Packet Sniffing with Winpcap Functions Ported to a .NET Library

Actually, the function is dotnetWinpCap.cs->ReadNextInternal

This set of changes worked for me:

string packetdata=(string)Marshal.PtrToStringAnsi(pktdata);
CloseHandle(pktdata);
/*
//byte[] packetdata=(byte[])
// clean up pkthdr
CloseHandle(pkthdr);
pkthdr=IntPtr.Zero;
*/

p=new PacketHeader();

//p.Caplength=(int)packetheader.caplen;
//p.Length=(int)packetheader.len;

p.Caplength = (int)packetdata.Length;
p.Length = (int)packetdata.Length;

p.ts = packetheader.ts;
packet_data=new byte[p.Length];
Marshal.Copy(pktdata, packet_data,0,p.Length);
return PCAP_NEXT_EX_STATE.SUCCESS;

Thanks.

I just wanted to say that I was able to contact the creator of this dll, and he specifically said that no one is allowed to decompile it. This means we can't have the source code. It's really a shame too.

Since he hasn't looked at the boards in so long, I thought I'd clarify that for others.

How to assemble the packets to get back image files and getting the search keywords used in google.com or other?
pls hlp me.

hi

Have you updated this at all to add filtering? if so can you provide?

Jpcap (Java) implements filtering, try using or porting that code (available on Sourceforge).

Could you mail me the source code of dotnetwinpcap.dll? It's very well done. Tks. My mail is nunommagalhaes@hotmail.com.

Greetings all,
Nuno Magalhaes.

You could decompile it using Reflector.Disassembler. http://www.denisbauer.com/NETTools/

