The attached source code is a packet sniffer. Most of featured came from ethereal. I used WinPCap libraries to do it. But the most important difference is my code only uses npf.sys of WinPCap. I ported all the function int PacketNtx.dll to C#. As I said, the features of it like ethereal which are,
- You can stop a capture session by,
- when a specified time duration has passed
- when specified bytes of data captured
- when a number of specified packets captured
- when stop button pressed
- You can limit the size of the packets to a specified length.You can enable/disable MAC name resolution
- You can enable the live scrolling the captured packets
- You can change the hardware filter
- You can change capture mode
- You can change Adapter Buffer size, Read Buffer size , Timeout value etc.
- You can highlight the protocol data by either clicking the protocol node or the protocol data itself.
- You can see the index of a protocol data and the length of it
- You can save the captured packets int he format that ethereal understands
- You can load a packet file captured by ethereal
- You can partially save the captured packet by selecting them
- You can copy the protocol data to clipboard in the format string and in the hex layout by selecting the start and stop points
- You can sort the captured packets as desired
The code is pure managed. and it supports about 20 protocols which are,
- ETHERNET
- LLC
- STP
- NETBIOS
- CDP
- INTERNET
- TCP
- UDP
- HTTP
- ICMP
- ARP
- LOOPBACK
- NBDS
- NBNS
- NBSS
- SMB MAILSLOT
- SMB - Not finished yet
- DCERPC
- DLSW - Almost finished
- DNS - Not finished yet
- IPX
- TFTP
- EIGRP
Senthil KumarPosted Apr 20, 2020, 1:31 AM
Can i get a MyClasses.dll out file. i am facing an error at MyClasses.csproj.
vijaylaxmi ekkhelikarPosted Jun 16, 2017, 6:01 AM
Pacanal.zip its not working properly
Fredrick BoldPosted Apr 11, 2016, 7:55 PM
My wireless adapter is not found or does not work <code>\Device\NPF_{26B11A49-585F-4B43-A90C-9AF3C3D7B25B}\Device\NPF_{26B11A49-585F-4B43-A90C-9AF3C3D7B25B} failed\Device\NPF_{78130BF3-3023-4E29-83B0-85834C191D5E}\Device\NPF_{78130BF3-3023-4E29-83B0-85834C191D5E} failed \Device\NPF_{2E06631D-4B10-46A3-87D5-6A14A9428AD4} \Device\NPF_{2E06631D-4B10-46A3-87D5-6A14A9428AD4} failed \Device\NPF_{FF8E5185-26C6-4DFC-B2DA-4788E3C33838} \Device\NPF_{FF8E5185-26C6-4DFC-B2DA-4788E3C33838} failed \Device\NPF_{9EAF1020-5B97-479C-A201-4B1126D6CF27} \Device\NPF_{9EAF1020-5B97-479C-A201-4B1126D6CF27} failed \Device\NPF_{AC17705F-030B-489A-9410-8CBA52DD698A} \Device\NPF_{AC17705F-030B-489A-9410-8CBA52DD698A} failed \Device\NPF_{DF7F44E8-7CD1-46F5-A5D0-1952DA8366C8} \Device\NPF_{DF7F44E8-7CD1-46F5-A5D0-1952DA8366C8} failed</code>
Kumaresan EPosted Jun 21, 2013, 6:15 AM
it's not downloading the source.
fadi abu zanteditedPosted Mar 7, 2013, 1:45 AMEdited Mar 7, 2013, 1:46 AM
Its not work given failed result on all devises !!!!
Alok SinghPosted Oct 31, 2012, 1:36 PM
please provide My classes.dll file
dulari bosamiyaPosted Sep 28, 2011, 6:56 AM
Download not available The following download is not available: https://rapidshare.com/files/97792934/MyClasses.dll | 0.00 MB The file of the above link no longer exists. This could be for several reasons: The uploader deleted the file. The file contained illegal contents and was deleted from our servers by our abuse-team. The file is incorrect. The server is busy and can not process the request.
dulari bosamiyaPosted Sep 28, 2011, 6:50 AM
When I am running the program it gives an error of My class.dll. Otherwise program is superb. Please................. reply as early as possible If possible please send me the ans on [email protected]
sudheerPosted May 19, 2010, 6:47 AM
Failed get adapter in my PC any fix i need to do before starting.
bunnyPosted Mar 19, 2010, 8:04 AM
Thanks for the article
Ras CyPosted Nov 19, 2009, 6:08 AM
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="ProgId" content="Word.Document"><meta name="Generator" content="Microsoft Word 10"><meta name="Originator" content="Microsoft Word 10"><link rel="File-List" href="file:///C:%5CDOCUME%7E1%5Cmonroe%5CLOCALS%7E1%5CTemp%5Cmsohtml1%5C01%5Cclip_filelist.xml"><o:smarttagtype namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="place"></o:smarttagtype><!--[if gte mso 9]><xml> <w:WordDocument> <w:View>Normal</w:View> <w:Zoom>0</w:Zoom> <w:Compatibility> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:UseFELayout/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!--[if !mso]><object classid="clsid:38481807-CA0E-42D2-BF39-B33AF135CC4D" id=ieooui></object> <![endif]--><!--[if gte mso 10]> <![endif]--> #define NULL 0<o:p></o:p> #define TCPDUMP_MAGIC 0xa1b2c3d4 /* Tcpdump Magic Number (Preamble) */<o:p></o:p> #define PCAP_VERSION_MAJOR 2 /* Tcpdump Version Major (Preamble) */<o:p></o:p> #define PCAP_VERSION_MINOR 4 /* Tcpdump Version Minor (Preamble) */<o:p></o:p> <o:p> </o:p> #define DLT_NULL 0 /* Data Link Type Null */<o:p></o:p> #define DLT_EN10MB 1 /* Data Link Type for Ethernet II 100 MB and above */<o:p></o:p> #define DLT_EN3MB 2 /* Data Link Type for 3 Mb Experimental Ethernet */<o:p></o:p> <o:p> </o:p> // Ethernet Header<o:p></o:p> #define ETHER_ADDR_LEN 6<o:p></o:p> #include <stdio.h><o:p></o:p> #include <iostream><o:p></o:p> #include <fstream><o:p></o:p> using namespace std;<o:p></o:p> <o:p> </o:p> FILE *input;<o:p></o:p> <o:p> </o:p> typedef struct packet_header<o:p></o:p> {<o:p></o:p> unsigned int magic; /* Tcpdump Magic Number */<o:p></o:p> unsigned short version_major; /* Tcpdump Version Major */<o:p></o:p> unsigned short version_minor; /* Tcpdump Version Minor */<o:p></o:p> unsigned int thiszone; /* GMT to Local Correction */<o:p></o:p> unsigned int sigfigs; /* Accuracy of timestamps */<o:p></o:p> unsigned int snaplen; /* Max Length of Portion of Saved Packet */<o:p></o:p> unsigned int linktype; /* Data Link Type */<o:p></o:p> } hdr;<o:p></o:p> <o:p> </o:p> typedef struct packet_timestamp<o:p></o:p> {<o:p></o:p> unsigned int tv_sec; /* Timestamp in Seconds */<o:p></o:p> unsigned int tv_usec; /* Timestamp in Micro Seconds */<o:p></o:p> /* Total Length of Packet Portion (Ethernet Length until the End of Each Packet) */<o:p></o:p> unsigned int caplen;<o:p></o:p> unsigned int len; /* Length of the Packet (Off Wire) */<o:p></o:p> } tt;<o:p></o:p> <o:p> </o:p> typedef struct ether_header<o:p></o:p> { unsigned char edst[ETHER_ADDR_LEN]; /* Ethernet Destination Address */<o:p></o:p> unsigned char esrc[ETHER_ADDR_LEN]; /* Ethernet Source Address */<o:p></o:p> unsigned short etype; /* Ethernet Protocol Type */<o:p></o:p> } eth;<o:p></o:p> <o:p> </o:p> int main(int argc, char *argv[])<o:p></o:p> {<o:p></o:p> <o:p></o:p> unsigned int remain_len = 0;<o:p></o:p> unsigned char temp=0, hlen, version, tlen;<o:p></o:p> int i, count=0;<o:p></o:p> <o:p> </o:p> struct packet_header hdr; /* Initialize Packet Header Structure */<o:p></o:p> struct packet_timestamp tt; /* Initialize Timestamp Structure */<o:p></o:p> struct ether_header eth; /* Initialize Ethernet Structure */<o:p></o:p> unsigned char buff, array[1500];<o:p></o:p> <o:p> </o:p> input = fopen("abc", "rb"); /* Open Input File */<o:p></o:p> if(fopen == NULL)<o:p></o:p> cout << "Cannot open saved windump file" << endl;<o:p></o:p> else<o:p></o:p> { /* Read & Display Packet Header Information */<o:p></o:p> fread((char *) &hdr, sizeof(hdr), 1, input); <o:p></o:p> cout << "\n********** ********** PACKET HEADER ********** ***********" << endl;<o:p></o:p> cout << "Preamble " << endl;<o:p></o:p> cout << "Packet Header Length : " << sizeof(hdr) << endl;<o:p></o:p> cout << " Magic Number : " << hdr.magic << endl;<o:p></o:p> cout << "Version Major : " << hdr.version_major << endl;<o:p></o:p> cout << "Version Minor : " << hdr.version_minor << endl;<o:p></o:p> cout << "GMT to Local Correction : " << hdr.thiszone << endl;<o:p></o:p> cout << "Jacked Packet with Length of : " << hdr.snaplen << endl;<o:p></o:p> cout << "Accuracy to Timestamp : " << hdr.sigfigs << endl;<o:p></o:p> cout << "Data Link Type (Ethernet Type II = 1) : " << hdr.linktype << endl;<o:p></o:p> <o:p> </o:p> /* Use While <st1:place>Loop</st1:place> to Set the Packet Boundary */<o:p></o:p> while(fread((char *) &tt, sizeof(tt), 1, input)) /* Read & Display Timestamp Information */<o:p></o:p> {<o:p></o:p> ++count;<o:p></o:p> <o:p> </o:p> cout << "********** ********** TIMESTAMP & ETHERNET FRAME ********** ***********" << endl;<o:p></o:p> cout << " Packet Number: " << count << endl; /* Display Packet Number */<o:p></o:p> cout << " The Packets are Captured in : " << tt.tv_sec << " Seconds" << endl;<o:p></o:p> cout << "The Packets are Captured in : " << tt.tv_usec << " Micro-seconds" << endl;<o:p></o:p> <o:p> </o:p> /* Use caplen to Find the Remaining Data Segment */<o:p></o:p> cout << "The Actual Packet Length: " << tt.caplen << "Bytes" << endl; <o:p></o:p> cout << "Packet Length (Off Wire): " << tt.len << "Bytes" << endl;<o:p></o:p> <o:p></o:p> fread((char *) ð, sizeof(eth), 1, input); /* Read & display ethernet header information */<o:p></o:p> cout << "Ethernet Header Length : " << sizeof(eth) << " bytes" << endl;<o:p></o:p> <o:p></o:p> // You may want to remove the MAC Address output in your code<o:p></o:p> printf("MAC Destination Address : [hex] %x :%x :%x :%x :%x :%x \n\t\t\t [dec] %d :%d :%d :%d :%d :%d\n", <o:p></o:p> eth.edst[0], eth.edst[1], <o:p></o:p> eth.edst[2], eth.edst[3], eth.edst[4], eth.edst[5], eth.edst[0], eth.edst[1], <o:p></o:p> eth.edst[2], eth.edst[3], eth.edst[4], eth.edst[5], eth.edst[6]);<o:p></o:p> <o:p> </o:p> printf("MAC Source Address : [hex] %x :%x :%x :%x :%x :%x \n\t\t\t [dec] %d :%d :%d :%d :%d :%d\n", <o:p></o:p> eth.esrc[0], eth.esrc[1], eth.esrc[2], <o:p></o:p> eth.esrc[3], eth.esrc[4], eth.esrc[5], eth.esrc[0], eth.esrc[1], <o:p></o:p> eth.esrc[2], eth.esrc[3], eth.esrc[4], eth.esrc[5]);<o:p></o:p> <o:p></o:p> printf("\n\n C Cout\n\n");<o:p></o:p> cout << "MAC Address " << eth.esrc[0] << " " << eth.esrc[1] << endl;<o:p></o:p> <o:p> </o:p> for (i=0;i<tt.caplen -14;i++)<o:p></o:p> { fread((char *) &buff, sizeof(buff), 1 , input);<o:p></o:p> printf(" %x", buff); // you may remove the printf line if neccessary<o:p></o:p> array[i] = buff;<o:p></o:p> } /*complete the code here<o:p></o:p> <o:p></o:p> Use the software wireshark and capture a few packets from the live network and save the filename as abc.txt<o:p></o:p> and modify the program to display only TCP/IP packets, even modify further for the code to capture this packets from a live network. That it!!!!!<o:p></o:p> */<o:p></o:p> <o:p> </o:p> <o:p></o:p> printf("\n ");<o:p></o:p> <o:p></o:p> } // end while <o:p></o:p> } // end main else <o:p></o:p> <o:p> </o:p> <o:p> </o:p> fclose(input); // Close input file <o:p></o:p> <o:p></o:p> return (0);<o:p></o:p> }<o:p></o:p>
hunza aliPosted Nov 16, 2009, 10:56 PM
Hi I m getting the error that MyClasses.dll is not found.I hav also checked the link u hav provided but i havn't found any thing there, kindly help me in this regard..
sravan kumarPosted Nov 3, 2009, 9:46 PM
is it possible for me to get the complete project setup file and doc i need to study the entire project
Ras CyPosted Oct 28, 2009, 11:25 PM
hi... i have a netdump.c coding to capture packets but i've been trying to modify the code to display only TCP/IP packets. Do you happen to know the coding to perform that.
Pallavi AggarwalPosted Sep 30, 2009, 12:43 AM
hey anyidea how to access httpcookie on the client side? its really urgent please reply
asdasd asasdPosted Dec 7, 2008, 9:10 AM
the application wont find adapters.... PacketOpenAdapter - fails
Zero FiveditedPosted Mar 7, 2008, 1:45 PMEdited Mar 7, 2008, 1:54 PM
This DLL is already included - just as another project which isn't build. If you don't know, what to do or anything else, download this file from my folder: http://rapidshare.com/files/97792934/MyClasses.dll Copy it to your Debug folder. It should work zero5
sri edayuPosted Jan 31, 2008, 1:50 AM
hello..how to get the myclasses??/plz help me??
Hai NMPosted Dec 25, 2007, 4:53 AM
It's doen't work when i open it in C# 2005 :(
Erik HjelmvikPosted Nov 25, 2007, 4:23 PM
If you have problems with this application then I suggest you try "NetworkMiner packet analyzer" instead. It is also written in C#, can sniff and alalyze network traffic and is available as open source (from sourceforge). http://sourceforge.net/projects/networkminer/
RaminPosted Sep 26, 2007, 9:23 AM
HI, i'm download this project, but do not runing.Error: do not find MyClasses.dll. plz help me Best regards
Adriana CorralesPosted Sep 23, 2007, 11:37 PM
This software capture IP packets from a wireless, too?
ZdenekeditedPosted Jun 26, 2007, 2:03 AMEdited Jun 26, 2007, 2:04 AM
Hi I downloaded the code and did not find the MyClasses.dll :(
navaneeth knPosted Feb 5, 2007, 2:28 AM
Hi I downloaded the application. I am getting several registry values error when starting the program. It is giving index was out of bounds error when i press start button.. Pls help Navaneeth