Use Raw Socket programming in C # To monitor network packets

When talking about socket programming, you may think of QQ and IE. That's right. Many other network tools, such as P2P and NetMeeting, are implemented at the application layer using socket. Socket is a network programming interface that is implemented on the network application layer. Windows Socket includes a set of system components that fully utilize the features of Microsoft Windows message driver. The Socket Specification Version 1.1 was released in January 1993 and is widely used in later Windows 9x operating systems. Socket Specification Version 2.2 (its version on Windows is Winsock2.2, also known as Winsock2) was released in May 1996. Windows NT 5.0 and later versions support Winsock2. In Winsock2, supports original sockets of multiple transmission protocols, overlapping I/O models, and service quality control.
This article introduces some programming of the original Socket (Raw Socket) implemented by C # in Windows Sockets and the network packet Monitoring Technology Based on this. Compared with Winsock1, Winsock2 supports the Raw Socket type most obviously. Using Raw Socket, you can set the NIC to the hybrid mode. In this mode, we can receive the IP packet on the network, of course, for the purpose of not the local IP packet, through the original socket, we can also more freely control the various protocols in Windows, it can also control the underlying transmission mechanism of the network.
In this example, the RawSocket class is implemented in the nbyte. BasicClass namespace, which includes the core technology for implementing packet monitoring. Before implementing this class, you need to write an IP header structure to temporarily store some information about network packets:
[StructLayout (LayoutKind. Explicit)]
Public struct IPHeader
{
[FieldOffset (0)] public byte ip_verlen; // I4-bit Header Length + 4-bit IP version number
[FieldOffset (1)] public byte ip_tos; // 8-bit service type TOS
[FieldOffset (2)] public ushort ip_totallength; // The total length of a 16-bit data packet (in bytes)
[FieldOffset (4)] public ushort ip_id; // 16-bit ID
[FieldOffset (6)] public ushort ip_offset; // 3-Bit Flag
[FieldOffset (8)] public byte ip_ttl; // 8-bit TTL
[FieldOffset (9)] public byte ip_protocol; // 8-bit protocol (TCP, UDP, ICMP, Etc .)
[FieldOffset (10)] public ushort ip_checksum; // 16-bit IP header checksum
[FieldOffset (12)] public uint ip_srcaddr; // 32-bit source IP address
[FieldOffset (16)] public uint ip_destaddr; // 32-bit destination IP address
}
In this way, when each packet arrives, you can use forced type conversion to convert the data stream in the packet into IPHeader objects.