C # using SharpPcap for network packet capture and sniffing,

C # using SharpPcap for network packet capture and sniffing,

This article is a small example of using SharpPcap to capture network packets. It implements port monitoring, packet capture, and other functions, and is mainly used for learning and sharing.

What is SharpPcap?

SharpPcap is a network packet capture framework in. NET environment. It is developed based on the famous pcap/WinPcap library. It provides capture, injection, analysis, and construction functions, and is suitable for C # and vb net development languages.

SharpPcap consists of two parts: 1> SharpPcap. dll is responsible for data capture 2> PacketDotNet. dll is responsible for data packet Parsing

Ideas:

Knowledge points:

• Process to obtain information about the Process.
• Netstat command: netstat-ano | find "3844" Get the port corresponding to the Process
• SharpPcap information:
  • Use the static method of CaptureDeviceList to obtain the device list.
  • Receives data packets through the OnPacketArrival event.
  • Use PacketDotNet to parse data packets

Below:

SharpPcap core code:

1 /// <summary> 2 /// start capturing 3 /// </summary> 4 /// <param name = "sender"> </param> 5 // /<param name = "e"> </param> 6 private void btnStart_Click (object sender, eventArgs e) 7 {8 if (this. combDevice. selectedIndex>-1) 9 {10 StartCapture (this. combDevice. selectedIndex); 11 this. btnStart. enabled = false; 12 this. btnStop. enabled = true; 13} 14 else {15 MessageBox. show (this, "select a device", "prompt", MessageBoxButt Ons. OK ); 16} 17} 18 19 /// <summary> 20 // stop capturing 21 /// </summary> 22 /// <param name = "sender"> </ param> 23 // <param name = "e"> </param> 24 private void btnStop_Click (object sender, eventArgs e) 25 {26 Shutdown (); 27 this. btnStop. enabled = false; 28 this. btnStart. enabled = true; 29} 30 31 private void StartCapture (int itemIndex) 32 {33 packetCount = 0; 34 device = CaptureDeviceList. instance [it EmIndex]; 35 packetStrings = new Queue <PacketWrapper> (); 36 bs = new BindingSource (); 37 dgvData. dataSource = bs; 38 LastStatisticsOutput = DateTime. now; 39 40 // start the background thread 41 backgroundThreadStop = false; 42 backgroundThread = new Thread (BackgroundThread); 43 backgroundThread. start (); 44 45 46 // setup background capture 47 device. onPacketArrival + = new PacketArrivalEventHandler (Device_OnPacketArrival); 48 device. onCaptureStopped + = new CaptureStoppedEventHandler (device_OnCaptureStopped); 49 device. open (); 50 51 // tcpdump filter to capture only TCP/IP packets 52 string filter = "IP and TCP"; 53 device. filter = filter; 54 55 // force an initial statistics update 56 captureStatistics = device. statistics; 57 UpdateCaptureStatistics (); 58 59 // start the background capture 60 device. startCapture (); 61 62 btnStop. enabled = true; 63} 64 65 // <summary> 66 // The device receives the event 67 // </summary> 68 // <param name = "sender"> </param> 69 // <param name = "e"> </param> 70 private void device_OnPacketArrival (object sender, captureEventArgs e) 71 {72 // print out periodic statistics about this device 73 var Now = DateTime. now; 74 var interval = Now-lastatisticsoutput; 75 if (inter Val> new TimeSpan (0, 0, 2) 76 {77 Console. writeLine ("device_OnPacketArrival:" + e. device. statistics); 78 captureStatistics = e. device. statistics; 79 statisticsUiNeedsUpdate = true; 80 LastStatisticsOutput = Now; 81} 82 83 lock (QueueLock) 84 {85 PacketQueue. add (e. packet ); 86} 87} 88 89 // <summary> 90 // device stop event 91 // </summary> 92 // <param name = "sender"> </param> 93 // <param name = "st Atus "> </param> 94 private void device_OnCaptureStopped (object sender, CaptureStoppedEventStatus) 95 {96 if (status! = CaptureStoppedEventStatus. completedWithoutError) 97 {98 MessageBox. show ("Error stopping capture", "Error", MessageBoxButtons. OK, MessageBoxIcon. error); 99} 100} 101 102 private void UpdateCaptureStatistics () 103 {104 tlblStatistic. text = string. format ("received packet: {0}, dropped packet: {1}, interface dropped packet: {2}", captureStatistics. receivedPackets, captureStatistics. droppedPackets, captureStatistics. interfaceDroppedPackets); 105}

View Code

SharpPcap Manual

 

Source code download