I am programming a UDP proxy application for Windows in C++ that sends and receives UDP packets with Winsock. The problem is that I need to work with the ENTIRE packet, not just the data and UDP and/or IP header. I have tried raw sockets with IP_HDRINCL (might be misspelled), but it still chops off some information from the packet. Is there some sort of library or something, if not possible in winsock, that will let me accomplish this?
+3
A:
For receiving packets, WinPCAP will let you do all of this and more, and there's sample code here which shows how to capture all of the packets arriving on an interface.
David Knell
2010-08-15 06:13:43
I have seen that WinPCAP will let you send packets exactly like you want them, but can you receive packets in a like manner to winsock, with bind() and everything? I thought with WinPCAP you had to receive all packets that went to any port on your computer.
Chroma
2010-08-15 06:16:34
Not necessarily - have a look at the second example on the sample code link above, which shows how to set a filter, which'll allow you just to receive the packets that you're interested in. And no, you don't need to use bind(), etc.; you just get raw packet data coming in.
David Knell
2010-08-15 06:18:16
I'm not savvy in this field of computing, but wouldn't receiving every packet your computer got and just filtering it be much slower than just receiving the ones intended for you?
Chroma
2010-08-15 06:24:49
It depends on where they are filtered. All packages that arrive at your computer need to be filtered anyway. PCAP does its filtering in the kernel (afaik), so it should't be signficantly slower then the filtering windows performs. You'll want to keep the promiscuous mode deactived since this filter is often implemented directy in hardware. Everything else is done on the CPU anyway.
Lawnmower
2010-08-15 07:11:31
One last addition to the above - in a wired Ethernet network, the network switch that a computer's connected to pretty much makes sure that only packets which are intended for that computer or are broadcasts get sent to that computer. So there's little extra overhead even if promiscuous mode is turned on.WiFi is, of course, a somewhat different story.
David Knell
2010-08-15 07:46:13