Open Source Library for capturing and analyzing network packets-winpcap

What is WinPcap

WinPcap is an open source library based on the Win32 platform for capturing and analyzing network packets.

Most Web applications access the network through widely used operating system components, such as sockets. This is a simple implementation because the operating system has properly handled the underlying implementation details (such as protocol processing, encapsulation of packets, etc.) and provides a familiar interface to read and write files.

Sometimes, however, this "simple approach" does not meet the needs of the task because some applications require direct access to the packets in the network. That is, those applications need access to the original packets, i.e. packets that are not processed by the operating system using the network protocol.

The purpose of WINPCAP is to provide this access for WIN32 applications; WinPcap provides the following features

• Captures the original packet, whether it is destined for a machine or is exchanged on other devices (shared media)
• Filter packets based on user-specified rules before data packets is sent to an application
• Send the original packet over the network
• Collect and Count network traffic information

These features need to be implemented with a network device driver installed in the Win32 kernel, plus several dynamic-link library DLLs.

All of these features can be demonstrated through a powerful programming interface, easy to develop, and can be used on different operating systems.   The main objective of this manual is to describe the use of these programming interfaces with the help of a number of program examples. If you want to start exploring these features right now, you can go directly to the WinPcap user manual.

Which programs are using WinPcap

WinPcap can be used to make many types of web tools, such as tools with analysis, dispute resolution, security, and monitoring capabilities. In particular, some typical applications based on WinPcap are:

• Networking and Protocol Analyzer (Network and protocol analyzers)
• Network Monitor (monitors)
• Network Traffic Recorder (traffic loggers)
• Network traffic Generator (traffic generators)
• User-level bridges and routes (User-level bridges and routers)
• Network intrusion detection system (intrusion detection systems (NIDS))
• Web scanner (Network scanners)
• Security Tools

What WinPcap can't do.

WinPcap can send and receive data independently via the host protocol, as in Tcp-ip. This means that WinPcap cannot block, filter, or manipulate the communication of other applications on the same machine: it simply "monitors" packets that are transmitted over the network. Therefore, it does not provide support such as network traffic control, service quality scheduling, and personal firewalls.

Official website: http://www.winpcap.org/

Chinese Document: http://www.ferrisxu.com/WinPcap/html/index.html

Development package (Development required class library): http://www.winpcap.org/devel.htm

Open Source Library for capturing and analyzing network packets-winpcap