Comments on: How to code a Packet Sniffer in C using Winsock

By: Brian

Brian — Wed, 23 Jun 2021 20:13:16 +0000

May want to add a note – newer versions of Windows require “Run as Admin” to open a raw socket. Great basic tips, though!

By: Sandburg

Sandburg — Fri, 05 Jul 2019 15:54:14 +0000

In reply to Binary Tides.

This is not a good advice… Don’t try just to compile, try to long term fix…

By: qandool

qandool — Wed, 10 Oct 2018 17:58:26 +0000

Thanks for nice coding, i wand to add one more function to this code, a filter (let the user to see log of only tcp or udp packets). can someone help me please. thanks.

By: SZM

SZM — Sat, 06 Oct 2018 05:16:04 +0000

thank you for your nice coding, how can I add a filter to this code, so user may select type packet(s) (eg only Tcp or udp) and run the program. can someone help me. thanks as advanced.

By: lamba

lamba — Wed, 25 Oct 2017 05:08:54 +0000

how to receive PPP packets with sniffer?

By: Roby

Roby — Sat, 07 Oct 2017 10:31:36 +0000

In reply to Bool. Hy, the program works great, i am on Windows 7 SP1 , u only need to change the property of the exe file to Compatible with Windows XP SP2.U will have a really nice log file with all the packets.This programmer did a really great job.

By: Begin

Begin — Mon, 28 Jan 2013 15:39:00 +0000

I compiler but it error

undefined reference to ‘WSAStartup@8’

undefined reference to ‘socket@12’

undefined reference to ‘gethostname@8’

By: Samuel Viveiros

Samuel Viveiros — Tue, 01 Jan 2013 14:17:39 +0000

In reply to Nic Cha. Disable the firewall ;)

By: Nic Cha

Nic Cha — Thu, 20 Dec 2012 15:58:05 +0000

Cannot get the incoming packet on x86 win7.

By: Samuel Viveiros

Samuel Viveiros — Tue, 05 Jun 2012 22:24:12 +0000

Hello,

nice article.

sorry, but I couldn’t resist. I did a version of the your code in Delphi:

http://www.4shared.com/rar/zclnBD9a/SimpleSniffer-Delphi.html

sorry my english :)

By: Binary Tides

Binary Tides — Wed, 04 Apr 2012 07:26:13 +0000

In reply to hind osman. router and firewalls are different things. routers have inbuilt firewall. provide more information on what you are trying to implement.

By: hind osman

hind osman — Tue, 03 Apr 2012 08:19:41 +0000

i want to write acode to reconfigration the router to work as firewall,can i do that in windows or only linux ,can you help me plzzzzzzzzz

By: Binary Tides

Binary Tides — Sun, 25 Dec 2011 07:03:02 +0000

In reply to Ebrahim. the code has been fixed. however these are actually warnings instead of errors , try reducing the warning level in vc++ project settings.

By: Ebrahim

Ebrahim — Sat, 24 Dec 2011 15:29:31 +0000

I compiled the code using Microsoft visual C++ Express Edition. I got these errors.

1) line (184): error C2664: ‘WSAIoctl’ : cannot convert parameter 7 from ‘int *’ to ‘LPDWORD’

2) line (205): error C2440: ‘initializing’ : cannot convert from ‘char *’ to ‘unsigned char *’

3) line (216): error C2664: ‘recvfrom’ : cannot convert parameter 2 from ‘unsigned char *’ to ‘char *’

4) line (453): error C2664: ‘strlen’ : cannot convert parameter 1 from ‘unsigned char [17]’ to ‘const char *’

By: Binary Tides

Binary Tides — Wed, 14 Dec 2011 09:44:15 +0000

In reply to Bool.

yes ipv6 headers are different from ipv4 headers.
the ethernet header “protocol” field has to be checked to identify whether packet is ipv4 or ipv6. ipv4 has protocol number 0x0800 whereas ipv6 has protocol number 0x86DD. Full list here :

http://www.iana.org/assignments/ethernet-numbers

but winsock sniffer will not provide the ethernet header. winpcap has to be used.

By: Binary Tides

Binary Tides — Wed, 14 Dec 2011 09:36:09 +0000

In reply to TheOtherGuy. code has been fixed. should compile without any errors.

By: Binary Tides

Binary Tides — Fri, 02 Dec 2011 07:16:23 +0000

In reply to matoust. Ethernet header is not available with winsock. Winpcap library can be used. It provides the whole packet including the ethernet header.

By: TheOtherGuy

TheOtherGuy — Wed, 03 Nov 2010 01:03:28 +0000

I tried to compile the code, and didn’t work.

at line 114: it says log undeclared(first use in this function)

Is there something im doing wrong?

By: Its me

Its me — Thu, 23 Apr 2009 13:23:00 +0000

To sniff the ethernet header and its fields a packet sniffing library like winpcap can be used.

By: matoust

matoust — Fri, 27 Feb 2009 22:56:00 +0000

I have tested the code and it works great. I would also like to be able to display the whole packet including the Ethernet frame (preamble, MAC dest. , MAC source and soon).

Do you know ho to configure the port to get the whole package?

Thanks
Tomas Matousek