Comments on: Packet Sniffer Code in C using Winsock

By: Binary Tides

Binary Tides — Sun, 25 Dec 2011 07:03:02 +0000

the code has been fixed.
however these are actually warnings instead of errors , try reducing the warning level in vc++ project settings.

By: Ebrahim

Ebrahim — Sat, 24 Dec 2011 15:29:31 +0000

I compiled the code using Microsoft visual C++ Express Edition. I got these errors.

1) line (184): error C2664: ‘WSAIoctl’ : cannot convert parameter 7 from ‘int *’ to ‘LPDWORD’

2) line (205): error C2440: ‘initializing’ : cannot convert from ‘char *’ to ‘unsigned char *’

3) line (216): error C2664: ‘recvfrom’ : cannot convert parameter 2 from ‘unsigned char *’ to ‘char *’

4) line (453): error C2664: ‘strlen’ : cannot convert parameter 1 from ‘unsigned char [17]‘ to ‘const char *’

By: Binary Tides

Binary Tides — Wed, 14 Dec 2011 09:44:15 +0000

yes ipv6 headers are different from ipv4 headers.
the ethernet header “protocol” field has to be checked to identify whether packet is ipv4 or ipv6. ipv4 has protocol number 0×0800 whereas ipv6 has protocol number 0x86DD. Full list here :

http://www.iana.org/assignments/ethernet-numbers

but winsock sniffer will not provide the ethernet header. winpcap has to be used.

By: Binary Tides

Binary Tides — Wed, 14 Dec 2011 09:36:09 +0000

code has been fixed. should compile without any errors.

By: Binary Tides

Binary Tides — Fri, 02 Dec 2011 07:16:23 +0000

Ethernet header is not available with winsock.
Winpcap library can be used. It provides the whole packet including the ethernet header.

By: TheOtherGuy

TheOtherGuy — Wed, 03 Nov 2010 01:03:28 +0000

I tried to compile the code, and didn’t work.

at line 114: it says log undeclared(first use in this function)

Is there something im doing wrong?

By: Its me

Its me — Thu, 23 Apr 2009 13:23:00 +0000

To sniff the ethernet header and its fields a packet sniffing library like winpcap can be used.

By: matoust

matoust — Fri, 27 Feb 2009 22:56:00 +0000

I have tested the code and it works great. I would also like to be able to display the whole packet including the Ethernet frame (preamble, MAC dest. , MAC source and soon).

Do you know ho to configure the port to get the whole package?

Thanks
Tomas Matousek

By: Bool

Bool — Tue, 15 Apr 2008 10:33:00 +0000

hi there, this article was of great help :D, i'm just playing around with Ragnarok Online (an MMORPG) and thanks to this I made a custom message logger, but I have got a problem.

Today I tried to open the program in a Windows Vista machine, and it didn't logged anything, I recompiled it with some printfs in several parts of the code just to know where the program was not working and I noticed it was not reaching this if

void ProcessPacket(unsigned char* Buffer, int Size)
{
iphdr = (IPV4_HDR *)Buffer;
if(iphdr->ip_protocol==6){
InterceptPacket(Buffer,Size);
}

}

it only checks if it is tcp because those are the packets I'm interested on, but I think the problem is that the machine could probably be using ipv6, so, my question is, how different are ipv6 headers and how can I distinguish ipv6 from ipv4?

thanks for yout time