The simplest sniffer

>> Wednesday, October 14, 2009


Here's the source code of the simplest sniffer using Winsock.

// Coded by rev __
#include <stdafx.h>
#include <winsock2.h>
#include <mstcpip.h>

// Buffer for receiving data
#define MAX_PACKET_SIZE 65535
static BYTE Buffer[MAX_PACKET_SIZE];

int _tmain(int argc, _TCHAR *argv[])
{
WSADATA wsadata; // Initialize WinSock.
SOCKET RawSocket; // Listening Socket
unsigned long flag = 1; // Ôëàã PROMISC Âêë/âûêë.

// Initialize WS2_32
WSAStartup(MAKEWORD(2, 2), &wsadata);
// Create RAW-socket
RawSocket = socket(AF_INET, SOCK_RAW, IPPROTO_IP);

// Determine host name
char HostName[256];
gethostname(HostName, sizeof(HostName));
printf("HostName = %s \n", HostName);

// Determine information from host name
PHOSTENT pLocalHostEnt;
pLocalHostEnt = gethostbyname(HostName);

// Prepare buffer SockAddr with ip address of host
SOCKADDR_IN SockAddr;
ZeroMemory(&SockAddr, sizeof(SockAddr));
SockAddr.sin_family = AF_INET;
SockAddr.sin_addr.s_addr = ((in_addr*)pLocalHostEnt->h_addr_list[0])->s_addr;
// Bind socket
bind(RawSocket, (SOCKADDR*) &SockAddr, sizeof(SOCKADDR));

// Switching network card in "promiscuous mode" to capture all packets
ioctlsocket(RawSocket, SIO_RCVALL, &flag);

// Receive IP-packets.
while (true)
{

int count;

count = recv(RawSocket, (char*)Buffer, sizeof(Buffer), 0);
printf("Len = %d \n", count);

// --- code for processing and recording the captured IP-packet ---
}

closesocket(RawSocket);
WSACleanup();
}

0 comments: