Receive Incoming Packets Only

Question

4.00/5 (1 vote)

See more:

New thread started as the other one was getting messy.
I only want incoming packets sniffed. I am currently in promiscuous mode and would like to get only incomming. Trying to add IPLEVEL to this and getting the squiggly red lines on SIO_RCVALL_IPLEVEL. I have #include MSTcpIP.h. Using Window Sockets.

// Set socket to promiscuous mode
// setsockopt wont work ... dont even try it
if ( WSAIoctl( sniff_socket,
               SIO_RCVALL_IPLEVEL,
               &optval,
               sizeof(optval),
               NULL,
               0,
               &dwLen,
               NULL,
               NULL ) == SOCKET_ERROR )

 {

Posted 1-May-11 9:40am

Member 7766180

Updated 1-May-11 10:13am

Albert Holguin

v2

Add a Solution

Comments

Albert Holguin 1-May-11 16:14pm

edit: fixed pre tags
question: I thought you had this working? What squiggly red lines are you talking about? Maybe post a screen capture somewhere and link...

Member 7766180 1-May-11 16:51pm

Oh Boy!, It was working and then bingo!
This is underlened with the red line....SIO_RCVALL_IPLEVEL, I opened the MSTcpIP.h file and IPLEVEL is in there as an ENum like you described earlier, perhaps I'm missing something?
DS

Member 7766180 1-May-11 16:53pm

This is the Error....
1 IntelliSense: identifier "SIO_RCVALL_IPLEVEL" is undefined c:\fb\fbsniffers\lsniff\lsniff\lsniff_main.cpp 147 19 lsniff

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Albert Holguin · Answer 1 · 2011-05-01T11:02:00

Solution 1

Alright... a few things:
1) Make sure that the file where you're making this call from has a direct link to mstcpip.h
(should have #include "mstcpip.h" or something similar)
2) Make sure that SIO_RCVALL_IPLEVEL is only defined once.

You're using Visual Studio? if so:
1) To make sure the linkage is there for #include, right click on the filename and open the file, if the compiler has a clear path to it, it will open, otherwise it will say file not found.
2) Do a solution level search for SIO_RCVALL_IPLEVEL definitions.

Posted 1-May-11 11:02am

Albert Holguin

Comments

Member 7766180 1-May-11 17:15pm

1) Have #include <<mstcpip.h>/>
2) Defined in the header file? Not sure about this one. This I have...

#ifndef SIO_RCVALL
# define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)
#endif

1) Visual Studio 2010......It opens on right click.
2) It's listed under External Dependencies

Albert Holguin 1-May-11 17:18pm

Try commenting out the code in the #ifndef all the way down to #endif

Member 7766180 1-May-11 17:43pm

No, still didn't work. However when I debug with the code commented out it debugged without any errors.

Albert Holguin 1-May-11 17:52pm

when you say "it didn't work", what do you mean? one thing is to get the error to compile without errors, another is for it to do what you expect.

Member 7766180 1-May-11 17:55pm

Sorry Albert, The suiggy red lines appeared under SIO_RCVALL_IPLEVEL

Albert Holguin 1-May-11 18:03pm

I had to go lookup the additions to VS2010 (since I've used everything before that) and it turns out this is a new addition (the underlines), that's why I didn't know what you were talking about. The underlines are due to IntelliSense, a lot of times even if the code is correct now (after fixing a problem) IntelliSense won't detect correctly... you can fix the problem by forcing IntelliSense to re-evaluate everything by closing the project, deleting the .ncb file (this file is only related to IntelliSense) and reopening the project (this will rebuild the database). If that doesn't fix it, then IntelliSense is still not clear about where the file is you may need #include <mstcpip.h> instead of #include "mstcpip.h".

Member 7766180 1-May-11 18:15pm

Albert, Found this...
The infamous .NCB file is no longer present in Visual Studio 2010 solution. Instead there is a new file with extension .SDF. This is not just a renaming of the extension, the entire Intellisense for Visual C++ was redesigned in Visual Studio 2010. This is a SQL Server Database file, possible to be opened even in Visual Studio (if one wants to check its content).

In the previous versions of Visual C++, each time you modified a header, the entire solution was reparsed, in which time it was very hard to use the environment. Moreover, the IntelliSense database file (the .NCB file) never seem to shrink, only increased in size, and it could get corrupted from time to time. In the new version, files are parsed on the background, and the IDE does not read all the files, only the current translation unit (which is a source file and all the headers it includes directly and indirectly). As a result, the operation is much swifter and less error prone.

There is also a new disk folder called iPCH in the new solution. This is the storing location for IntelliSense support files and browsing database files (SDF). I will try this. I guess the learning never ends!
DS

Albert Holguin 1-May-11 18:24pm

it never does... :)

Albert Holguin 1-May-11 18:25pm

Are you sure its supposed to be SIO_RCVALL_IPLEVEL and not RCVALL_IPLEVEL? I don't see where SIO_RCVALL_IPLEVEL is specified (http://msdn.microsoft.com/en-us/library/ms741621%28v=vs.85%29.aspx).

Member 7766180 1-May-11 18:29pm

Tried RCVALL_IPLEVEL....Red Lines
Also deletes the .SDF file, still red lines.

Albert Holguin 1-May-11 18:55pm

well, all i can tell you at this point is that the red line is there because intellisense can't figure out where this variable is defined...

Albert Holguin 1-May-11 21:27pm

I just tested with RCVALL_IPLEVEL and it finds the definition fine.

Member 7766180 2-May-11 23:06pm

Can you post the code so that I may see what you did?
Thank you Albert.
DS

Albert Holguin 1-May-11 21:33pm

The #ifndef SIO_RCVALL... shouldn't affect the enumeration definition (just checked to see if any of the names were conflicting but they're not).