<br />
[assembly: System.Reflection.AssemblyKeyName("")]<br />
[assembly: System.Reflection.AssemblyKeyFile("d:\\data\\programming\\vcs\\key.snk")]<br />
[assembly: System.Reflection.AssemblyDelaySign(false)]<br />
[assembly: System.Reflection.AssemblyTrademark("")]<br />
[assembly: System.Reflection.AssemblyCopyright("(c) 2003 Victor Tan")]<br />
[assembly: System.Reflection.AssemblyProduct("")]<br />
[assembly: System.Reflection.AssemblyCompany("utopian_centaury@yahoo.com")]<br />
[assembly: System.Reflection.AssemblyConfiguration("")]<br />
[assembly: System.Reflection.AssemblyDescription("Winpcap port for .NET framework")]<br />
[assembly: System.Reflection.AssemblyTitle("dotnetWinpcap library")]<br />
<br />
using System;<br />
using System.Collections;<br />
using System.Runtime.InteropServices;<br />
using System.Text;<br />
using System.Threading;<br />
<br />
public class Device<br />
{<br />
  private string name;<br />
  private string description;<br />
  private string address;<br />
  private string netmask;<br />
<br />
  public Device()<br />
  {<br />
    name = null;<br />
    description = null;<br />
    address = null;<br />
    netmask = null;<br />
    return;<br />
  }<br />
  public virtual string Name<br />
  {<br />
    get<br />
    {<br />
      return name;<br />
    }<br />
    set<br />
    {<br />
      name = value;<br />
      return;<br />
    }<br />
  }<br />
  public virtual string Description<br />
  {<br />
    get<br />
    {<br />
      return description;<br />
    }<br />
    set<br />
    {<br />
      description = value;<br />
      return;<br />
    }<br />
  }<br />
  public virtual string Address<br />
  {<br />
    get<br />
    {<br />
      return address;<br />
    }<br />
    set<br />
    {<br />
      address = value;<br />
      return;<br />
    }<br />
  }<br />
  public virtual string Netmask<br />
  {<br />
    get<br />
    {<br />
      return netmask;<br />
    }<br />
    set<br />
    {<br />
      netmask = value;<br />
      return;<br />
    }<br />
  }<br />
}<br />
public class dotnetWinpCap<br />
{<br />
  public class AlreadyOpenException : Exception<br />
  {<br />
<br />
    public AlreadyOpenException()<br />
    {<br />
      return;<br />
    }<br />
    public override string Message<br />
    {<br />
      get<br />
      {<br />
        return "Device attached to object already open. Close first before reopening";<br />
      }<br />
    }<br />
  }<br />
  delegate void packet_handler(int param, int header, int pkt_data);<br />
  public enum PCAP_NEXT_EX_STATE<br />
  {<br />
    SUCCESS = 1,<br />
    TIMEOUT = 0,<br />
    ERROR = -1,<br />
    EOF = -2,<br />
    UNKNOWN = -3,<br />
  }<br />
  delegate void ReceivePacket(object sender, PacketHeader p, System.Byte[] s);<br />
  delegate void DumpEnded(object sender);<br />
  delegate void ReceivePacketInternal(object sender, int header, int data);<br />
  public struct pcap_pkthdr<br />
  {<br />
    public dotnetWinpCap.timeval ts;<br />
    public UInt32 caplen;<br />
    public UInt32 len;<br />
  }<br />
  public struct timeval<br />
  {<br />
    public UInt32 tv_sec;<br />
    public UInt32 tv_usec;<br />
  }<br />
  private struct pcap_rmtauth<br />
  {<br />
    private int type;<br />
    private string username;<br />
    private string password;<br />
  }<br />
  private struct in_addr<br />
  {<br />
    public char b1;<br />
    public char b2;<br />
    public char b3;<br />
    public char b4;<br />
    public UInt16 w1;<br />
    public UInt16 w2;<br />
    public UInt64 addr;<br />
  }<br />
  private struct sockaddr<br />
  {<br />
    public short family;<br />
    public UInt16 port;<br />
    public System.Byte[] addr;<br />
    public System.Byte[] zero;<br />
  }<br />
  private struct pcap_addr<br />
  {<br />
    public int next;<br />
    public int addr;<br />
    public int netmask;<br />
    public int broadaddr;<br />
    public int dstaddr;<br />
  }<br />
  private struct pcap_if<br />
  {<br />
    public int next;<br />
    public string name;<br />
    public string description;<br />
    public int addresses;<br />
    public UInt32 flags;<br />
  }<br />
  private Thread ListenThread;<br />
  private bool disposed;<br />
  private dotnetWinpCap.packet_handler callback;<br />
  private string fname;<br />
  private int maxb;<br />
  private int maxp;<br />
  private bool m_islistening;<br />
  private bool m_isopen;<br />
  private string m_attachedDevice;<br />
  private int pcap_t;<br />
  private int dumper;<br />
  private dotnetWinpCap.ReceivePacket OnReceivePacket;<br />
  private dotnetWinpCap.DumpEnded OnDumpEnded;<br />
  private dotnetWinpCap.ReceivePacketInternal OnReceivePacketInternal;<br />
  private StringBuilder errbuf;<br />
<br />
  public dotnetWinpCap()<br />
  {<br />
    ListenThread = null;<br />
    disposed = 0;<br />
    callback = null;<br />
    fname = "";<br />
    maxb = 0;<br />
    maxp = 0;<br />
    m_islistening = 0;<br />
    m_isopen = 0;<br />
    m_attachedDevice = null;<br />
    pcap_t = IntPtr.Zero;<br />
    dumper = IntPtr.Zero;<br />
    errbuf = new StringBuilder(256);<br />
    return;<br />
  }<br />
  public virtual string AttachedDevice<br />
  {<br />
    get<br />
    {<br />
      return m_attachedDevice;<br />
    }<br />
  }<br />
  public virtual string LastError<br />
  {<br />
    get<br />
    {<br />
      return errbuf.ToString();<br />
    }<br />
  }<br />
  public virtual bool IsListening<br />
  {<br />
    get<br />
    {<br />
      return m_islistening;<br />
    }<br />
  }<br />
  public virtual bool IsOpen<br />
  {<br />
    get<br />
    {<br />
      return m_isopen;<br />
    }<br />
  }<br />
  public event dotnetWinpCap.ReceivePacket OnReceivePacket;<br />
  private event dotnetWinpCap.DumpEnded OnDumpEnded;<br />
  private event dotnetWinpCap.ReceivePacketInternal OnReceivePacketInternal;<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_findalldevs(ref int devicelist, StringBuilder errbuf);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_setbuff(int p, int kernelbufferbytes);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_live_dump(int p, string filename, int maxsize, int maxpacks);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_live_dump_ended(int p, int sync);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_dump_open(int p, string filename);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern void pcap_dump(int dumper, int h, int data);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern void pcap_dump_close(int dumper);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_sendpacket(int p, System.Byte[] buff, int size);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_loop(int p, int cnt, dotnetWinpCap.packet_handler callback, int user);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_open_live(string device, int snaplen, int promisc, int to_ms, StringBuilder ebuf);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern System.Byte[] pcap_next(int p, int pkt_header);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_setmintocopy(int p, int size);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern void pcap_freealldevs(int devicelist);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_open(string source, int snaplen, int flags, int read_timeout, int auth, StringBuilder errbuf);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern int pcap_next_ex(int p, ref int pkt_header, ref int packetdata);<br />
