Sample application to read and inspect packets on a network?

Question

Hi, I'm looking to write a quick program to read and inspect packets of a certain format and then blacklist ips with a certain style of packet-traffic (packet patterns of an attack against the network). Are there decent samples of reading and inspecting packet flow on a network?

Answer 1

Instead of writing your own program you might consider using WireShark, which can collect packets and filter data to identify certain patterns.

Answer 2

There's a related question here:

http://stackoverflow.com/questions/742024/which-net-library-wrapper-do-you-recommend-for-sniffing-packets

Id have to suggest though, implementing software monitoring is almost guaranteed to add a bottleneck to your network, and there are plenty of existing hardware solutions.

Answer 3

Wireshark, on Windows at least, uses libpcap. You could try that.

Also, if you're using Windows, I know several apps that use the Windows firewall stuff to remove themselves from a blacklist, so going the other way should be possible.

This is a lot easier on Unix... ;-P