Click here to Skip to main content
13,291,084 members (59,509 online)
Click here to Skip to main content
Add your own
alternative version


130 bookmarked
Posted 23 Oct 2007

Internet Traffic Firewall and Sniffer

, 23 Oct 2007
Rate this:
Please Sign up or sign in to vote.
The article demonstrates internet packets interception with firewall capabilities based on IpFilterDriver driver and sending TCP/UDP/ICMP packets using raw sockets with IP spoofing support.


Some time ago, I developed a Sniffer/Firewall GUI application which allows monitoring internet traffic, sending raw TCP/UDP/ICMP packets with any source IP you'd like using raw sockets. It is based on IpFilterDriver. I used Developing Firewalls for Windows 2000/XP article when studying how to intercept internet traffic and wrote a simple driver with Windows 2000 DDK for that purpose. I developed and used it successfully under WinXP. However, I recently migrated to Vista and it is not able to intercept internet traffic under that OS but is executing all functions without error. The Vista firewall does not use IpFilterDriver as it is disabled and I do not use any additional ones. However I tried to turn off Vista's firewall but the interception still did not occur.


You need to have an understanding of TCP/IP for sending raw packets and interpreting intercepted traffic contents. If you'd like to extend the developed driver and figure out why it does not capture packets under Vista, you should have experience with DDK.

Using the Code

The MFC application is developed with SDI Document/View architecture. Go to FireWall menu and click IPhookON. This will start the userdrv.sys driver and IpFilterDriver. The first one is developed by me to intercept packets using ipfltdrv.sys windows driver. If no errors are encountered you'll notice IpFilter: ON displayed at the status bar right corner. To stop interception click IPhookOFF. The same procedure applies if you want to enable raw sockets, click Packs->StartRAW. After rawsock: ON notification in the status bar you'll be able to send raw sockets. Just go to Packs->IP4 menu and choose TCP, UDP or ICMP one. The two wide edit boxes in the middle of the dialog are source and destination IPs in text format like The same for the ports, first is the source and second edit box is the destination one. The bottom large edit box is for the text message you want to send (currently supports only text data, just meddle with the code to add binary).

Through the Settings... menu you can control FireWall parameters sent to userdrv.sys.

firewall settings

Drop TCP SYN and drop TCP RST enable it to drop incoming TCP SYN packets and outgoing TCP RST packets. The latter is useful if you initiate connection with raw sockets and prevent windows from sending reset packets to the remote host. Drop ICMP * tells the driver to drop incoming ICMP packets of the corresponding type. UDP range is the allowed interval of incoming UDP packets ports. You can also log packets to windows\pmyfire.log file by checking the bottom box.

You may also use promiscuous mode to track the packets using FireWall->PromiscON but without controlling the traffic.

The additional helper classes I developed in the project are:

  • CPacket
  • CDriver

With CPacket class you can send TCP, UDP and ICMP raw packets.

int sendudp(SOCKET s, ip4_header *, 
    udp_header *, char *data = 0, int size = 0);

int sendtcp(SOCKET s, ip4_header *, 
    tcp_header *, char *data = 0, int size = 0);

int sendicmp(SOCKET s, ip4_header *, icmp_header *);

With CDriver class you can start, stop, send IOCTL codes to system drivers and remove them from the registry.

bool drvStart(LPCTSTR, LPCTSTR servpath = 0, 
    LPCTSTR linkname = 0, LPCTSTR info = 0);

DWORD drvIOCTL(DWORD code, LPVOID in = 0, DWORD inlen = 0, 
    LPVOID out = 0, DWORD outlen = 0);

bool drvStop(LPCTSTR servname = 0, DWORD timeout = 30000);

bool drvDelete(LPCTSTR servname = 0);

Just have a look at the CSnifferDoc class on how to use them properly.

