Click here to Skip to main content
15,169,249 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I make program Client-Server by VB6 with winsock.
I want send packet to server without connect by winpcap and Client-Server is connected.
I build packet from winpcap same packet from Client vb6 but server vb6 cannot receive packet from winpcap
Richard MacCutchan 25-Oct-11 4:10am
You need to give some more detail of what your code is doing. What exactly do you mean by "cannot receive from winpcap"?.

How is the server set up? I suspect it is with a TCP connection.

A typical client/server system would use Transmission Control Protocol (TCP). This requires the client to send a connection request (known as SYN), the server to reply with a connection accepted (known as ACK) and the client to acknowledge the accepted connection (known as a SYN ACK). Only then will your program see data. It should also be shutdown cleanly (this is not absolutly required by the protocol, but should be coded). TCP connections allow for error handling when packets are lost, which makes it a good choice.

The alternative is User Datagram Protocol (UDP) this is a stateless connection. You send data to the server IP and port and your server program receives this data. UDP does not have any connection state and hence does not guarantee a successful delivery of data, this is left up to you if you care. This is typically used for things like skype, where you dont want to have to wait for a packet to be resent because that would add a delay into your chat, the video just skips a bit instead.

When pcap (or winpcap for windows) sends a raw packet, it only sends the single data packet, not a connection setup. This is exactly what a UDP program would do.

You could set up a connection first, and then send data from pcap (have to use the same source ip and port as well as the same destination ip and port for this to work). If it is a real client/server situation I would strongly advise against using UDP, if you really need this, it is possible to fake the SYN, and SYN ACK packets with pcap.

If you are unfamiliar with networking perhaps get a copy of Wireshark and sniff some data. It wont work on the loopback address tho, it will only see data sent to other computers.
TCP need connection before send data ?
It possible to send not connect ?

#include <pcap.h>
int main()
    pcap_if_t      * allAdapters;
    pcap_if_t       * adapter;
    pcap_t       * adapterHandle;
    u_char         packet[ 58 ];
    char             errorBuffer[ PCAP_ERRBUF_SIZE ];

    // retrieve the adapters from the computer
    if( pcap_findalldevs_ex( PCAP_SRC_IF_STRING, NULL, 
                &allAdapters, errorBuffer ) == -1 )
        fprintf( stderr, "Error in pcap_findalldevs_ex function: %s\n", 
                 errorBuffer );
        return -1;

    // if there are no adapters, print an error
    if( allAdapters == NULL )
    printf( "\nNo adapters found! Make sure WinPcap is installed.\n" );
        return 0;

    // print the list of adapters along with basic information about an adapter
    int crtAdapter = 0;
    for( adapter = allAdapters; adapter != NULL; adapter = adapter->next)
    printf( "\n%d.%s ", ++crtAdapter, adapter->name );
    printf( "-- %s\n", adapter->description );

    printf( "\n" );

    int adapterNumber;

    printf( "Enter the adapter number between 1 and %d:", crtAdapter );
    scanf( "%d", &adapterNumber );
    if( adapterNumber < 1 || adapterNumber > crtAdapter )
        printf( "\nAdapter number out of range.\n" );

        // Free the adapter list
        pcap_freealldevs( allAdapters );

        return -1;
    // parse the list until we reach the desired adapter
    adapter = allAdapters;
    for( crtAdapter = 0; crtAdapter < adapterNumber - 1; crtAdapter++ )
        adapter = adapter->next;

    // open the adapter
    adapterHandle = pcap_open( adapter->name, // name of the adapter
                               65536,         // portion of the packet to capture
                                              // 65536 guarantees that the whole 
                                              // packet will be captured
                               PCAP_OPENFLAG_PROMISCUOUS, // promiscuous mode
                               1000,             // read timeout - 1 millisecond
                               NULL,          // authentication on the remote machine
                               errorBuffer    // error buffer

    if( adapterHandle == NULL )
        fprintf( stderr, "\nUnable to open the adapter\n", adapter->name );

        // Free the adapter list
        pcap_freealldevs( allAdapters );

        return -1;
    // free the adapter list
    pcap_freealldevs( allAdapters );

    // this is the most important part of the application
    // here we send the packet

    // first we create the packet

    // set mac destination address to 01 : 01 : 01 : 01 : 01 : 01
    packet[0] = 0x00;
    packet[1] = 0x23;
    packet[2] = 0x5a;
    packet[3] = 0x99;
    packet[4] = 0x4f;
    packet[5] = 0xe2;
    // set mac source address to 02 : 02 : 02 : 02 : 02 : 02
    packet[6]  = 0x00;
    packet[7]  = 0x13;
    packet[8]  = 0x8f;
    packet[9]  = 0x83;
    packet[10] = 0xa9;
    packet[11] = 0xb3;
    // set the rest of the packet

    packet[12]  = 0x08;
    packet[13]  = 0x00;
    packet[14]  = 0x45;
    packet[15]  = 0x00;
    packet[16]  = 0x00;
    packet[17]  = 0x2c;
    packet[18]  = 0x00;
    packet[19]  = 0xfb;
    packet[20]  = 0x40;
    packet[21]  = 0x00;
    packet[22]  = 0x40;
    packet[23]  = 0x06;
    packet[24]  = 0xb6;
    packet[25]  = 0x7d;
    packet[26]  = 0xc0;
    packet[27]  = 0xa8;
    packet[28]  = 0x01;
    packet[29]  = 0x01;
    packet[30]  = 0xc0;
    packet[31]  = 0xa8;
    packet[32]  = 0x01;
    packet[33]  = 0x02;
    packet[34]  = 0x04;
    packet[35]  = 0x15;
    packet[36]  = 0x00;
    packet[37]  = 0xa6;
    packet[38]  = 0x4d;
    packet[39]  = 0x62;
    packet[40]  = 0xfe;
    packet[41]  = 0x09;
    packet[42]  = 0x17;
    packet[43]  = 0x46;
    packet[44]  = 0x60;
    packet[45]  = 0x5c;
    packet[46]  = 0x50;
    packet[47]  = 0x18;
    packet[48]  = 0xff;
    packet[49]  = 0xff;
    packet[50]  = 0x7d;
    packet[51]  = 0x15;
    packet[52]  = 0x00;
    packet[53]  = 0x00;
    packet[54]  = 0x74;
    packet[55]  = 0x65;
    packet[56]  = 0x73;
    packet[57]  = 0x74;
    // send the packet
    if( pcap_sendpacket( adapterHandle, // the adapter handle
             packet, // the packet
             58 // the length of the packet
               ) != 0 )
        fprintf( stderr,"\nError sending the packet: \n", pcap_geterr( adapterHandle ) );
        return -1;

    system( "PAUSE" );
    return 0;

Andrew Brock 25-Oct-11 11:33am
No, TCP requires a connection to be made. Additionally, a new connection will spawn a new thread if you are allowing multiple simultaneous connections. If you could explain what you are trying to achieve, and from which computers (is pcap on the client or a 3rd computer?) I may be able to suggest an alternative
te2531 25-Oct-11 12:02pm

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900