL,
0,
&dwLen,
NULL,
NULL ) == SOCKET_ERROR )

{

Albert Holguin 26-Apr-11 17:53pm

see my solution, he's been asking a lot of questions around winpcap...

Member 7766180 28-Apr-11 8:26am

I added this header #include <mstcpip.h> and I'm still getting undefined for SIO_RCVALL_IPLEVEL
DS

Albert Holguin 28-Apr-11 15:10pm

is this a reply to me or a comment for hans?

Member 7766180 28-Apr-11 17:53pm

To Hans. Suggestions welcome though!
DS

Albert Holguin 28-Apr-11 17:56pm

when you want to "reply" to someone specifically, use the "Reply" link in the top right of their post, if you want to comment to a solution, use the "Add Comment" link in the bottom right of the solution... you sent that message to me not hans...

Albert Holguin 28-Apr-11 17:58pm

what Hans wrote is not applicable to you because you're not writing the socket level programming, you're using a library, so you have to use my suggestion (unless you want to do the socket level development yourself)

Member 7766180 28-Apr-11 22:03pm

Thanks Albert, I guess I can forget about that direction, so I looked at your suggestion and I don't see anything that is remotely similiar to what I have.
DS

Albert Holguin 28-Apr-11 22:07pm

Sometimes helping gets a bit frustrating [this is one of those times]... :) ...you'll get it though... wireshark is an application that also uses winpcap, so if you're using winpcap in your application, getting familiar with wireshark will help you understand the capabilities that are within winpcap.

Member 7766180 28-Apr-11 23:18pm

Thank You Albert. I am not using WinPcap. I'm using Winsock I believe. Does this help (I'm trying to build a small application that will run under window services that will capture the Source IP and Packet ID of incoming packets only.)

.

Member 7766180 28-Apr-11 23:27pm

Albert,
Windows Sockers WSA API
To be exact.
DS

Albert Holguin 28-Apr-11 23:33pm

in that case you are working at the socket level, in which case Hans' suggestion is valid.

Member 7766180 29-Apr-11 0:20am

But the code is not taking. Squggly red lines

Albert Holguin 29-Apr-11 0:32am

probably defined here Mstcpip.h... include that?

Member 7766180 29-Apr-11 12:12pm

Yes Its included.
*****************************************
if ( WSAIoctl( sniff_socket,
SIO_RCVALL_IPLEVEL,
&optval,
***************************************
Error on the SIO_RCVALL_IPLEVEL

Albert Holguin 29-Apr-11 0:47am

here's the definition, its an enumeration:
http://doxygen.reactos.org/d5/d0f/mstcpip_8h.html

Member 7766180 29-Apr-11 12:15pm

Very Interesting page! I ss it there but unfortunately at this point I don't know how to implement it. Any help is appreciated!
Thanks
DS

Member 7766180 29-Apr-11 12:50pm

Found this in my code. Could this be causing the problem?
********************************
#ifndef SIO_RCVALL_IPLEVEL
# define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#endif
***************************************************

Albert Holguin 30-Apr-11 20:51pm

what's the error? why don't you post this as another question, this is getting a bit too messy in here...

Member 7766180 1-May-11 10:27am

For the Love of......Now its working! Thank you Albert!
DS

Albert Holguin · Answer 2 · 2011-04-26T11:49:00

since you're using winpcap, this is another filter option... like i've suggested before, get familiar with your filtering options. you really have to download and learn to use wireshark, this would allow you to see the capabilities of winpcap.

See dst host host:
http://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/packet-capture/winpcap/docs/docs31/html/group__language.html[^]

...And here's the wireshark site:
http://www.wireshark.org/[^]

P.S. Not sure what you're trying to build, but it seems like you're trying to build wireshark. Maybe you need to stop and take the time to see what that tool has and if its something you can use.