Points of Interest

The nice feature you may find in the context menu clicking on a particular packet. You may actually create a fake connection by using CSnifferDoc::Onsynack, CSnifferDoc::Onack, CSnifferDoc::OnPshack, CSnifferDoc::OnFinack. Do not forget to drop outgoing TCP reset packets. The intruder thinks you have got a lot of open ports (depends on which SYN you reply ACK) to his delight and rubs his hands! You may confuse him quite a lot by sending fake data also. Works fine in text messages after he got himself 'connected' to port 80.


This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)


About the Author

Chesnokov Yuriy
Russian Federation Russian Federation
Highly skilled Engineer with 14 years of experience in academia, R&D and commercial product development supporting full software life-cycle from idea to implementation and further support. During my academic career I was able to succeed in MIT Computers in Cardiology 2006 international challenge, as a R&D and SW engineer gain CodeProject MVP, find algorithmic solutions to quickly resolve tough customer problems to pass product requirements in tight deadlines. My key areas of expertise involve Object-Oriented
Analysis and Design OOAD, OOP, machine learning, natural language processing, face recognition, computer vision and image processing, wavelet analysis, digital signal processing in cardiology.

You may also be interested in...


Comments and Discussions

QuestionCan you send sniffer.rc2 file? Pin
Member 26884814-Nov-11 1:03
memberMember 26884814-Nov-11 1:03 
GeneralRejecting outgoing ip connections Pin
seer_tenedos22-Jun-10 13:08
memberseer_tenedos22-Jun-10 13:08 
what i am trying to do is to detect outgoing connections and instead of having my routing table send the requests into a blackhole
that drops the packets i want to reject them with a ICMP Port Unreachable packet. Is this possible at all?

Just a bit of background. We currently use vpn software to connect to clients etc but like most companies our computers are full of software that wants to talk to our own network. when we go on vpn the vpn changes the routing table to send packets for our network to the other network or to a blackhole. either way they are silently dropped not rejected so that our computers lockup waiting on connection timeouts as there are not rejection packets. From what i can tell nothing built into windows can help me here so i need to make my own solution. Your code looks the most promising so i hope you may be able to point me in the right direction or at least tell me if you think it is possible or not. so sick of my pc locking up all the time and help desk saying nothing can be done and they don't know the cause or why it happens to everyone. idiots Smile | :)
GeneralRe: Rejecting outgoing ip connections Pin
Chesnokov Yuriy2-Jun-10 23:15
memberChesnokov Yuriy2-Jun-10 23:15 
Generalbad word filter to protect my kids. with [***********] 's Pin
ZUPERKOOL7-Feb-10 10:13
memberZUPERKOOL7-Feb-10 10:13 
AnswerRe: bad word filter to protect my kids. with [***********] 's Pin
Chesnokov Yuriy7-Feb-10 21:23
memberChesnokov Yuriy7-Feb-10 21:23 
General[Message Deleted] Pin
it.ragester2-Apr-09 22:55
memberit.ragester2-Apr-09 22:55 
Generalres folder has been missed Pin
hakem13-Feb-09 8:30
memberhakem13-Feb-09 8:30 
AnswerRe: res folder has been missed Pin
Chesnokov Yuriy19-Feb-09 21:17
memberChesnokov Yuriy19-Feb-09 21:17 
Kerem Guemruekcue29-Jun-08 8:22
memberKerem Guemruekcue29-Jun-08 8:22 
Answerdata compression program to gui Pin
geetikasuri10-Dec-07 7:32
membergeetikasuri10-Dec-07 7:32 
GeneralI'm sorry... Pin
SlimFast200024-Oct-07 0:06
memberSlimFast200024-Oct-07 0:06 
GeneralRe: I'm sorry... should be uploaded Pin
Chesnokov Yuriy24-Oct-07 1:17
memberChesnokov Yuriy24-Oct-07 1:17 
GeneralRe: I'm sorry... should be uploaded Pin
SlimFast200024-Oct-07 1:59
memberSlimFast200024-Oct-07 1:59 Pin
Chesnokov Yuriy23-Oct-07 23:01
memberChesnokov Yuriy23-Oct-07 23:01 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.171207.1 | Last Updated 24 Oct 2007
Article Copyright 2007 by Chesnokov Yuriy
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid