深度剖析WinPcap之(二)

1.3.3 CSMA/CD以太网使用载波监听多点接入/冲突检测（CSMA/CD）协议，为了设备在网络上家交换数据。

多点接入这个术语指许多网络设备连接到同一个网段有发送的机会。

每个设备赋予等同的发送机会；没有任何设备优先于其它设备。

载波监听描述了一个网络设备的以太网接口在传送之前如何监听网线。

网络接口确保没有其它信号在网线上，在它传送之前，并且在传送的时候监听确保在同一时刻没有其它网络设备传送数据。

当两个网络设备在同一时刻传送时，一个冲突发生。

因为以太网接口在它们正在传送时监听媒体，通过冲突检测它们能够标识其它传送的出现。

如果一个冲突发生了，正在传送的设备在重新传送之前等待一个小的，随机的时间量。

该功能就是随机补偿(random backoff)。

传统地，以太网操作是半双工的，其意味着一个接口只能传送或接收数据，但是并不是同时。

如果一个网段中多于一个的网络接口试图在同一时刻传送，一个冲突发生每个载波监听多点接入/冲突检测。

当一个交叉的网线用来连接两个设备，或者一个单个设备连接一个交换机端口，在该网段中仅仅两个接口需要传送或接收，没有冲突发生。

这是因为设备A的传送连接到设备B的接收，设备B的接收连接到设备A的传送。

冲突检测的方法不再是必需的，因此，接口能够工作于全双工模式，其允许网络设备在同一时刻传送与接收，从而提高性能。

1.3.4 主要的协议：IP、TCP、UDP与ICMP协议下列IP、TCP、UDP与ICMP四个协议是现今互联网工作的核心。

IP(网际互连协议)IP是一个非连接协议，管理寻址数据从一个点到另一个点，把大数据包分割成小的、能传输的数据包。

IP数据报的主要组成如下：<!--[if !supportLists]--> ∙∙∙∙∙∙∙∙ <!--[endif]-->IP标识(IPID) 试图唯一标识IP数据报<!--[if !supportLists]--> ∙∙∙∙∙∙∙∙ <!--[endif]-->协议描述使用IP层服务的高层协议<!--[if !supportLists]--> ∙∙∙∙∙∙∙∙ <!--[endif]-->生存时间(TTL) 数据报在通过互联网是必须具有的受限的寿命。

Windows下截获网络数据——winpcap源代码分析王守彦1简介在本刊的前期中，介绍用于截获网络数据的通用库libpcap的高层实现，及在linux/unix 下底层实现。

Winpcap是libpcap的windows版本，它们虽然提供了同样的高层接口，但底层实现却截然不同。

对于linux/unix，网络数据的截获作为系统的一项基本功能，大多直接实现于内核中，用户只要调用简单的接口函数，就能截获通过网络适配器的数据，windows 系统本身不提供截获网络数据的接口，但提供一套和网络适配器交互的网络驱动器接口规范（NDIS），可以通过NDIS实现网络数据的截获。

本文作为前文的补充，详细分析winpcap 的结构和如何通过NDIS实现网络数据的截获和过滤。

本文分为三个部分：winpcap结构、NDIS概述和winpcap包截获驱动器源代码分析。

2Winpcap结构图1 winpcap结构图1描述了winpcap的结构，其中windump.exe是一个使用winpcap的外部程序，winpcap 包括libpcap通用接口、packet.dll动态链接库和NDIS包截获驱动器三个部分。

NDIS包截获驱动器用于从网络适配器(Network Adapter)截获数据，并提供一套标准的接口函数，如read，write,ioctl等；packet.dll提供对NDIS包截获驱动器接口函数的封装，对上层（libpcap）提供更为方便的接口；libpcap调用packet.dll中的函数，提供和linux/unix平台上libpcap相同的接口，实现代码的通用性。

实际上在windows编程中使用packet.dll提供的接口函数和使用libpcap函数一样方便，它们都是对其它函数的封装，本文不做分析，而是着重分析NDIS包截获驱动器的实现。

3NDIS概述包截获驱动器通过NDIS（网络驱动器接口规范）与网络适配器交互，NDIS是win32网络代码的一部分。

WinPcap 原理技术winpcap是windows平台下一个免费，公共的网络访问系统。

开发winpcap这个项目的目的在于为win32应用程序提供访问网络底层的能力。

1、网络及协议分析2、网络监控3、通信日志记录4、traffic generators5、用户级别的桥路和路由6、网络入侵检测系统（NIDS）7、网络扫描8、安全工具WinPcap导入WinPcap是一个开源的专业网络数据捕获开发包，其实，WinPcap的强大功能并不仅限于数据包的获取，主要功能：捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据包；在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；在网络上发送原始的数据包；收集网络通信过程中的统计信息。

Sniffer 嗅探原理Winpcap是针对Win32平台上的抓包和网络分析的一个架构。

它包括一个核心态的包过滤器，一个底层的动态链接库（packet.dll）和一个高层的不依赖于系统的库（wpcap.dll）Packet.dll提供更方便更易用的编程接口，wpcap.dll中的接口函数Sniffer嗅探器，是一种基于被动侦听原理的网络分析方式。

使用这种技术方式，可以监视网络的状态、数据流动情况以及网络上传输的信息。

当信息以明文的形式在网络上传输时，便可以使用网络监听的方式来进行攻击。

将网络接口设置在监听模式，便可以将网上传输的源源不断的信息截获。

Sniffer技术常常用于网络故障诊断、协议分析、应用性能分析和网络安全保障等各个领域。

实现Sniffer 功能函数序列第一步：获取网络设备指针pcap_findalldevs_ex()第二步：打开网卡pcap_open()第三步：检查链路层pcap_datalink()第四步：编译BPF过滤规则pcap_compile第五步：设置过滤规则pcap_setfilter第六步：注册回调函数，循环捕获数据包pcap_loop()第七步：释放网络设备列表pcap_freealldevs()第八步：关闭WinPcap会话句柄pcap_close()获取网络设备指针（查找机器的所有网络设备接口，并使用链表结构返回）打开网络设备（打开一个用来捕获或发送流量的通用源（网卡））检查链路3层类型（检查链路层类型）编译BFP过滤规则（编译数据包过滤器，将程序中高级的过滤表达式（即过滤规则字符串）转换为能被内核级的过滤引擎所处理的内容）执行过滤规则（把一个过滤器绑定到WinPcap会话句柄）注册回调函数，循环捕获数据包（循环捕获数据包并分析）释放网络设备列表（释放链表空间）关闭WinPcap会话句柄（关闭一个和p关联的文件，并释放资源）数据包分析1.数据包的分析内容数据包(Packet)是TCP/IP协议通信传输中的数据单位,TCP/IP协议是工作在OSI模型第三层(网络层)、第四层(传输层)上的，而帧是工作在第二层(数据链路层)。

网络安全导论课程考核论文题目一：基于WinPcap的用户名和密码监听器实现题目二：AES算法的加密和解密实现院（系）：物联网工程学院专业: 计算机科学与技术班级:学号:姓名:摘要：本文基于WinPcap，解决了局域网网络流量监测和用户名登陆信息的截取等问题，同时基于对截获的报文的解析，可以显示截获的报文的源和目的，报文的长度，报文的内容等。

第二部分通过对AES算法的研究，实现了对信息的加密和解密过程。

关键词：WinPcap；网络编程；AES一.引言在21世纪互联网的今天，各种网络构成了我们的信息交流网，因此对网络流量的监测成为一个关键的问题，通过对网络流量的监测，可以发现异常流量，从而及时的发现问题，WinPcap提供了很好的用于网络分析的工具，同时通过对开放APT的进一步研究，进行报文解析，可以直接获取基于局域网登陆的用户名和密码等信息。

另一方面，随着网络的发展，对于信息安全性的提高也成为了一个研究关键，在国际上有通用的安全的密码加密体系DES,AES等，本文对AES的数学原理进行了探索，同时用C/C++实现了AES的加密和解密过程。

二.基于WinPcap的用户名和密码监听器实现(一)WinPcap简介WinPcap is an open source library for packet capture and network analysis for the Win32 platforms.Most networking applications access the network through widely used operating system primitives such as sockets. It is easy to access data on the network with this approach since the operating system copes with the low level details (protocol handling, packet reassembly, etc.) and provides a familiar interface that is similar to the one used to read and write files.The purpose of WinPcap is to give this kind of access to Win32 applications; it provides facilities to:1.capture raw packets, both the ones destined to the machine where it's running and the ones exchanged by other hosts (on shared media)2.filter the packets according to user-specified rules before dispatching them to the application3.transmit raw packets to the network4.gather statistical information on the network trafficWinPcap receives and sends the packets independently from the host protocols,like TCP-IP. This means that it isn't able to block, filter or manipulate the traffic generated by other programs on the same machine: it simply "sniffs" thepackets that transit on the wire. Therefore, it does not provide the appropriate support for applications like traffic shapers, QoS schedulers and personal firewalls.(二)WinPcap架构WinPcap is an architecture for packet capture and network analysis for the Win32 platforms. It includes a kernel-level packet filter, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (wpcap.dll).The following figure shows the various components of WinPcap:Netgroup Packet Filter (NPF), the kernel portion of WinPcap.It is the WinPcap component that does the hard work, processing the packets that transit on the network and exporting capture, injection and analysis capabilities to user-level.NIC drivers directly manage network interface cards, referred to as NICs. The NIC drivers interface directly to the hardware at their lower edge and at their upper edge present an interface to allow upper layers to send packets on the network, to handle interrupts, to reset the NIC, to halt the NIC and to query and set the operational characteristics of the driver. NIC drivers can be either miniports or legacy full NIC drivers.NDIS (Network Driver Interface Specification) is a standard that defines the communication between a network adapter (or, better, the driver that manages it) and the protocol drivers (that implement for example TCP/IP). Main NDIS purpose is to act as a wrapper that allows protocol drivers to send and receive packets onto a network (LAN or WAN) without caring either the particular adapter or the particular Win32 operating system.Next figure shows the position of NPF inside the NDIS stack:Next figure shows the structure of WinPcap, with particular reference to the NPF driver:(三)WireShark简介Wireshark is a free and open-source packet analyzer. It is used for networktroubleshooting, analysis, software and communications protocol development, and education.Wireshark is cross-platform, using the GTK+ widget toolkit in current releases, andQt in the development version, to implement its user interface, and using pcap to capture packets.Wireshark allows the user to put network interface controllers that support promiscuous mode into that mode, in order to see all traffic visible on that interface, not just traffic addressed to one of the interface's configured addresses and broadcast/multicast traffic.Wireshark is software that "understands" the structure (encapsulation) of different networking protocols. It can parse and display the fields, along with their meanings as specified by different networking protocols. Wireshark uses pcap to capture packets, so it can only capture packets on the types of networks that pcap supports.Next figure shows the menu of Wireshark:(四)基于WinPcap流量监测1.关键结构体和函数分析struct pcap_if {struct pcap_if *next;char *name; /* name to hand to "pcap_open_live()" */char *description; /* textual description of interface, or NULL */ struct pcap_addr *addresses;bpf_u_int32 flags; /* PCAP_IF_ interface flags */};struct pcap{int fd; /* 文件描述字，实际就是 socket */int selectable_fd;/* 在 socket，可以使用 select() 和 poll() 等 I/O 复用类型函数 */ int snapshot; /* 用户期望的捕获数据包最大长度 */int linktype; /* 设备类型 */int tzoff; /* 时区位置，实际上没有被使用 */int offset; /* 边界对齐偏移量 */int break_loop; /* 强制从读数据包循环中跳出的标志 */struct pcap_sf sf; /* 数据包保存到文件的相关配置数据结构 */struct pcap_md md; /* 具体描述如下 */int bufsize; /* 读缓冲区的长度 */u_char buffer; /* 读缓冲区指针 */u_char *bp;int cc;u_char *pkt;/* 相关抽象操作的函数指针，最终指向特定操作系统(os)的处理函数 */int (*read_op)(pcap_t *, int cnt, pcap_handler, u_char *);int (*setfilter_op)(pcap_t *, struct bpf_program *);int (*set_datalink_op)(pcap_t *, int);int (*getnonblock_op)(pcap_t *, char *);int (*setnonblock_op)(pcap_t *, int, char *);int (*stats_op)(pcap_t *, struct pcap_stat *);void (*close_op)(pcap_t *);/*如果 BPF 过滤代码不能在内核中执行,则将其保存并在用户空间执行 */struct bpf_program fcode;/* 函数调用出错信息缓冲区 */char errbuf[PCAP_ERRBUF_SIZE + 1];/* 当前设备支持的、可更改的数据链路类型的个数 */int dlt_count;/* 可更改的数据链路类型号链表，在 linux 下没有使用 */int *dlt_list;/* 数据包自定义头部，对数据包捕获时间、捕获长度、真实长度描述 [pcap.h] */ struct pcap_pkthdr pcap_header;};struct pcap_pkthdr {struct timeval ts; /* time stamp */bpf_u_int32 caplen; /* length of portion present */bpf_u_int32 len; /* length this packet (off wire) */};int pcap_findalldevs_ex(char *source, struct pcap_rmtauth *auth, pcap_if_t **alldevs, char *errbuf);/* pcap_findalldevs_ex() 获取适配器列表，返回0表示正常，-1表示出错*/void pcap_freealldevs(pcap_if_t *);/*pcap_freealldevs() 释放适配器链表空间*/pcap_t *pcap_open(const char *source, int snaplen, int flags, int read_timeout, struct pcap_rmtauth *auth, char *errbuf);/*pcap_open() 打开适配器*/int pcap_next_ex ( pcap_t * p, struct pcap_pkthdr ** pkt_header, const u_char ** pkt_data)/*pcap_next_ex() 直接获得一个数据包，非回调方法； pcap_pkthdr结构体表示dump 文件中数据包首部*/2.算法流程3.代码清单#include <pcap.h>#define LINE_LEN 16int main(int argc,char* argv[]){/* Get all the devices */pcap_if_t *alldevs, *d;/* File descriptor */pcap_t *fp;u_int inum, i=0/* Work as a counter to count the number of the interface */;/* As the buffer of the error */char errbuf[PCAP_ERRBUF_SIZE];/* The flag of getting the package */int res;/* Pkt header */struct pcap_pkthdr *header;/* u_char means unsigned char */const u_char *pkt_data;printf("printing the device list:\n");/* Get the local device list */if(pcap_findalldevs(&alldevs, errbuf) == -1){fprintf(stderr,"Error:pcap_findalldevs_ex: %s\n", errbuf);exit(1);}/* Print the list */for(d=alldevs; d; d=d->next){printf("%d. %s\n", ++i, d->name);/* The description:textual description of interface, or NULL */if (d->description)printf(" (%s)\n", d->description);elseprintf("No description available\n");}if (i==0){printf("\nNo interfaces found! Make sure WinPcap is installed.\n");return -1;}printf("Enter the interface number (1-%d)[enter Ctrl+C to stop the program]:",i);scanf("%d", &inum);if (inum < 1 || inum > i){printf("\nInterface number out of range.\n");/* Free the device list */pcap_freealldevs(alldevs);/* It's important to free the devs */return -1;}/* Jump to the selected adapter */for (d=alldevs, i=0; i< inum-1 ;d=d->next, i++);/* I think if I can index the number of the devs,maybe I can find it easily *//* Open the adapter */if ((fp = pcap_open_live(d->name, // name of the device65536, // portion of the packet to capture.// 65536 grants that the whole packet will be captured on all the MACs.1, // promiscuous mode (nonzero means promiscuous)1000, // read timeouterrbuf // error buffer)) == NULL){fprintf(stderr,"\nError opening adapter\n");return -1;}/* Read the packets */while((res = pcap_next_ex( fp, &header, &pkt_data)) >= 0){if(res == 0)/* Timeout elapsed */continue;/* Print pkt timestamp and pkt len */printf("%ld:%ld (%ld)\n", header->_sec, header->_usec, header->len);/* Print the packet */for (i=1; (i < header->caplen + 1 ) ; i++){/* Control the format of the packet */printf("%.2x ", pkt_data[i-1]);if ( (i % LINE_LEN) == 0)printf("\n");/* Dealy the time to show the dat */Sleep(10);}printf("\n\n");}if(res == -1){printf("Error reading the packets: %s\n", pcap_geterr(fp));return -1;}/* It's easy to forget closing the file description */pcap_close(fp);return 0;}4.测试结果(五)基于WinPcap的用户名和密码监听器1.关键结构体和函数分析pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);/*pcap_dump_open() 打开一个文件来写入数据包；而pcap_dumper结构体表示libpcap存储文件的描述符*/int pcap_loop ( pcap_t * p, int cnt, pcap_handler callback, u_char*user) /*pcap_loop() 捕获数据包，其中pcap_handler为回调函数指针*/void packet_handler(u_char *dumpfile, const struct pcap_pkthdr *header, const u_char *pkt_data)/* 包处理函数*/void pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *);/* 将数据包保存到磁盘*/pcap_dumper_t *pcap_dump_open(pcap_t *, const char *);typedef struct pcap_dumper pcap_dumper_t;/*打开一个文件写入数据包，pcap_dumper 表示的写入的文件描述*/2.算法流程WriteDat：ReadDat：False3.代码清单WriteDat：#include <pcap.h>/* To deal with the packet */void packet_handler(u_char *dumpfile, const struct pcap_pkthdr *header, const u_char *pkt_data){/* Store the dump infos into file */pcap_dump(dumpfile, header, pkt_data);}int main(){pcap_if_t *alldevs;pcap_if_t *d;int inum;int i=0;/* Including the file description and the buffer and so on */pcap_t *adhandle;char errbuf[PCAP_ERRBUF_SIZE];/* Store the infos about the dump files */pcap_dumper_t *dumpfile;/* Store the dump infos into the file named filename */const char* filename = "dat.txt";/* Get the local devs as lists */if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1) {fprintf(stderr,"Error:in pcap_findalldevs: %s\n", errbuf);exit(1);}/* Print the list */for(d=alldevs; d; d=d->next){printf("%d. %s", ++i, d->name);if (d->description)printf(" (%s)\n", d->description);elseprintf("No description available\n");}if(i==0){printf("\nNo interfaces found! Make sure WinPcap is installed.\n");return -1;}printf("Enter the interface number (1-%d):",i);scanf("%d", &inum);if(inum < 1 || inum > i){printf("\nInterface number out of range.\n");/* Free the list */pcap_freealldevs(alldevs);return -1;}/* Jump to the adapter chosed */for(d=alldevs, i=0; i< inum-1 ; d=d->next, i++);/* Open the adapter */if ( (adhandle= pcap_open(d->name, // the name of the dev65536, //Snaplen/* Get all the infos */PCAP_OPENFLAG_PROMISCUOUS, // Set the pattern 1000, // Set the timeNULL, // Be checked?errbuf // Errbuf) ) == NULL){fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);/* Free the list */pcap_freealldevs(alldevs);return -1;}/* Open the dump files */dumpfile = pcap_dump_open(adhandle,filename);if(dumpfile==NULL){fprintf(stderr,"\nError opening output file\n");return -1;}printf("\nlistening on %s... Press Ctrl+C to stop...\n", d->description);/* Free the list */pcap_freealldevs(alldevs);/* Begin to capture */pcap_loop(adhandle, 0, packet_handler, (unsigned char *)dumpfile);return 0;}ReadDat:#include <stdio.h>#include <pcap.h>#define LINE_LEN 16void dispatcher_handler(u_char *temp1,const struct pcap_pkthdr *header,const u_char *pkt_data){u_int i=0;/* Print pkt timestamp and pkt len */printf("%ld:%ld (%ld)\n", header->_sec, header->_usec, header->len);/* Print the packet */for (i=1; (i < header->caplen + 1 ) ; i++){printf("%.2c ", pkt_data[i-1]);/* It's better to insert a Hex2Char() */if ( (i % LINE_LEN) == 0) printf("\n");}printf("\n\n");}int main(){pcap_t *fp;char errbuf[PCAP_ERRBUF_SIZE];const char* filename = "dat.txt";/* Open the capture file */if ((fp = pcap_open_offline(filename, // Name of the deviceerrbuf // Error buffer)) == NULL){fprintf(stderr,"\nUnable to open the file %s.\n",filename);return -1;}/* Read and dispatch packets until EOF is reached */pcap_loop(fp, 0, dispatcher_handler, NULL);pcap_close(fp);return 0;}4.测试结果WriteDat:存储在文件中的内容：ReadDat:和WireShark对比的结果：三. AES算法的加密和解密实现 (一)数学原理Four-term polynomials can be defined - with coefficients that are finite field elements - as:a(x) = a3 x3 + a2x2 + a1x + a(4.5)which will be denoted as a word in the form [a0, a1, a2, a3 ]. Note that the polynomials in this section behave somewhat differently than the polynomials used in the definition of finite field elements, even though both types of polynomials use the same indeterminate, x. The coefficients in this section are themselves finite field elements, i.e., bytes, instead of bits; also, the multiplication of four-term polynomials uses a different reduction polynomial, defined below. The distinction should always be clear from the context.To illustrate the addition and multiplication operations, letb(x) = bx3 + bx2 + bx + bdefine a second four-term polynomial. Addition is performed by adding the finite field coefficients of like powers of x. This addition corresponds to an XOR operation between the corresponding bytes in each of the words – in other words, the XOR of the complete word values.Thus, using the equations of (4.5) and (4.6),Multiplication is achieved in two steps. In the first step, the polynomial product c(x) = a(x) •b(x) is algebraically expanded, and like powers are collected to givewhereThe result, c(x), does not represent a four-byte word. Therefore, the second step of the multiplication is to reduce c(x) modulo a polynomial of degree 4; the result can be reduced to a polynomial of degree less than 4. For the AES algorithm, thisis accomplished with the polynomial x 4+ 1, so thatThe modular product of a(x) and b(x), denoted by a(x) ˜b(x), is given by the four-term polynomial d(x), defined as follows:d(x) = d3 x3 + d2x2 + d1x + d(4.11)withWhen a(x) is a fixed polynomial, the operation defined in equation (4.11) can be written in matrix form as:Because x 4+1 is not an irreducible polynomial over GF(28), multiplication by a fixed four-term polynomial is not necessarily invertible. However, the AES algorithm specifies a fixed four-term polynomial that does have an inverse (see Sec. 5.1.3 and Sec. 5.3.3):a (x ) = {03}x 3 + {01}x 2+ {01}x + {02} (4.14) a -1(x ) = {0b}x 3+ {0d}x 2+ {09}x + {0e}. (4.15)Another polynomial used in the AES algorithm (see the RotWord()function in Sec. 5.2) has a 0 = a 1 = a 2 = {00} and a 3 = {01}, which is the polynomial x 3. Inspection of equation (4.13) above will show that its effect is to form the output word by rotating bytes in the input word. This means that [b 0, b 1, b 2, b 3] is transformed into [b 1, b 2, b 3, b 0].(二)算法流程加密过程伪代码；解密过程伪代码：KeyExpansion是将输入的密钥扩展为11组128位的密钥组，其中第0组为输入密钥本身，其后第n组第i列为第(n - 1)组第i列和第n组第(i - 1)列之和，其中(1 <= i <= 3)SubBytes 操作比较简单，在加密和解密过程中，分别对照加密和解密置换表即可完成KeyExpansion分为两种情况：i = 0时的密钥编排方案不同于上述过程：如下其中的加法和乘法都是建立在（GF）域上的。

基于WinPcap的网络数据包捕获与分析一、WinPcap介绍1.WinPcap简介WinPcap是一个在Windows操作系统下的免费、公开的用于直接访问网络的开发工具包（编程API）。

大多数Windows网络应用程序都是通过Winsock API（Windows套接口）这类高级编程接口访问网络的。

这种方法允许在网络上进行简单的数据传送，因为操作系统的TCP/IP协议栈实现软件会处理底层细节（协议操作、流程重组等等），并提供一个类似于读写文件的函数接口。

然而，有时候“简便方法”并不能满足实际需要。

有些程序希望绕过TCP/IP协议栈，直接处理底层网络中的通信数据，它们需要对网络进行底层进行直接访问，即在没有类似协议栈（TCP/IP协议栈）的实体介入条件下对网络进行原始访问。

基于Winsock API编程，应用程序是通过调用操作系统提供的编程接口访问TCP/IP协议栈实现网络通信的。

基于WinPcap编程，网络程序实际上是绕开操作系统的TCP/IP协议栈直接通过底层网络发送数据，因此，网络程序可以实现一些更低级、更灵活的功能。

2.WinPcap的组成与结构如图1.1，WinPcap由一个数据包监听设备驱动程序（NPF）、一个底层的动态连接库（）和一个高层的不依赖于操作系统的静态库（）共三个部分构成。

这里，NPF在操作系统的内核级，、在用户级。

1）数据包监听设备驱动程序Array技术实现上，为了实现抓包，系统必须绕过操作系统的协议栈来访问在网络上传输的原始数据包（rawpacket）。

这就要求WinPcap的一部分运行在操作系统核心内部，直接与网络接口驱动交互。

由于这个部分是系统依赖（system dependent）的，在Winpcap的解决方案中它被视为是一个设备驱动，称作NPF（Netgroup Packet Filter）。

图1.1 WinPcap的组成和结构2）底层的动态连接库（）和高层静态库（）为了方便编程，WinPcap必须提供一个编程接口（API），这就是WinPcap的底层的动态连接库（）和高层静态库（）。

Winpcap使用介绍Winpcap使用介绍Winpcap简介Winpcap（windowspacketcapture）是在Win32平台上的强大的、有较好扩展性的底层网络分析体系结构，是Unix下的lipbcap移植到windows下的产物，是Win32环境下数据包捕获的开放代码函数库。

Winpcap是第一个Win32开放式的捕获包的体系结构，能够支持大多数应用程序的需要。

如图A-1所示，Winpcap包含了一个内核级的数据包过滤器——NPF(NetgroupPacketFilter)、一个底层动态链接库（Packet.dll）和一个高层的独立于系统的库（Wpcap.dll）。

这三个模块中，NPF属于内核级，其他两模块属于用户级。

图A-1Winpcap的结构图NPF模块过滤数据包，将数据包不做任何改动的传递给用户，它还包含了一些操作系统专用代码（如：时间戳管理）。

Packet.dll模块提供了Win32平台下的捕获包的驱动接口。

实际上，不同版本的Windows都提供了不同的内核模块和应用程序之间的接口函数，Packet.dll有一套独立于系统的API来处理这些差异。

基于Packet.dll编写的程序可以不经过重新编译就在各种Win32平台下实现捕获数据包。

Packet.dll还包含了其他一些函数。

它可以进行一些底层的操作，Packet.dll和NPF都依赖于操作系统，并且由于Windows95/98和WindowsNT/2000之间操作系统结构的不同而在不同版本的操作系统上有所不同。

Wpcap.dll库不依赖于操作系统，并且它包含了一些其它高层的函数，比如：过滤器生成器、用户定义的缓冲区和高层特性（数据统计和构造数据包）。

Winpcap提供的功能包括四个方面：捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据包；在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；在网络上发送原始的数据包；收集网络通信过程中的流量信息。

WinPcap：⽹络监控的基⽯稳定版本:WinPcap 4.0.2最近版本:WinPcap 4.1 beta5WinPcap是Windows环境访问链路层的⼯业标准级别的⼯具。

允许应⽤程序绕过协议栈抓取和传输⽹络包，且有以下有⽤特性，包括内核级包过滤，⽹络统计引擎并⽀持远程抓包。

WinPcap包括⼀个继承操作系统以提供底层⽹络访问的驱动，和⼀个⽤来轻松访问底层⽹络的库。

该库也包含Unix下的API libpcap。

由于众多特性，WinPcap成为许多开源或商业⽹络⼯具的抓包和过滤引擎，包括协议分析，⽹络监控，⽹络⼊侵检测系统，嗅探器，流量⽣成器和⽹络测试器。

其中⼀些⼯具，像Wireshar，Nmap,Snort,ntop在⽹络社区被⼴泛使⽤。

WinPcap同时也是WinDump诞⽣之地，WinPcap是windows版本的流⾏tcpdump,能被⽤来按照各种各样复杂的规则监视，分析⽹络流量并存盘。

看看基于WinPcap开发出的众多知名产品:Ethereal,Windump等等，当然还包括国内有名(⾮常有⽤但被⼈滥⽤⼜⼗分讨厌)的⽹络剪⼑⼿，P2P终结者，⽹络执法官等等.还包括基于它开发的不同语⾔的库，如JPcap(⽤于Java)，pypcap(⽤于Python)，sharpcap(.NET)0x4553-IntercepterThis program offers the following features: - Sniffing passwords\hashes of the types:ICQ\IRC\AIM\FTP\IMAP\POP3\SMTP\LDAP\BNC\SOCKS\HTTP\WWW\NNTP\CVS\TELNET\MRA\DC++\VNC\MYSQL\ORACLE -Sniffing chat messages of ICQ\AIM\JABBER\YAHOO\MSN\GADU-GADU\IRC\MRA - Changing MAC address of LAN adapters - Raw mode (with filtering rules) - Capturing packets and post-capture (offline) analyzing - Remote traffic capturing via RPCAP daemon -Reconstruction of SMTP\POP3 messagesAerosolWardriving utility for Windows.AirSnareAirSnare is an intrusion detection system to help you monitor your wireless network.AnalyzerAnalyzer is a fully configurable Network Analyzer for Win32. It includes several functionalities that are needed by network management operator. Analyzer is based on WinPcap and it is able to capture packets on most Win32 platforms (and link-layer technologies). Analyzer 3.0 comes out with some event logging, LAN monitoring and traffic monitoring capabilities. However,Analyzer 3.0 most valuable point is the ability to parse network packets according to the protocol description contained into some external files, which can be modified at run-time by the user.AnetTestAnetTest is a integrated packet generator and sniffer for Ethernet, but also works with blocks of data over TCP connection.Enables you to use scripts for automated testing, monitoring, imitating of various network objects, creating custom network tools.ArchaeopteryxArchaeopteryx is a Passive mode OS Identification Tool. It is based off Siphon v.666 by SubTerrain. It has a GUI and a highly configurable OS signature file.ARP0cARP0c is an ARP redirector and bridging engine. ARP requests from various sources in a switched environment get false ARP response which point to the host running ARP0c. Packets from these hosts are bridged to the realdestination address to allow normal network operation and keep TCP connections alive.Asn1BrowserThe Asn1Browser analyzer decodes ASN1 binary data and provides an advanced display for the user.assnifferassniffer can monitor a network, and for every HTTP transfer it sees, save a copy of the transferred data.AutoScan-Network AutoScan-Network is a network discovering and managing application.BillSniffBillSniff is a free (freeware) sniffer under MS Windows.CAS BACnet ExplorerAutomatically discover all the BACnet® IP, BACnet® Ethernet and BACnet® MSTP devices, objects, and their properties on your network. The objects and devices are arranged in an easy to use tree format with braches for each network, object, and device.Bit-TwistBit-Twist is a simple yet powerful WinPcap-based Ethernet packet generator. It is designed to compliment WinDump, which by itself has done a great job in capturing network traffic. With Bit-Twist, you can now regenerate the captured traffic onto a live network! Packets are generated from windump trace file (.pcap file). Bit-Twist also comes with a comprehensive trace file editor to allow you to change the contents of a trace file.BochsBochs is a highly portable open source IA-32 (x86) PC emulator written in C++, that runs on most popular platforms.It includes emulation of the Intel x86 CPU, common I/O devices, and a custom BIOS.Busted!Busted! records AOL instant message conversations, web sites visited, applications used, keystrokes and takes periodic screen shots.CableMonCable traffic monitoring tool.Cain & AbelCain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.CarnivorePECarnivore is a surveillance tool for data networks. At the heart of the project is CarnivorePE, a software application that listens to all Internet traffic (email, web surfing, etc.) on a specific local network. Next, CarnivorePE serves this data stream tointerfaces called "clients." These clients are designed to animate, diagnose, or interpret the network traffic in various ways.cdpr - Cisco Discovery Protocol Reportercdpr is used to decode a Cisco Disovery Protocol (CDP) packet, by default it will report the device ID, the IP Address (of the device), and the port number that the machine is connected to. Optionally it will decode the entire CDP packet.choozmailparental control software.CHScannerCHScanner allows you to scan in "style" from Windows XP SP2 and higher OS. It is IPv4 and IPv6 enabled, it has a skinnable interface and it has the ability to mimic various operating systems. Last but not least, it has many scanning methods.coLinuxCooperative Linux is the first working free and open source method for optimally running Linux on Microsoft Windowsnatively. More generally, Cooperative Linux (short-named coLinux) is a port of the Linux kernel that allows it to run cooperatively alongside another operating system on a single machine. For instance, it allows one to freely run Linux on Windows 2000/XP, without using a commercial PC virtualization software such as VMware, in a way which is much more optimal than using any generalpurpose PC virtualization software.CORE IMPACTAutomated, comprehensive penetration testing product for assessing specific information security threats to an organization.dasniffdaSniff is an open source customizable sniffer for win32 systems. It helps you to log your LAN traffic by specifyingpacket rules as filters.Deep Network Analyzer (DNA)DNA is an open, flexible and extensible deep network analyzer (software server) and architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks. DNA is designed to be used for Internet Security, Intrusion detection, Network Management, Protocol and Network Analysis, Information Gathering, Network Monitoring applications.dsniffdsniff is a collection of utilities to aid in sniffing network data.E.L.AE.L.A. identifies and counts the network traffic by any application. In addition the traffic is separated between local network(s) and Internet (external networks).EffeTech HTTP SnifferEffeTech HTTP Sniffer is a HTTP protocol network sniffer, packet analyzer and file rebuilder based on Windows platform. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol and to rebuild the HTTP communications and files sent through HTTP protocol.Engage Packet BuilderScriptable libnet-based packet builder for Windows platform.EthergrouikEthergrouik is a Windows open source project (C + GTK) whose main goal is to represent graphically connections by protocols on your network.EtherSnoopEtherSnoop is a basic network sniffer, that can capture all packets going through the network. It lists the captured data in real-time, using an easy-to-understand interface with a hex and text display of the packet content. EtherSnoop also offers basic filtering by protocol type and a tree-style packet explorer. The output can be saved to file and reloaded later if needed. ettercapEttercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis.FAP GuardFAP Guard allows DirecPC and DirecWay users to monitor their Fair Access Policy ( FAP ) download level, thus preventing them from getting throttled or disconnected. You might also find this application useful if you are paying for download, or have a download limit imposed by your ISP. It provides some interesting network traffic statistics as well.FanfareSVTThe Fanfare Group delivers one-click test automation™ for communication equipment manufacturers who need to reduce their time to market and improve product quality.FramePadFramePad is a Windows based packet sniffer and protocol analyzer, designed from the ground up with ease and functionality in mind. It allows you to examine data from a live network or from a capture file on disk.FTPXeroxFTPXerox grabs files that are transferred across the network using the FTP protocol. It implements a full end-to-end TCP re-assembly engine that watches for FTP transfers.Gamer's IPX Tunnel (GIT)GIT is a freeware utility to link LANs together over the internet for IPX-based network gameplay. It can also be used to bridge many configurations of IPX packets and frames from once point to another.GIPS IP Network SimulatorThe GIPS IP Network Simulator is a software tool that allows the user to emulate network behavior by delaying and/or dropping packets in an IP-network. Installed in a laptop it can be placed between two LAN’s, two gateways, or any two IP devices and simulate the network conditions experienced by the two end-points.Hammer Call AnalyzerThe Hammer Call Analyzer enables users to visualize signaling and voice quality problems in VoIP networks. For example, the unique call list and multistage call flow display features walk engineers through the legs of a particular call. In addition, the Hammer Call Analyzer displays waveforms and the Stream Quality Signature for any call. HiDownloadHiDownload is a multi-threaded download manager that allows you to download individual files (or lists of files) from web and FTP.HoneydHoneyd is a small daemon that creates virtual hosts on a network that enhances network security by providing "honeypot" decoys that enable network security officers to detect, monitor, and contain unauthorized network activities without the intruder knowing they are being tracked.hpinghping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.HTTP snoop A simple but functional HTTP sniffer application. It will display a few basic information about every "HTTP packet" that it sees on the NIC and decode all basics authentication header entries it finds (both for proxies and for web sites). It will also write everything in the HTTP request that is both in the same packet and before the firs null char.HttpTracerView web traffic between browser and any Internet server. HttpTracer is a windows program that runs as a proxy server on your desktop, catching and displaying all textual commands and data sent and recieved by a web browser. jNetPCAPjNetPCAP is a java library that is a wrapper around WinPcap. What makes this library unique is that it is a comprehensive and accurate wrapper around the libpcap library.JPcapA Java wrapper for WinPcap. It allows Java code to access to the WinPcap (and libpcap on UNIX) calls.IM SnifferIntercepts and decodes all instant message traffic received by the computer. A high performance engine delivers real time message decryption. Conversations can be viewed immediately or saved for later analysis. Freeware. iNetWatcheriNetWatcher© is based on Winpcap, may fully monitor the Internet activity of staff or students, record the E-mail transmitting through the Internet and Web Page; monitor the various real-time chatting messages and IM files sent; monitor the register table, hard disk, system information of the employee's computer; monitor FTP; monitor net flow of all staff. ipInterceptorTrace TCP/UDP Packets on your workstation. View packets in a logical sequence, with requests and responses grouped into conversations (showing the resulting response times). Set filters for tracing. View headers and data in text or HEX format. IpMaster/IpMasterProInternet/Network Ip address & data packet monitor.IP SnifferWindows 2000/XP packet sniffer with replay function. Monitor is a bandwidth analysis utility. Besides giving a graphical illustration of the bandwidth usage on your computer or the network it resides, you get a list of all incoming and outgoing connections. KolSnifferKolsniffer contains a component to write very small self-contained WinPcap applications with Delphi and the Key Object Library framework. The source code is a translation of the Tsniffer class that Umar Sears wrote earlier. The source code is freeware, with the permission of the original author. It was written by . The zip filecontains a demo with sources, that illustrates how to use the component. The Key Object Library framework itself is available fromLaBrea@HomeLaBrea@Home is a version of the original network administrator's tool "LaBrea" for home use. LaBrea is a way to combat both port scanners and worms such as Code Red and Nimda. The original network administrator's "LaBrea" creates phantom machines which hold scanners and worms in a sort of "tarpit", luring them in, and holding onto their communications with what they think are real machines.LeetGeek ICMP TunnelerAn ICMP tunneling program.LibnetLibnet is a high-level API (toolkit) allowing the application programmer to construct and inject network packets. It provides a portable and simplified interface for low-level network packet shaping, handling and injection.LibnidsLibnids is an implementation of an E-component of Network Intrusion Detection System. It emulates the IP stack of Linux 2.0.x. Libnids offers IP defragmentation, TCP stream assembly and TCP port scan detection.LineAge UtilsLineAge Utils is tool that allows editing of colored chat, and NPC/mob description in Lineage 2 game. It also has integrated sniffer which allows user to import game character inventory and warehouse into material calculator, which is also part of LineAge Utils.lwIPlwIP is a small independent implementation of the TCP/IP protocol suite. The focus of the lwIP TCP/IP implementation is to reduce the RAM usage while still having a full scale TCP.MSN Protocol AnalyzerMSNProtocol Analyzer(MSNPAnalyzer) is a network utility that can monitor (or capture, monitor) the sessions of MSN Protocol. If you use this program in conbination with SwitchSniffer program, you can capture and see all the MSNP sessions including conversations and MSN commandsMSN Webcam RecorderMSN Webcam Recorder is a tool that allows you to record video streamed to and from your computer by MSN Messenger's Webcam Feature.myNetMonmyNetMon is windows based network monitor and packet analyzing (sniffer).NemesisNemesis is a command-line network packet injection utility for UNIX-like and Windows systems. You might think of it as an EZ-bake packet oven or a manually controlled IP stack. With Nemesis, it is possible to generate and transmit packets from the command line or from within a shell script.Net::Pcap for Win32A Perl interface to the libpcap library. Net::PcapUtils is available on the same site.NETI@homeNETI@home is an open-source software package that collects network performance statistics from end-systems. It has been written for and tested on the Windows, Linux, and Solaris operating systems, with testing for other operating systems to be completed soon. NETI@home is designed to run on end-user machines and will collect various statistics about Internet performance. These statistics will then be sent to a server at the Georgia Institute of Technology (Georgia Tech), where they will be collected and made publicly available.NetCalibratorNetCalibrator offers statistical analysis of captured data in support of performance analysis. The approach being used provides ability to quantify performance issues for small as well as large (>500,000) number of packets. NetPredictorNetPredictor offers monitoring and prediction of application performance. It enables you to build, or to interactively discover, the path between an application user and the server.netwib, netwox and netwagNetwib provides sniff, spoof, client, server and most functions needed by network programs. Toolbox netwox helps to find and solve networks' problems. Netwag is a graphical network toolbox. Netwox and netwag contain over 150 tools.NetWitnessNetWitness gives an organization the ability to quickly understand and respond to network activity of interest, regardless of the device provisioning the data or the application producing the packets.NetworkMinerA passive network monitoring tool for Windows with an easy-to-use graphical interface. NetworkMiner can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off line analysis. The source code is available as open source.Network packet generatorNetwork Packet Generator (npg) is a free GNU GPL Windows packet injector (generator) that utilizes WinPcap to send specific packets out a single or multiple network interfaces. These packets and other extended options can be defined on the command line, in a packet file, or combination of the two.NeVODetermine vulnerabilities on your network through passive monitoring much like a sniffer. NeVO dynamically learns about your servers, services and vulnerabilities by performing signature and protocol analysis of the observed network sessions.NeWTEasy-to-use windows vulnerability scanner based on Nessus technology. NeWT installs on any Windows 2000 or Windows XP computer and can quickly scan several thousand hosts for vulnerabilities and produce detailed vulnerability reports. ngrepNgrep strives to provide most of GNU grep's common features, applying them to the network layerNmapNTNmap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques (determine what services the hosts are offering), and TCP/IP fingerprinting (remote host operating system identification). Nmap also offers flexible target and port specification, decoy scanning, determination of TCP sequence predictability characteristics, sunRPC scanning, reverse-identd scanning, and more.ntopntop is a tool that shows the network usage, similar to what the popular top Unix command does.Nuzzler IDSThe Securepoint Intrusion Detection System (Nuzzler) allows to analyse the network for intrusion detection. Nuzzler can detect possible attacks, viruses, trojans and other bad traffic.Oidview MIB BrowserMIB browser and snmp toolset for network fault management. Free download for network professionals.P2P WatchDogP2P WatchDog is a network sniffer which can monitor and block several Peer-to-Peer file transfer protocols, including FastTrack, Gnutella, DirectConnect, EarthStation5, eDonken, Filetopia, BitTorrent, MP2P, and Overnet.PacanalPacket capture and analyzer program. The source contains a C# reimplementation of the packet.dll WinPcap library. Packet ExcaliburA multi-platform graphical and scriptable network packet engine with extensible text based protocol descriptions.PacketVBIts an ActiveX for use with Visual Basic that wraps the function exported by the WinPcap API (packet.dll). PacketXPacketX is set of ActiveX classes that integrate winpcap packet capture functionality with Visual Basic or anyother programming environment supporting Microsoft ActiveX technology.PacketyzerPacketyzer is a Windows user interface for the Ethereal packet capture and dissection library.PcapyPcapy is a Python extension module that interfaces with WinPcap/libpcap. Pcapy enables python scripts to capture packets on the network. is a .net wrapper for WinPcap written in C++/CLI and C#. It Features almost all WinPcap features and includes a packet interpretation framework. It has different advantages over previously existing WinPcap wrappers and is still in development for new features and bug fixes and is written with pretty high standards of coding.PerformaSureSitraka PerformaSure allows J2EE development teams to identify sources of performance problems within an assembled application. PerformaSure coordinates the collection of performance metrics for any given transaction, following the path of execution from the initial HTTP request through load balancers, application servers, to the database and back again.PI IT MonitorPI IT Monitor collects real-time information regarding the performance of various elements that compose an IT infrastructure. But in addition to collecting real-time values, PI IT Monitor archives such data and makes them available for use in reporting, analysis, troubleshooting, and decision making.PingPlotterPingPlotter is a network troubleshooting and diagnostic tool. It uses a combination of traceroute, ping, and whois to collect data quickly, and then allows you to continue to collect data over time to give you the information you really need to identify problems (both short-term and long-term trends).PromiScanSoftware for remotely monitoring computers on local networks to locate network interfaces operating in a promiscuous mode.PortScannerA TCP port scanner.PSentry Internet Policy Guard & SurveillancePSentry sniffs network traffic at gateway point, captures and records user activites like web surf, emails, web submissions, instant messager sessions (AOL aim, MSN, ICQ, Yahoo, QQ, googletalk). It can log or block ftp, p2p file transfers. PSentry deloys different Internet policies by IP/MAC address or by user, to controls which resource or servce is permited or blocked on a LAN.Pseud IP MasqueradePseud IP Masquerade is a Windows application and NT/2000 Serivce, that has some basic functions of "IP Masquerade".pypcapsimplified object-oriented Python extension module for libpcap - the current version, the legacy version shipping with some of the BSD operating systems, and the WinPcap port for Windows.QtNetworkMonitorThe project is a KISS network monitor that works under both Windows and Linux. It shows how much bandwidth you are taking on a daily basis.rawstuffrawstuff is a toolkit for totally raw (MAC level and with no TCP/IP installed) send and receive on Windows. SatoriSatori is a passive OS Fingerprinting tool for Windows. Unlike most other passive tools it parses and tries to use the following protocols for OS Identification: CDP, DHCP, EIGRP, HPSP , HSRP, ICMP, IGMP, HTTP, MDNS, OSPF, SAP, SCCP, SMB, SNMP, STP, TCP, and UPNP with new protocols being added from time to time.Show TrafficShow Traffic monitors network traffic on the chosen network interface and displays it continuously. It could be used for locating suspicious network traffic or to evaluate current utilization of the network interface.SIMHSIMH is a highly portable, multi-system simulator.SniphereSniphere is an another network wiretapping program for Windows using winpcap. Nevertheless, Sniphere is a pretty handy program with a lot of possibilities which most of free sniffers do not have.SmartSniffSmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump.snoopSnoop is component library encapsulating WinPcap used in Delphi.SnoopAnalyzerSnoopAnalyzer Standard is a network protocol analyzer based on network data capturing technology under Microsoft Windows platforms(95/98/Me/2000/NT/XP).SnoopMSNBlockSnoopMSNBlock is a software to block MSN messenger service used in your company. SnoopNetCoopSnoopNetCop Standard is a program that can detect possible packet sniffing attack on your network. snortSnort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis andpacket logging on IP networks.snotSnot is an arbitrary packet generator, that uses snort rules files as its source of packet information. It can be used asan IDS evasion tool, by using specific decoy hosts, or just something to keep your friendly IDS monitoring staff busy. SOAPscopeSOAPscope is a Web services diagnostic system that collects and analyzes information about SOAP and WSDL by monitoring communications among SOAP endpoints.ssldumpssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic.STINGA NGN Monitor:Protocol analyser focusing on SS7oIP from Utel Systems. Protocols like ISUP (ITU, ANSI, UK), SCCP, TCAP, MAP, INAP, CAP/CAMEL, SMS, IS-41, Megaco/H.248, MGCP, SIP, SDP, RTP, SIP-T (ITU, ANSI, UK, DPNSS/DASS2), SCTP,M2PA, M2UA, M3UA, SUA, IAU, DUA, V5UA, TCP, UDP, IP and others are decoded in detaild by this product.STINGA SIP SimulatorProtocol simulator for SIP and SDP protocol testing.SuperAgentThis product from NetQoS analyzes application response times without the need to deploy client-side agents. TCPKillNTTCPKillNT is a TCP connection "Reset" utility for Microsoft Windows NT platforms. It has the ability to send RST packets to already established TCP connections. Quite deadly on a LAN. It is very useful for IDS kind of products which need to terminate a TCP session.tingting is an OSI layer 4 connectivity assurance tool. It supports UDP multicast, unicast and TCP/IP. It makes use of the packet capture library to perform passive multicast monitoring.TJesNetMonitorBorland C++ Builder wrapper for WinPcap. Comes with a sample application.TraceDetTraceDet is a Traceroute Detector for Windows NT. Basically, it detects and logs if somebody trace routes to your host. The idea is that when somebody traces to your host, you receive IP packets with TTL value equal to 1. So, TraceDet looks out for suchpackets.tracetcptracetcp is a command line traceroute utility for WIN32 that uses TCP SYN packets rather than ICMP/UDP packets that the usual implementations use, thus bypassing gateways that block traditional traceroute packets.TrafficStatisticMZL & Novatech TrafficStatistic shows the consumed traffic volume comfortably in system tray.TrafficWatcherA tool to measure network traffic by service (FTP, mail, news, web, UDP etc)TrafMeterTrafMeter is an utility for accounting and realtime monitoring of Internet traffic to and from a local network. It includes flexible filter engine, extensive logging facility and friendly user interface.uIPuIP is an implementation of the TCP/IP protocol stack intended for small 8-bit and 16-bit microcontrollers. It provides the necessary protocols for Internet communication, with a very small code footprint and RAM requirements - the uIP code size is on the order of a few kilobytes and RAM usage is on the order of a few hundred bytes.Unsniff Network AnalyzerUnsniff features brand new visualization of packet data, advanced reassembly capabilities, full stream monitoring and several other enhancements over the current crop of network analyzers. What really sets Unsniff apart is its Scripting capabilities. Unsniff allows you to write your own network analysis scripts using the Ruby scripting language.You can also write powerful protocol handlers and other types of plugins using XML and/or C++. Unsniff is even available in Japanese.Url SnooperUrl Snooper is a a program written to help users locate the urls of audio and video files so that they can be recorded. VB.PCAPVB.PCAP is an "Open Source and completely free" packet capture library for Visual Basic (tested on VB5 andVB6, not tested on ) based on Winpcap. The library exposes a set of APIs, that wrap aroud Winpcap using the _stdcall convention. The library is the foundstone for a network analyzer in VB.Viper ChatViperChat is a FREE LAN chat client compatible with Vypress Chat™ protocol version 1.93. It uses UDP communication over WinPcap.VLADescu VLADescu is a network content sniffer, it is currently able to recognize gif, jpeg and audio mpeg files. VLADescu listens to network traffic and picks out images and mp3s from sniffed TCP streams. It can be used on local LAN or on wireless network (if your driver supports promiscuous mode, or even better, monitor mode).WallCoolerWallCooler is a powerful and flexible VPN solution to access Home or Office computers & networks from anywhere. All Windows based applications are supported, no need to use special applications or synchronize files. Users can remote access organization's databases, e-mails, remote desktops, product catalogue... from anywhere. WallCooler sits on the local company network, uses an existing Internet connection and automatically manages incoming connections via relay servers.Warp PipeWarp Pipe is free software that runs on your PC or Mac and is available for Windows, Mac OSX, Linux, and BSD operating systems. While running on your PC or Mac, Warp Pipe allows you to play LAN-enabled Nintendo GameCube games over the Internet with other GameCube gamers.Watt-32Watt-32 is a library for making networked TCP/IP programs in the language of C and C++ under DOS and Windows-NT. WebSnurfWebsnurf is a small application that follows a user web-surfing; that is to say, as you run WebSnurf on your PC, you can pursue web-surfing movements made on another PC. Obviously, you have to be connected over the same LAN.Win32::NetPacketWin32::NetPacket is an Object-Oriented interface to the WinPcap packet.dll library.Windows ARP SpooferWindows ARP Spoofer (WinArpSpoof) is a program that can scan the computers including network devices and can spoof their ARP tables on local area network and can act as a router while pulling all packets on LAN.Windows ToolboxThe Windows Toolbox is a comprehensive collection of software and information for Windows - a toolbox of high quality applications and utilities for a wide array of functions, all freely re-distributable and under Free, Open Source, Freeware, Shareware or similar licences; documents on installing, configuring and maintaining Windows and various software applications, for stability, performance, usability and security.WindumpWinDump is the Windows version of the famous tcpdump Unix tool. It's developed and maintained by the WinPcap team. WinfingerprintWinfingerprint is a Win32 Host/Network Enumeration Scanner. Winfingerprint is capable of performing SMB, TCP, UDP, ICMP, RPC, and SNMP scans.WinPcapArpWinPcapArp is ARP client library that works on Windows OS(NT and 2000). The main purpose of this library is to get a MAC address of the target ethernet NIC with the IP address.WinPcapDhcpCDWinPcapDhcpCD is a DHCP client demon library that works on Windows OS (NT and 2000). The purpose of this library is to get more than one IP addresses in your application program.winpcapyPython port of Winpcap functions using ctypes. Work with Python 2.x and 3 under Linux / Windows. This is a low level implementation, no object or pythonic way, so you need ctypes knowledge to use it.WinSniffWinSniff is an application for capturing packets on the network. It displays all the packets that are transmitted on the local network and gives detailed information about each header in the packet.WinWhifWinWhif allows any PC running Windows (95, 98, NT or 2000) to record the DICOM traffic between two machines on the same network. It can be useful in diagnosing DICOM communications problems.Wireshark/EtherealWireshark (formerly known as Ethereal) is the world's most popular network analyzer. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.wpa_supplicantwpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11authentication/association of the wlan driver.WIRE1xWIRE1x is an open source implementation of IEEE 802.1x client (supplicant). It supports various EAP authentication methods.YATTYATT is a project to replace the current proliferation of trace tools ( tcpTrace, proxyTrace, pcapTrace ), with a single extensible tracing tool. YATT features a new GUI built with WTL, complete with a Hex View mode, and currently ships with 2 Trace providers, one based on WinPCAP and one based on the W2K Raw sockets support.YorkYork logs ip/fqdn addresses if all traffic. It can save sniffed http and ftp files. Also you can sniff for HTTP, FTP, POP3, SMTP, SMB, VNC and AIM password/hash. Further you can see the web browsing from other users, so your browser will show the same pages as the selected user. A screensaver is included, it shows the pictures which are sniffed in a slide show manner.。