  [DllImport("wpcap.dll", SetLastError=false)]<br />
  private static extern void pcap_close(int p);<br />
  [DllImport("Kernel32", SetLastError=false)]<br />
  private static extern bool CloseHandle(int handle);<br />
  public static ArrayList FindAllDevs()<br />
  {<br />
    ArrayList arrayList;<br />
    dotnetWinpCap.pcap_if pcap_if;<br />
    int i;<br />
    StringBuilder stringBuilder;<br />
    int i1;<br />
    Device device;<br />
    dotnetWinpCap.pcap_addr pcap_addr;<br />
    dotnetWinpCap.sockaddr sockaddr;<br />
    dotnetWinpCap.sockaddr sockaddr1;<br />
    System.StringSystem.String[] arr;<br />
    arrayList = new ArrayList();<br />
    pcap_if.addresses = IntPtr.Zero;<br />
    pcap_if.description = new StringBuilder().ToString();<br />
    pcap_if.flags = 0;<br />
    pcap_if.name = new StringBuilder().ToString();<br />
    pcap_if.next = IntPtr.Zero;<br />
    i = IntPtr.Zero;<br />
    stringBuilder = new StringBuilder(256);<br />
    i1 = IntPtr.Zero;<br />
    if (dotnetWinpCap.pcap_findalldevs(ref i, stringBuilder) != -1)<br />
    {<br />
      goto ILO_006d;<br />
    }<br />
    return null;<br />
  ILO_006d:<br />
    i1 = i;<br />
    goto ILO_026f;<br />
  ILO_0075:<br />
    device = new Device();<br />
    arrayList.Add(device);<br />
    pcap_if = ((dotnetWinpCap.pcap_if)(Marshal.PtrToStructure(i, typeof(dotnetWinpCap.pcap_if))));<br />
    device.Name = pcap_if.name;<br />
    device.Description = pcap_if.description;<br />
    if (pcap_if.addresses.ToInt32() == 0)<br />
    {<br />
      goto ILO_0267;<br />
    }<br />
    pcap_addr = ((dotnetWinpCap.pcap_addr)(Marshal.PtrToStructure(pcap_if.addresses, typeof(dotnetWinpCap.pcap_addr))));<br />
    if (pcap_addr.addr.ToInt32() == 0)<br />
    {<br />
      goto ILO_01ab;<br />
    }<br />
    sockaddr = ((dotnetWinpCap.sockaddr)(Marshal.PtrToStructure(pcap_addr.addr, typeof(dotnetWinpCap.sockaddr))));<br />
    arr = new string[7];<br />
    arr[0] = sockaddr.addr[0].ToString();<br />
    arr[1] = ".";<br />
    arr[2] = sockaddr.addr[1].ToString();<br />
    arr[3] = ".";<br />
    arr[4] = sockaddr.addr[2].ToString();<br />
    arr[5] = ".";<br />
    arr[6] = sockaddr.addr[3].ToString();<br />
    device.Address = string.Concat(arr);<br />
  ILO_01ab:<br />
    if (pcap_addr.netmask.ToInt32() == 0)<br />
    {<br />
      goto ILO_0267;<br />
    }<br />
    sockaddr1 = ((dotnetWinpCap.sockaddr)(Marshal.PtrToStructure(pcap_addr.netmask, typeof(dotnetWinpCap.sockaddr))));<br />
    arr = new string[7];<br />
    arr[0] = sockaddr1.addr[0].ToString();<br />
    arr[1] = ".";<br />
    arr[2] = sockaddr1.addr[1].ToString();<br />
    arr[3] = ".";<br />
    arr[4] = sockaddr1.addr[2].ToString();<br />
    arr[5] = ".";<br />
    arr[6] = sockaddr1.addr[3].ToString();<br />
    device.Netmask = string.Concat(arr);<br />
  ILO_0267:<br />
    i = pcap_if.next;<br />
  ILO_026f:<br />
    if (i.ToInt32() != 0)<br />
    {<br />
      goto ILO_0075;<br />
    }<br />
    dotnetWinpCap.pcap_freealldevs(i1);<br />
    return arrayList;<br />
  }<br />
  public virtual bool Open(string source, int snaplen, int flags, int read_timeout)<br />
  {<br />
    if ((pcap_t != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_0018;<br />
    }<br />
    throw new dotnetWinpCap.AlreadyOpenException();<br />
  ILO_0018:<br />
    pcap_t = dotnetWinpCap.pcap_open(source, snaplen, flags, read_timeout, IntPtr.Zero, errbuf);<br />
    if (pcap_t.ToInt32() == 0)<br />
    {<br />
      goto ILO_0050;<br />
    }<br />
    m_isopen = 1;<br />
    m_attachedDevice = source;<br />
    return 1;<br />
  ILO_0050:<br />
    m_isopen = 0;<br />
    m_attachedDevice = null;<br />
    return 0;<br />
  }<br />
  private void Loop()<br />
  {<br />
    int i;<br />
    callback = new dotnetWinpCap.packet_handler(this.LoopCallback);<br />
    i = IntPtr.Zero;<br />
    new HandleRef(callback, i);<br />
    dotnetWinpCap.pcap_loop(pcap_t, 0, callback, IntPtr.Zero);<br />
    return;<br />
  }<br />
  private void LoopCallback(int param, int header, int pkt_data)<br />
  {<br />
    dotnetWinpCap.pcap_pkthdr pcap_pkthdr;<br />
    System.ByteSystem.Byte[] arr;<br />
    Marshal.PtrToStringAnsi(param);<br />
    pcap_pkthdr = ((dotnetWinpCap.pcap_pkthdr)(Marshal.PtrToStructure(header, typeof(dotnetWinpCap.pcap_pkthdr))));<br />
    arr = new Byte[pcap_pkthdr.caplen];<br />
    Marshal.Copy(pkt_data, arr, 0, pcap_pkthdr.caplen);<br />
    Marshal.PtrToStringAnsi(pkt_data);<br />
    return;<br />
  }<br />
  private bool OpenLive(string source, int snaplen, int promisc, int to_ms)<br />
  {<br />
    pcap_t = dotnetWinpCap.pcap_open_live(source, snaplen, promisc, to_ms, errbuf);<br />
    if (pcap_t.ToInt32() == 0)<br />
    {<br />
      goto ILO_0025;<br />
    }<br />
    return 1;<br />
  ILO_0025:<br />
    return 0;<br />
  }<br />
  private dotnetWinpCap.PCAP_NEXT_EX_STATE ReadNextInternal(out PacketHeader p, out System.Byte[] packet_data, out int pkthdr, out int pktdata)<br />
  {<br />
    int i;<br />
    dotnetWinpCap.pcap_pkthdr pcap_pkthdr;<br />
    pkthdr = IntPtr.Zero;<br />
    pktdata = IntPtr.Zero;<br />
    p = null;<br />
    packet_data = null;<br />
    if (pcap_t.ToInt32() != 0)<br />
    {<br />
      goto ILO_003c;<br />
    }<br />
    errbuf = new StringBuilder("No adapter is currently open");<br />
    return -1;<br />
  ILO_003c:<br />
    i = dotnetWinpCap.pcap_next_ex(pcap_t, ref pkthdr, ref pktdata);<br />
    if (i != 0)<br />
    {<br />
      goto ILO_0050;<br />
    }<br />
    return 0;<br />
  ILO_0050:<br />
    if (i != 1)<br />
    {<br />
      goto ILO_00cc;<br />
    }<br />
    pcap_pkthdr = ((dotnetWinpCap.pcap_pkthdr)(Marshal.PtrToStructure(pkthdr, typeof(dotnetWinpCap.pcap_pkthdr))));<br />
    p = new PacketHeader();<br />
    p.Caplength = pcap_pkthdr.caplen;<br />
    p.Length = pcap_pkthdr.len;<br />
    p.ts = pcap_pkthdr.ts;<br />
    packet_data = new Byte[((System.UInt32)(p.Length))];<br />
    Marshal.Copy(pktdata, packet_data, 0, p.Length);<br />
    return 1;<br />
  ILO_00cc:<br />
    if (i != -1)<br />
    {<br />
      goto ILO_00d2;<br />
    }<br />
    return -1;<br />
  ILO_00d2:<br />
    if (i != -2)<br />
    {<br />
      goto ILO_00da;<br />
    }<br />
    return -2;<br />
  ILO_00da:<br />
    return -3;<br />
  }<br />
  public virtual dotnetWinpCap.PCAP_NEXT_EX_STATE ReadNextInternal(out PacketHeader p, out System.Byte[] packet_data)<br />
  {<br />
    int i;<br />
    return ReadNextInternal(out p, out packet_data, out i, out i);<br />
  }<br />
  public virtual bool SendPacket(System.Byte[] packet_data)<br />
  {<br />
    int i;<br />
    i = dotnetWinpCap.pcap_sendpacket(pcap_t, packet_data, packet_data.Length);<br />
    if (i != 0)<br />
    {<br />
      goto ILO_0015;<br />
    }<br />
    return 1;<br />
  ILO_0015:<br />
    return 0;<br />
  }<br />
  private void MonitorDump()<br />
  {<br />
    if (dotnetWinpCap.pcap_live_dump_ended(pcap_t, 1) == 0)<br />
    {<br />
      goto ILO_0022;<br />
    }<br />
    if (OnDumpEnded == null)<br />
    {<br />
      goto ILO_0022;<br />
    }<br />
    OnDumpEnded.Invoke(this);<br />
  ILO_0022:<br />
    return;<br />
  }<br />
  private void DumpPacket(object sender, int header, int data)<br />
  {<br />
    if ((dumper != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_001f;<br />
    }<br />
    dotnetWinpCap.pcap_dump(dumper, header, data);<br />
  ILO_001f:<br />
    return;<br />
  }<br />
  public virtual void StopDump()<br />
  {<br />
    dotnetWinpCap dotnetWinpCap;<br />
    dotnetWinpCap = this;<br />
    dotnetWinpCap.OnReceivePacketInternal = (Delegate.Remove(dotnetWinpCap.OnReceivePacketInternal, new dotnetWinpCap.ReceivePacketInternal(this.DumpPacket)) as dotnetWinpCap.ReceivePacketInternal);<br />
    if ((dumper != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_004a;<br />
    }<br />
    dotnetWinpCap.pcap_dump_close(dumper);<br />
    dumper = IntPtr.Zero;<br />
  ILO_004a:<br />
    return;<br />
  }<br />
  public virtual bool StartDump(string filename)<br />
  {<br />
    bool bl;<br />
    dotnetWinpCap dotnetWinpCap;<br />
    if ((pcap_t != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_004f;<br />
    }<br />
    try<br />
    {<br />
      dumper = dotnetWinpCap.pcap_dump_open(pcap_t, filename);<br />
      goto ILO_002b;<br />
    }<br />
    catch (object obj)<br />
    {<br />
      obj;<br />
      bl = 0;<br />
      goto ILO_0051;<br />
    }<br />
  ILO_002b:<br />
    dotnetWinpCap = this;<br />
    dotnetWinpCap.OnReceivePacketInternal = (Delegate.Combine(dotnetWinpCap.OnReceivePacketInternal, new dotnetWinpCap.ReceivePacketInternal(this.DumpPacket)) as dotnetWinpCap.ReceivePacketInternal);<br />
    return 1;<br />
  ILO_004f:<br />
    return 0;<br />
  ILO_0051:<br />
    return bl;<br />
  }<br />
  private bool StartLiveDump(string filename, int maxbytes, int maxpackets)<br />
  {<br />
    fname = filename;<br />
    maxb = maxbytes;<br />
    maxp = maxpackets;<br />
    if (dotnetWinpCap.pcap_live_dump(pcap_t, fname, maxb, maxp) != 0)<br />
    {<br />
      goto ILO_0048;<br />
    }<br />
    new Thread(new ThreadStart(this.MonitorDump));<br />
    return 1;<br />
  ILO_0048:<br />
    return 0;<br />
  }<br />
  public virtual bool SetMinToCopy(int size)<br />
  {<br />
    if (dotnetWinpCap.pcap_setmintocopy(pcap_t, size) != 0)<br />
    {<br />
      goto ILO_0010;<br />
    }<br />
    return 1;<br />
  ILO_0010:<br />
    return 0;<br />
  }<br />
  private void ReadNextLoop()<br />
  {<br />
    PacketHeader packetHeader;<br />
    System.ByteSystem.Byte[] arr;<br />
    int i;<br />
    int i1;<br />
    dotnetWinpCap.PCAP_NEXT_EX_STATE pCAP_NEXT_EX_STATE;<br />
  ILO_0000:<br />
    packetHeader = null;<br />
    arr = null;<br />
    pCAP_NEXT_EX_STATE = ReadNextInternal(out packetHeader, out arr, out i, out i1);<br />
    if (pCAP_NEXT_EX_STATE != 1)<br />
    {<br />
      goto ILO_0000;<br />
    }<br />
    if (OnReceivePacket == null)<br />
    {<br />
      goto ILO_002f;<br />
    }<br />
    OnReceivePacket.Invoke(this, packetHeader, arr);<br />
  ILO_002f:<br />
    if (OnReceivePacketInternal == null)<br />
    {<br />
      goto ILO_0000;<br />
    }<br />
    OnReceivePacketInternal.Invoke(this, i, i1);<br />
    goto ILO_0000;<br />
  }<br />
  public virtual bool SetKernelBuffer(int bytes)<br />
  {<br />
    if (dotnetWinpCap.pcap_setbuff(pcap_t, bytes) == 0)<br />
    {<br />
      goto ILO_0010;<br />
    }<br />
    return 0;<br />
  ILO_0010:<br />
    return 1;<br />
  }<br />
  public virtual void StartListen()<br />
  {<br />
    if (ListenThread == null)<br />
    {<br />
      goto ILO_0013;<br />
    }<br />
    ListenThread.Abort();<br />
  ILO_0013:<br />
    ListenThread = new Thread(new ThreadStart(this.ReadNextLoop));<br />
    ListenThread.Start();<br />
    m_islistening = 1;<br />
    return;<br />
  }<br />
  public virtual void StopListen()<br />
  {<br />
    if (ListenThread == null)<br />
    {<br />
      goto ILO_0027;<br />
    }<br />
    if (ListenThread.IsAlive == 0)<br />
    {<br />
      goto ILO_0020;<br />
    }<br />
    ListenThread.Abort();<br />
  ILO_0020:<br />
    ListenThread = null;<br />
  ILO_0027:<br />
    m_islistening = 0;<br />
    return;<br />
  }<br />
  public virtual void Close()<br />
  {<br />
    StopDump();<br />
    if (IsListening == 0)<br />
    {<br />
      goto ILO_0014;<br />
    }<br />
    StopListen();<br />
  ILO_0014:<br />
    m_isopen = 0;<br />
    m_attachedDevice = null;<br />
    if ((pcap_t != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_004a;<br />
    }<br />
    dotnetWinpCap.pcap_close(pcap_t);<br />
    pcap_t = IntPtr.Zero;<br />
  ILO_004a:<br />
    return;<br />
  }<br />
  private void Dispose()<br />
  {<br />
    Dispose(1);<br />
    GC.SuppressFinalize(this);<br />
    return;<br />
  }<br />
  private void Dispose(bool disposing)<br />
  {<br />
    if (disposed != 0)<br />
    {<br />
      goto ILO_005a;<br />
    }<br />
    if (disposing == 0)<br />
    {<br />
      goto ILO_0032;<br />
    }<br />
    if (ListenThread == null)<br />
    {<br />
      goto ILO_0032;<br />
    }<br />
    if (ListenThread.IsAlive == 0)<br />
    {<br />
      goto ILO_002b;<br />
    }<br />
    ListenThread.Abort();<br />
  ILO_002b:<br />
    ListenThread = null;<br />
  ILO_0032:<br />
    if ((pcap_t != IntPtr.Zero) == 0)<br />
    {<br />
      goto ILO_005a;<br />
    }<br />
    dotnetWinpCap.pcap_close(pcap_t);<br />
    pcap_t = IntPtr.Zero;<br />
  ILO_005a:<br />
    disposed = 1;<br />
    return;<br />
  }<br />
  protected override void Finalize()<br />
  {<br />
    try<br />
    {<br />
      Dispose(0);<br />
      goto ILO_0010;<br />
    }<br />
    finally<br />
    {<br />
      base.Finalize();<br />
    }<br />
  ILO_0010:<br />
    return;<br />
  }<br />
}<br />
public class PacketHeader<br />
{<br />
  public dotnetWinpCap.timeval ts;<br />
  private int caplen;<br />
  private int len;<br />
<br />
  public PacketHeader(dotnetWinpCap.timeval ts, int caplen, int len)<br />
  {<br />
    caplen = 0;<br />
    len = 0;<br />
    ts = ts;<br />
    caplen = caplen;<br />
    len = len;<br />
    return;<br />
  }<br />
<br />
  public PacketHeader()<br />
  {<br />
    caplen = 0;<br />
    len = 0;<br />
    return;<br />
  }<br />
  public virtual int Caplength<br />
  {<br />
    get<br />
    {<br />
      return caplen;<br />
    }<br />
    set<br />
    {<br />
      caplen = value;<br />
      return;<br />
    }<br />
  }<br />
  public virtual int Length<br />
  {<br />
    get<br />
    {<br />
      return len;<br />
    }<br />
    set<br />
    {<br />
      len = value;<br />
      return;<br />
    }<br />
  }<br />
  public virtual DateTime TimeStamp<br />
  {<br />
    get<br />
    {<br />
      DateTime dateTime;<br />
      DateTime dateTime1;<br />
      dateTime1 = new DateTime(1970, 1, 1);<br />
      dateTime = dateTime1.AddSeconds(((System.Double)(ts.tv_sec)));<br />
      dateTime.AddMilliseconds(((System.Double)(ts.tv_usec)));<br />
      return dateTime;<br />
    }<br />
  }<br />
}<br />

