Click here to Skip to main content
15,305,969 members
Articles / Desktop Programming / MFC
Posted 18 Jun 2004


83 bookmarked

WinSniff :The packet capturing application for Windows

Rate me:
Please Sign up or sign in to vote.
3.36/5 (24 votes)
22 Jun 20043 min read
A packet capturing application for Windows.


This article describes a sniffer for Windows. WinSniff is an application for capturing packets on the network. It displays all the packets that are transmitted on the local network and gives detailed information about each header in the packet. In order to keep it simple, I am not dealing with application level protocols. If you are interested, you can add features to support various application level protocols such as SMTP, FTP, NETBIOS etc.


Visual C++ 6.0, Win98/WinXP.

How it works?

When your machine is on the network, packets with different destinations arrive. By default (i.e., when the network adapter is in normal mode) these packets are rejected by the network adapter since they are intended to different hosts. But if you want, you can receive these packets by putting the network adapter in promiscuous mode. In this mode, it will accept all the packets irrespective of the destination address.

Hence you can analyze the packets transmitted on your network. This trick is used for network management to determine the network traffic... etc. However, there is one problem here...!!! You will receive the packets with different destinations if you are using HUB. Since, HUB uses broadcasting technique for transmitting packets to all the hosts attached to it. However, if you are using SWITCH (an intelligent device), then you won't receive any packet sent to other hosts on the network. Best place to install this application is  on the gateway where you can keep track of incoming and outgoing packets.


Firstly, you have to get the device list and then open the device in promiscuous mode. While opening the device, you can also specify the size of the packet and time out value.

// Get all devices for capturing the packet 

//Open device in promiscous mode 
hdev=pcap_open_live( devname[index], //name of the device 
65536, //size ->Capture whole packet 
1, //promiscous mode 
1000, //read timeout 

Once you have opened the device, you will receive all packets. If you are interested in a particular packet, for example, only QUAKE packets (port 27960), ARP packets (ARP) etc., then you can specify the filter expression. For how to specify filter expression, you can refer WinPcap documentation.

//compile the filter 
//now set the filter 

Once you have opened the device and set the filter, now you are ready to receive the packets. Once the packet is received, header contains the length, time and other information about the packet. And pkt_data contains the exact contents of the packet starting from Ethernet header.

  // Do whatever you want.. 

In order to analyze the packet contents, you must be familiar with various header formats. Mainly, you must know the format of the following headers... ETHERNET, ARP, IP, TCP, UDP, ICMP and IGMP. I have included the file protocol.h which contains the format information about all these headers. If you want more details, you can refer RFCs for respective protocols.

Once you have done the job, it's time to safely close the device.

//close the device... 


You need WinPcap (Windows version of Libpcap: packet capturing library) to run this application. It can be downloaded from this location. It contains the setup file along with good documentation that explains capturing and sending packets in detail. I advice you to go through the WinPcap documentation before going through the source code.

Running the application

When you run the application, the main window pops up. Click on the startcapture menu item to start the capture. It displays a dialog box, now select the device. Packets will be displayed in the main window. Click on the packet to see more details. You can save any packet by clicking SaveFrame menu item. Later, you can open this saved frame.

If you don't have a network adapter or you are not on the network, I have included some sample packets in SamplePackets folder in the source zip file. You can open these files and view their contents.

If you have any queries or suggestions, feel free to drop a mail at


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Web Developer
India India
Nagareshwar is a security enthusiastic person involved in reverse engineering, vulnerability research, coding security tools etc. He spend most of the time in uncovering the secrets of computer world.

He holds 'Bachelor of Engineering' degree from National Institute of Technology of Karnataka, India. He had professional experience of 2.5 years in Novell. At Novell he was working on various security products including 'Novell Secure Login' and CASA.

For more details visit his website

Comments and Discussions

QuestionError: pcap.h is not a file or directory Pin
Madhumitha nara7-Jun-19 5:32
MemberMadhumitha nara7-Jun-19 5:32 
Questionregarding source code Pin
Chintan Prajapati27-Feb-15 23:36
MemberChintan Prajapati27-Feb-15 23:36 
Questionplease help me with the following error messages Pin
debinalaishram30-Jan-14 0:19
Memberdebinalaishram30-Jan-14 0:19 
Generalsockaddr_storage undefined Pin
xdddlt29-Feb-08 0:47
Memberxdddlt29-Feb-08 0:47 
Generalfrom iraq Pin
Member 432242223-Feb-08 23:48
MemberMember 432242223-Feb-08 23:48 
Generalhelp me soon Pin
Member 432242223-Feb-08 23:45
MemberMember 432242223-Feb-08 23:45 
GeneralRe: help me soon Pin
scott_wen1-Jun-11 21:09
Memberscott_wen1-Jun-11 21:09 
Generalhelp me soon Pin
Member 432242223-Feb-08 23:42
MemberMember 432242223-Feb-08 23:42 
GeneralMemory leaks ! Pin
Nico Cuppen6-Dec-07 9:09
MemberNico Cuppen6-Dec-07 9:09 
GeneralPlease Help me Pin
mustafa_kh_200710-Sep-07 4:11
Membermustafa_kh_200710-Sep-07 4:11 
GeneralA bug fix! Pin
cristitomi28-Mar-07 4:09
Membercristitomi28-Mar-07 4:09 
QuestionHeader Error Pin
sksurhio3-Jan-07 20:39
Membersksurhio3-Jan-07 20:39 
AnswerRe: Header Error Pin
cristitomi5-Mar-07 4:38
Membercristitomi5-Mar-07 4:38 
GeneralRe: Header Error Pin
ntiac7-Dec-09 0:09
Memberntiac7-Dec-09 0:09 
GeneralError 'pcap.h': No such file or directory Pin
Andy Rama24-Oct-06 20:40
MemberAndy Rama24-Oct-06 20:40 
GeneralRe: Error 'pcap.h': No such file or directory Pin
cristitomi5-Mar-07 4:41
Membercristitomi5-Mar-07 4:41 
GeneralRe: Error 'pcap.h': No such file or directory Pin
Palaniyappan.M19-Mar-07 3:24
MemberPalaniyappan.M19-Mar-07 3:24 
GeneralRe: Error 'pcap.h': No such file or directory Pin
cristitomi19-Mar-07 4:08
Membercristitomi19-Mar-07 4:08 
GeneralRe: Error 'pcap.h': No such file or directory Pin
chetnak28-Mar-07 3:22
Memberchetnak28-Mar-07 3:22 
GeneralRe: Error 'pcap.h': No such file or directory Pin
cristitomi28-Mar-07 3:58
Membercristitomi28-Mar-07 3:58 
GeneralRe: Error 'pcap.h': No such file or directory Pin
chetnak28-Mar-07 4:56
Memberchetnak28-Mar-07 4:56 
GeneralRe: Error 'pcap.h': No such file or directory Pin
benicetoall26-Oct-07 3:54
Memberbenicetoall26-Oct-07 3:54 
GeneralRe: Error 'pcap.h': No such file or directory Pin
benicetoall25-Oct-07 6:01
Memberbenicetoall25-Oct-07 6:01 
GeneralWinPcap and compiling WinSniff Pin
Yaron Abershitz3-May-06 23:05
MemberYaron Abershitz3-May-06 23:05 
GeneralRe: WinPcap and compiling WinSniff Pin
Nikita Agarwal12-Nov-07 23:40
MemberNikita Agarwal12-Nov-07 23:40 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.