Does anyone know why should I use Winpcap and not just .Net sockets to sniff packets on my local pc?
TY
+1
A:
As far as I understanf .Net sockets are an IPC to communicate between 2 processes. While winpcap is a library that help you to access the data link layer an sniff pacquets going through your network hardware (or virtual) devices on your machine. Data link layer allow to get the data on any socket (.Net or not) created on your system.
yves Baumes
2009-10-12 20:44:54
+2
A:
Sockets (.NET, Winsock, etc.) normally collect at layer 7, the Application layer. That is, whatever is sent by the sender is what is received by the receiver. All of the various headers that are added automatically on the sending side are stripped off by the time the receiver reads the data from the socket.
It is possible to configure a socket to be a raw socket, in which case, you can see all of the headers down to layer 3, the Network layer. Further still, you can put the raw socket in promiscuous mode, which allows you to see all of the traffic on the network, not just the packets destined for your machine. But even this is limited. For example, when you configure the raw socket, you specify the protocol type to use, e.g., IP, ICMP, etc. This limits the socket to "seeing" packets that adhere to that protocol. I have been unable to figure out how to make the socket see all packets at layer 3 regardless of protocol.
Winpcap operates as a device driver at layer 2, the Data Link layer. In this case, you see literally all of the packets on the network with full headers down to layer 2. Winpcap also offers filtering capability so you can narrow down the packets that are reported to you based on whatever criteria you provide.
As far as choosing between them, it really boils down to the requirements of your specific task. If you are trying to implement any kind of realistic network analysis capability, you'll be hardpressed to do that with just sockets. Winpcap makes more sense in that case. However, if you are only interested in IP packets, for example, then sockets will work fine for that.
Matt Davis
2009-10-14 19:55:52
Great. Thank you very much.
2009-10-15 20:37:34
Can I use sockets to capture MSN messanger and Yahoo messanger conversations?
2010-03-09 06:32:45
Assuming the MSN/Yahoo messenger clients use IP, then yes, a raw socket will capture this information off your local network connection.
Matt Davis
2010-03-09 06:57:16
A:
Does this mean using WinPCap is better performance in terms of speed instead of sockets for sending data out?
bsobaid
2010-07-15 17:54:33