There are two bugs in the dotnetwinpcap:
- The timestamps are very inaccurate
- There is a bug freeing the resources in non LAN network cards (e.g.: wireless cards)

Any solutions posted here will be appreciated.

Is it legal to do that?

Hello,

I have a small problem when trying to upgrade this code to .net 2005.
Here is what I have, the problem is that I get exception in the line:
sockaddr = ((dotnetWinpCap.sockaddr)(Marshal.PtrToStructure((System.IntPtr)pcap_addr.addr, typeof(dotnetWinpCap.sockaddr))));
Does anyone know what is wrong with this upgrade ?

Thank you,

Ran

using System;
using System.Collections;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;

public class Device
{
private string name;
private string description;
private string address;
private string netmask;

public Device()
{
name = null;
description = null;
address = null;
netmask = null;
return;
}
public virtual string Name
{
get
{
return name;
}
set
{
name = value;
return;
}
}
public virtual string Description
{
get
{
return description;
}
set
{
description = value;
return;
}
}
public virtual string Address
{
get
{
return address;
}
set
{
address = value;
return;
}
}
public virtual string Netmask
{
get
{
return netmask;
}
set
{
netmask = value;
return;
}
}
}
public class dotnetWinpCap
{

public class AlreadyOpenException : Exception
{
public AlreadyOpenException()
{
return;
}
public override string Message
{
get
{
return "Device attached to object already open. Close first before reopening";
}
}
}
delegate void packet_handler(int param, int header, int pkt_data);
public enum PCAP_NEXT_EX_STATE
{
SUCCESS = 1,
TIMEOUT = 0,
ERROR = -1,
EOF = -2,
UNKNOWN = -3,
}
public delegate void ReceivePacket(object sender, PacketHeader p, System.Byte[] s);
delegate void DumpEnded(object sender);
delegate void ReceivePacketInternal(object sender, int header, int data);
[StructLayout(LayoutKind.Sequential)]
public struct pcap_pkthdr
{
public dotnetWinpCap.timeval ts;
public UInt32 caplen;
public UInt32 len;
}

[StructLayout(LayoutKind.Sequential)]
public struct timeval
{
public UInt32 tv_sec;
public UInt32 tv_usec;
}

[StructLayout(LayoutKind.Sequential)]
private struct pcap_rmtauth
{
private int type;
private string username;
private string password;
}

[StructLayout(LayoutKind.Sequential)]
private struct in_addr
{
public char b1;
public char b2;
public char b3;
public char b4;
public UInt16 w1;
public UInt16 w2;
public UInt64 addr;
}

[StructLayout(LayoutKind.Sequential)]
private struct sockaddr
{
public short family;
public UInt16 port;
public byte[] addr;
public byte[] zero;
}

[StructLayout(LayoutKind.Sequential)]
private struct pcap_addr
{
public int next;
public int addr;
public int netmask;
public int broadaddr;
public int dstaddr;
}

[StructLayout(LayoutKind.Sequential)]
private struct pcap_if
{
public int next;
public string name;
public string description;
public int addresses;
public UInt32 flags;
}
private Thread ListenThread;
private bool disposed;
private dotnetWinpCap.packet_handler callback;
private string fname;
private int maxb;
private int maxp;
private bool m_islistening;
private bool m_isopen;
private string m_attachedDevice;
private int pcap_t;
private int dumper;
private StringBuilder errbuf;

public dotnetWinpCap()
{
ListenThread = null;
disposed = false;
callback = null;
fname = "";
maxb = 0;
maxp = 0;
m_islistening = false;
m_isopen = false;
m_attachedDevice = null;
pcap_t = 0;
dumper = 0;
errbuf = new StringBuilder(256);
return;
}
public virtual string AttachedDevice
{
get
{
return m_attachedDevice;
}
}

public virtual string LastError
{
get
{
return errbuf.ToString();
}
}
public virtual bool IsListening
{
get
{
return m_islistening;
}
}
public virtual bool IsOpen
{
get
{
return m_isopen;
}
}
public event dotnetWinpCap.ReceivePacket OnReceivePacket;
private event dotnetWinpCap.DumpEnded OnDumpEnded;
private event dotnetWinpCap.ReceivePacketInternal OnReceivePacketInternal;
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_findalldevs(ref int devicelist, StringBuilder errbuf);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_setbuff(int p, int kernelbufferbytes);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_live_dump(int p, string filename, int maxsize, int maxpacks);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_live_dump_ended(int p, int sync);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_dump_open(int p, string filename);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern void pcap_dump(int dumper, int h, int data);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern void pcap_dump_close(int dumper);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_sendpacket(int p, System.Byte[] buff, int size);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_loop(int p, int cnt, dotnetWinpCap.packet_handler callback, int user);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_open_live(string device, int snaplen, int promisc, int to_ms, StringBuilder ebuf);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern System.Byte[] pcap_next(int p, int pkt_header);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_setmintocopy(int p, int size);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern void pcap_freealldevs(int devicelist);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_open(string source, int snaplen, int flags, int read_timeout, int auth, StringBuilder errbuf);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern int pcap_next_ex(int p, ref int pkt_header, ref int packetdata);
[DllImport("wpcap.dll", SetLastError=false)]
private static extern void pcap_close(int p);
[DllImport("Kernel32", SetLastError=false)]
private static extern bool CloseHandle(int handle);
public static ArrayList FindAllDevs()
{
ArrayList arrayList;
dotnetWinpCap.pcap_if pcap_if;
int i;
StringBuilder stringBuilder;
int i1;
Device device;
dotnetWinpCap.pcap_addr pcap_addr;
dotnetWinpCap.sockaddr sockaddr;
dotnetWinpCap.sockaddr sockaddr1;
System.String[] arr;
arrayList = new ArrayList();
pcap_if.addresses = 0;
pcap_if.description = new StringBuilder().ToString();
pcap_if.flags = 0;
pcap_if.name = new StringBuilder().ToString();
pcap_if.next = 0;
i = 0;
stringBuilder = new StringBuilder(256);
i1 = 0;
if (dotnetWinpCap.pcap_findalldevs(ref i, stringBuilder) != -1)
{
goto ILO_006d;
}
return null;
ILO_006d:
i1 = i;
goto ILO_026f;
ILO_0075:
device = new Device();
arrayList.Add(device);
pcap_if = ((dotnetWinpCap.pcap_if)(Marshal.PtrToStructure((System.IntPtr) i, typeof(dotnetWinpCap.pcap_if))));
device.Name = pcap_if.name;
device.Description = pcap_if.description;
if (pcap_if.addresses == 0)
{
goto ILO_0267;
}
pcap_addr = ((dotnetWinpCap.pcap_addr)(Marshal.PtrToStructure((System.IntPtr)pcap_if.addresses, typeof(dotnetWinpCap.pcap_addr))));
if (pcap_addr.addr == 0)
{
goto ILO_01ab;
}
sockaddr = ((dotnetWinpCap.sockaddr)(Marshal.PtrToStructure((System.IntPtr)pcap_addr.addr, typeof(dotnetWinpCap.sockaddr))));
arr = new string[7];
arr[0] = sockaddr.addr[0].ToString();
arr[1] = ".";
arr[2] = sockaddr.addr[1].ToString();
arr[3] = ".";
arr[4] = sockaddr.addr[2].ToString();
arr[5] = ".";
arr[6] = sockaddr.addr[3].ToString();
device.Address = string.Concat(arr);
ILO_01ab:
if (pcap_addr.netmask == 0)
{
goto ILO_0267;
}
sockaddr1 = ((dotnetWinpCap.sockaddr)(Marshal.PtrToStructure((System.IntPtr)pcap_addr.netmask, typeof(dotnetWinpCap.sockaddr))));
arr = new string[7];
arr[0] = sockaddr1.addr[0].ToString();
arr[1] = ".";
arr[2] = sockaddr1.addr[1].ToString();
arr[3] = ".";
arr[4] = sockaddr1.addr[2].ToString();
arr[5] = ".";
arr[6] = sockaddr1.addr[3].ToString();
device.Netmask = string.Concat(arr);
ILO_0267:
i = pcap_if.next;
ILO_026f:
if (i != 0)
{
goto ILO_0075;
}
dotnetWinpCap.pcap_freealldevs(i1);
return arrayList;
}

public virtual bool Open(string source, int snaplen, int flags, int read_timeout)
{
if ((pcap_t != 0) == false)
{
goto ILO_0018;
}
throw new dotnetWinpCap.AlreadyOpenException();
ILO_0018:
pcap_t = dotnetWinpCap.pcap_open(source, snaplen, flags, read_timeout, 0, errbuf);
if (pcap_t == 0)
{
goto ILO_0050;
}
m_isopen = true;
m_attachedDevice = source;
return true;
ILO_0050:
m_isopen = false;
m_attachedDevice = null;
return false;
}

private void Loop()
{
int i;
callback = new dotnetWinpCap.packet_handler(this.LoopCallback);
i = 0;
new HandleRef(callback, (System.IntPtr) i);
dotnetWinpCap.pcap_loop(pcap_t, 0, callback, 0);
return;
}

private void LoopCallback(int param, int header, int pkt_data)
{
dotnetWinpCap.pcap_pkthdr pcap_pkthdr;
System.Byte[] arr;
Marshal.PtrToStringAnsi((System.IntPtr)param);
pcap_pkthdr = ((dotnetWinpCap.pcap_pkthdr)(Marshal.PtrToStructure((System.IntPtr)header, typeof(dotnetWinpCap.pcap_pkthdr))));
arr = new Byte[pcap_pkthdr.caplen];
Marshal.Copy((System.IntPtr) pkt_data, arr, 0, (int)pcap_pkthdr.caplen);
Marshal.PtrToStringAnsi((System.IntPtr)pkt_data);
return;
}

private bool OpenLive(string source, int snaplen, int promisc, int to_ms)
{
pcap_t = dotnetWinpCap.pcap_open_live(source, snaplen, promisc, to_ms, errbuf);
if (pcap_t == 0)
{
goto ILO_0025;
}
return true;
ILO_0025:
return false;
}

private dotnetWinpCap.PCAP_NEXT_EX_STATE ReadNextInternal(out PacketHeader p, out System.Byte[] packet_data, out int pkthdr, out int pktdata)
{
int i;
dotnetWinpCap.pcap_pkthdr pcap_pkthdr;
pkthdr = 0;
pktdata = 0;
p = null;
packet_data = null;
if (pcap_t != 0)
{
goto ILO_003c;
}
errbuf = new StringBuilder("No adapter is currently open");
return PCAP_NEXT_EX_STATE.ERROR;
ILO_003c:
i = dotnetWinpCap.pcap_next_ex(pcap_t, ref pkthdr, ref pktdata);
if (i != 0)
{
goto ILO_0050;
}
return 0;
ILO_0050:
if (i != 1)
{
goto ILO_00cc;
}
pcap_pkthdr = ((dotnetWinpCap.pcap_pkthdr)(Marshal.PtrToStructure((System.IntPtr) pkthdr, typeof(dotnetWinpCap.pcap_pkthdr))));
p = new PacketHeader();
p.Caplength = (int)pcap_pkthdr.caplen;
p.Length = (int)pcap_pkthdr.len;
p.ts = pcap_pkthdr.ts;
packet_data = new Byte[((System.UInt32)(p.Length))];
Marshal.Copy((System.IntPtr)pktdata, packet_data, 0, p.Length);
return PCAP_NEXT_EX_STATE.SUCCESS;
ILO_00cc:
if (i != -1)
{
goto ILO_00d2;
}
return PCAP_NEXT_EX_STATE.ERROR;
ILO_00d2:
if (i != -2)
{
goto ILO_00da;
}
return PCAP_NEXT_EX_STATE.EOF;
ILO_00da:
return PCAP_NEXT_EX_STATE.UNKNOWN;
}
public virtual dotnetWinpCap.PCAP_NEXT_EX_STATE ReadNextInternal(out PacketHeader p, out System.Byte[] packet_data)
{
int i;
return ReadNextInternal(out p, out packet_data, out i, out i);
}
public virtual bool SendPacket(System.Byte[] packet_data)
{
int i;
i = dotnetWinpCap.pcap_sendpacket(pcap_t, packet_data, packet_data.Length);
if (i != 0)
{
goto ILO_0015;
}
return true;
ILO_0015:
return false;
}
private void MonitorDump()
{
if (dotnetWinpCap.pcap_live_dump_ended(pcap_t, 1) == 0)
{
goto ILO_0022;
}
if (OnDumpEnded == null)
{
goto ILO_0022;
}
OnDumpEnded.Invoke(this);
ILO_0022:
return;
}

private void DumpPacket(object sender, int header, int data)
{
if ((dumper != 0) == false)
{
goto ILO_001f;
}
dotnetWinpCap.pcap_dump(dumper, header, data);
ILO_001f:
return;
}

public virtual void StopDump()
{
dotnetWinpCap dotnetWinpCap;
dotnetWinpCap = this;
dotnetWinpCap.OnReceivePacketInternal = (Delegate.Remove(dotnetWinpCap.OnReceivePacketInternal, new dotnetWinpCap.ReceivePacketInternal(this.DumpPacket)) as dotnetWinpCap.ReceivePacketInternal);
if ((dumper != 0) == false)
{
goto ILO_004a;
}
dotnetWinpCap.pcap_dump_close(dumper);
dumper = 0;
ILO_004a:
return;
}
public virtual bool StartDump(string filename)
{
bool bl;
dotnetWinpCap dotnetWinpCap;
if ((pcap_t != 0) == false)
{
goto ILO_004f;
}
try
{
dumper = dotnetWinpCap.pcap_dump_open(pcap_t, filename);
goto ILO_002b;
}
catch (System.Exception obj)
{
//obj;
bl = false;
goto ILO_0051;
}
ILO_002b:
dotnetWinpCap = this;
dotnetWinpCap.OnReceivePacketInternal = (Delegate.Combine(dotnetWinpCap.OnReceivePacketInternal, new dotnetWinpCap.ReceivePacketInternal(this.DumpPacket)) as dotnetWinpCap.ReceivePacketInternal);
return true;
ILO_004f:
return false;
ILO_0051:
return bl;
}

private bool StartLiveDump(string filename, int maxbytes, int maxpackets)
{
fname = filename;
maxb = maxbytes;
maxp = maxpackets;
if (dotnetWinpCap.pcap_live_dump(pcap_t, fname, maxb, maxp) != 0)
{
goto ILO_0048;
}
new Thread(new ThreadStart(this.MonitorDump));
return true;
ILO_0048:
return false;
}

public virtual int SetMinToCopy(int size)
{
if (dotnetWinpCap.pcap_setmintocopy(pcap_t, size) != 0)
{
goto ILO_0010;
}
return 1;
ILO_0010:
return 0;
}

private void ReadNextLoop()
{
PacketHeader packetHeader;
System.Byte[] arr;
int i;
int i1;
dotnetWinpCap.PCAP_NEXT_EX_STATE pCAP_NEXT_EX_STATE;
ILO_0000:
packetHeader = null;
arr = null;
pCAP_NEXT_EX_STATE = ReadNextInternal(out packetHeader, out arr, out i, out i1);
if (pCAP_NEXT_EX_STATE != PCAP_NEXT_EX_STATE.SUCCESS)
{
goto ILO_0000;
}
if (OnReceivePacket == null)
{
goto ILO_002f;
}
OnReceivePacket.Invoke(this, packetHeader, arr);
ILO_002f:
if (OnReceivePacketInternal == null)
{
goto ILO_0000;
}
OnReceivePacketInternal.Invoke(this, i, i1);
goto ILO_0000;
}

public virtual bool SetKernelBuffer(int bytes)
{
if (dotnetWinpCap.pcap_setbuff(pcap_t, bytes) == 0)
{
goto ILO_0010;
}
return false;
ILO_0010:
return true;
}

public virtual void StartListen()
{
if (ListenThread == null)
{
goto ILO_0013;
}
ListenThread.Abort();
ILO_0013:
ListenThread = new Thread(new ThreadStart(this.ReadNextLoop));
ListenThread.Start();
m_islistening = true;
return;
}

public virtual void StopListen()
{
if (ListenThread == null)
{
goto ILO_0027;
}
if (ListenThread.IsAlive == false)
{
goto ILO_0020;
}
ListenThread.Abort();
ILO_0020:
ListenThread = null;
ILO_0027:
m_islistening = false;
return;
}
public virtual void Close()
{
StopDump();
if (IsListening == false)
{
goto ILO_0014;
}
StopListen();
ILO_0014:
m_isopen = false;
m_attachedDevice = null;
if ((pcap_t != 0) == false)
{
goto ILO_004a;
}
dotnetWinpCap.pcap_close(pcap_t);
pcap_t = 0;
ILO_004a:
return;
}

private void Dispose()
{
Dispose(true);
GC.SuppressFinalize(this);
return;
}
private void Dispose(bool disposing)
{
if (disposed != false)
{
goto ILO_005a;
}
if (disposing == false)
{
goto ILO_0032;
}
if (ListenThread == null)
{
goto ILO_0032;
}
if (ListenThread.IsAlive == false)
{
goto ILO_002b;
}
ListenThread.Abort();
ILO_002b:
ListenThread = null;
ILO_0032:
if ((pcap_t != 0) == false)
{
goto ILO_005a;
}
dotnetWinpCap.pcap_close(pcap_t);
pcap_t = 0;
ILO_005a:
disposed = true;
return;
}

~dotnetWinpCap()
{
try
{
Dispose(false);
goto ILO_0010;
}
finally
{
// base.Finalize();
}
ILO_0010:
return;
}

}

public class PacketHeader
{
public dotnetWinpCap.timeval ts;
private int caplen;
private int len;

public PacketHeader(dotnetWinpCap.timeval ts, int caplen, int len)
{
caplen = 0;
len = 0;
ts = ts;
caplen = caplen;
len = len;
return;
}

public PacketHeader()
{
caplen = 0;
len = 0;
return;
}
public virtual int Caplength
{
get
{
return caplen;
}
set
{
caplen = value;
return;
}
}
public virtual int Length
{
get
{
return len;
}
set
{
len = value;
return;
}
}
public virtual DateTime TimeStamp
{
get
{
DateTime dateTime;
DateTime dateTime1;
dateTime1 = new DateTime(1970, 1, 1);
dateTime = dateTime1.AddSeconds(((System.Double)(ts.tv_sec)));
dateTime.AddMilliseconds(((System.Double)(ts.tv_usec)));
return dateTime;
}
}
}

I'm developing a winPCap services, I need to implement it with dotnetwinpcap.dll or I could use wpcap.dll and packet.dll? I use Visual Studio.net 2003.
Thanks

Alessandro

Hi! and congratulations,
I am doing a project in the university and I am looking for a library to dissect IP packets in c#. I know there is something similar in Perl using

use NetPacket::Ethernet;
use NetPacket::IP;

Do you know any library to do something like that ?

thank you

hi everybody!
first of all sorry for my english!

i want to write a simple NIDS(Network Intrusion Detection System).
i have many problem.
1- how to capture packet and save in sql database.
how to seperate each type of packet(tcp,icmp,ip,...)
2- how to write rule with dotnet?

Hi,

Will you continue to work on this project or is it dead now?

narf!

actually I was going to ask the same question. What's the verdict man?

I'm writing a small app with a network statistics component that I'd like to use dotnetwinpcap for. Is that OK? It looks like the author hasn't posted in a while so if anyone else has gotten a response from him on a similar question, please respond.

Never mind about my last question, I figured it out.
I am curious about why this wrapper doesn't get the milliseconds in the timestamp. I'm not sure about the rest of the world, but I see more than 1 packet a second....
Any ideas how I can more accurately get the time of each packet?
~Liron

Hey,
Does anyone here know what is actually contained within each packet returned by s? I am trying to break apart each packet into its different header parts but the information stored in s doesn't seem to match the normal IP protocols.
Any ideas or advice about what I should do?

~Liron

you can see it thanks to ethereal (free): just select a line in a packet and u can see "beneath" what it means. U also can try to look at this:
http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/ip-packet.html[^]
For source ip: it is s[26] through s[29]
and for destination it is s[30] through s[33].
for the data it is s[54] through s[63] (i count the array from index zero)
The only thing which doesn't work for me is when i try to add some instructions into ReceivedPacket method: seems the wpcap come back to sleeping after 1 packet received...

I'm trying to use Winpcap (packet32.h and packet.dll) to display a list of installed Ethernet cards. A previous version of my project (done by someone else at the company) compiles using Borland, but we're porting everything to VC++ .Net version 7.1.
I basically tried to compile an example project that comes with the Winpcap Developer Pack. I was getting link errors using the older version of packet.dll ("The procedure entry point PacketGetVersion could not be located in the dynamic link library packet.dll") so I downloaded the source code for Winpcap and recompiled packet.dll & packet.lib. So now the program runs, but when I call PacketGetAdapterNames() it returns false!!

I'm not sure if I need to do something with dotnetwinpcap.dll (I'm not doing any packet sniffing or anything, just trying to get a list of installed adapters). If so, how do I use this DLL? Confused | :confused:

I'm trying to convert the sample to vb.net.

How is this translated?

if (rcvPack==null)
{
rcvPack=new dotnetWinpCap.ReceivePacket(this.ReceivePacket);
wpcap.OnReceivePacket+=rcvPack;
}

if rcvPack is nothing then
rcvPack = new dotnetWinpCap.ReceivePacket(me.ReceivPacket)
wpcap.OnReceivePacket += rcvPack
end if

i think this is what it would be.

I need to assemble packets into complete files, specifically .JPG and .GIF. Can anyone give me some idea of how to do this?

Thanks,
Rick

Would it be possible to move the methods around a bit? The logic that involves getting an ArrayList of Device-s from dotnetWinpCap, then choosing a Device, retrieving its name, and instantiating dotnetWinpCap using a string name is a tad bit clumsy, and could use some encapsulation.

My idea is basically moving most of the packet capture functionality into the Device class; using lazy initialization for the native resources and releasing them on finalize / explicitly. The dotnetWinpCap class could be changed into a DeviceList class, or removed altogether, with findAllDevs moved directly into Device as a static method. Either that, or create a factory method in Device that creates a dotnetWinPcap object.

Also, is the name of the device a dotnetWinPcap object is listening to stored in the object? I am currently working on an assignment that emulates an Ethernet Switch, and I need to be able to determine the network interface a frame arrived from to maintain the switching table, and I end up having to wrap your wrapper yet, which just doesn't feel right - I'm afraid I'm coding things redundantly, which I don't like.

More documentation for the Device and PacketHeader wouldn't hurt, as well as separating the presentational code and application logic in the example. Giving dotnetWinpCap a better name would be nice too Wink | ;)

The combination of abbreviation and weird capitalization doesn't work well - putting the classes in a WinPcap namespace, and renaming dotnetWinpCap to something like PacketCapturer could work.

And... This has been done to death, but... Releasing the source code under reasonable conditions (quoting you as the original author or something) would be wonderful.

-- David Vallner

Packet Sniffing with Winpcap Functions Ported to a .NET Library

Introduction

Methods Available

Properties

Event Support

History

License

Comments and Discussions