winpcap捕捉⽹络数据包利⽤WIPCAP捕捉IP数据包分析局域⽹流量1、背景知识1.1、IP协议IP（Internet Protocol，互联⽹协议）协议是TCP/IP协议族中最为核⼼的协议，所有的TCP、UDP、ICMP及IGMP数据都以IP 数据报格式传输。

IP协议把传输层送来的消息封装成IP数据包，并把IP数据包传递给数据链路层。

IP协议制定了统⼀的IP数据报格式，向传输层屏蔽了通信⼦⽹的差异，从⽽为消息的收发双⽅提供了⼀条透明的传输通道。

IP数据包结构如图1-1：图1-1 IP包结构1.版本IP数据报的第⼀个域是版本域，其长度为4bit，表⽰所使⽤的IP协议的版本。

通信双⽅使⽤的IP协议的版本必须⼀致。

版本域值为4则表⽰IPv4；版本域值为6则表⽰IPv6。

当前的版本为IPv4。

2.报头长度报头长度域长度为4bit，它以4个字节为计算单位表⽰报头的长度，该长度不包含数据部分。

报头中除了IP选项域与填充域之外，其他各项是定长的。

因为很少使⽤IP选项功能，所以，该域的值⼀般为5，意味着报头的长度是5个4字节，也就是20个字节。

协议规定：IP数据报的报头长度必须是4字节的整数倍。

当IP报头长度不是4字节的整数倍时，必须利⽤最后⼀个填充域“添0”来加以填充。

3.服务类型如图1-2所⽰，该字段占8bit，包括3bit的优先级字段，4bit的服务类型（type of service，TOS）字段和1bit的保留位，保留位必须置0。

该字段⽤于指⽰路由器如何处理该数据报。

图1-2 服务类型字段结构3bit的优先级表⽰数据报的重要性，共分8级，数值越⼤等级越⾼，优先级越⾼则表⽰数据报越重要（该字段值现在已被忽略）。

4bit的TOS字段分别表⽰：最⼩时延（D）、最⼤吞吐量（T）、最⾼可靠性（R）和最⼩费⽤（C）。

每个位都有0或1两个值，但4bit中最多只能有⼀个位的值为1。

如果所有4 bit均为0，那么就意味着是⼀般服务。

WinPcap网络分析的体系结构方松茂李祥（贵州大学计算机软件与理论研究所贵阳550025）摘要：WinPcap是一个包含了一套与libpcap兼容的捕获网络数据包的函数库，在各种不同的网络分析工具、故障工具、安全工具和监听工具开发中被广泛使用；本文首先介绍WinPcap，分析其体现结构，并通过捕获、发送网络数据包实例说明该函数库的使用方法。

关键词: WinPcap , LibPcap, 结构体系，网络分析WinPcap是一个包含了一套与libpcap兼容的捕获数据包的函数库。

这套函数库是由加州大学和Lawrence Berkeley实验室及其投稿者联合开发的。

他们在1999年3月31日推出了1.0版，提供了用户级BPF过滤；1999年8月21日推出了2.0版，将BPF过滤增加到内核中并增加了内核缓存；2001年3月15日推出了2.1版，该版对libpcap0.5.2进行了升级，并可支持更多的网络类型；2001年1月30日推出了2.2版；2002年3月28日推出了2.3版；2003年1月10日推出了最新的3.0版，增加了NPF设备驱动的一些新的特性及优化方案、在wpcap.dll 中增加了一些函数等等功能。

1 带内核驱动模式的WinPcap及其功能进行网络分析的应用程序依赖于一套适当的指令来捕获网络中的数据包，监听网络等等。

几乎所有的Unix系统版本都含有至少是支持捕获分组的内核模块。

在Windows中有一些API有自己的内核模块，然而它们都有一些局限。

例如，Netmon API不是免费的，其扩展性很有限，而且它不允许发数据包。

IP过滤驱动程序只在Windows2000上有效，它除了IP协议外不支持任何其他协议。

它允许操作或丢弃数据包但不允许监听和产生数据包。

PCAUSA[11]是一套商业化的产品，它提供一个捕获包的接口及兼容BPF的过滤器。

然而，用户的接口都很底层，没有提供类似于产生过滤器的抽象函数。

浅谈WinPCap和计算机网络协议来源：dnf连发对于一些协议分析，我们可以借助一些软件的力量。

这里我们就将要为大家讲解一下WinPCap以及计算机网络协议等相关的内容。

那么就让我们先来看看具体的WinPCap的工作原理：系统的开发和应用WinPcap支持Win32平台上信息包的捕获和网络分析,它的主要思想来源于Unix系统中最着名的包截获架构,目前已在许多领域得到了应用,如网络监控、电子监考等㈡103.WinPcap的基本结构由3个模块所组成.(1)内核级的网络组包过滤器(Netgroup PacketFilter,NPF).运行于操作系统内核中的驱动程序,直接与网卡驱动程序进行交互.它的主要功能是过滤数据包,在包上附加时间戳、数据包长度等信息.它直接从数据链路层取得数据包,不加修改地传给运行在用户层的应用程序,也允许用户发送原始数据包.(2)低级动态链接库(Packet．d11).用于在Win32平台上为数据包驱动程序提供一个公共接口,把应用程序和数据包监听设备驱动程序隔离开来,使得程序可以不加修改地在不同Windows系统上运行.(3)高级系统无关库(Wpcap．d11).工作在用户级,和应用程序编译在一起,并使用Packet．dll提供的模块,向应用程序提供完善的监听接口.Wpcap．dll模块与Unix系统下的BSD截获架构提供的Libpeap 库完全兼容,提供了一组功能强大而且跨平台的函数,利用这些函数,可以不去关心适配器和操作系统类型.系统的开发和应用WinPCap向上层的应用程序提供了网络监听的接口,通过这些接口,应用程序可以捕获网络通信中发送或接收的数据包.因此,网络协议实验系统可以利用WinPCap捕获在实际的网络通信中产生的数据包,并以一定的方式展示出来.实验系统的主要目的是要方便对计算机网络协议的理解,因此针对计算机网络的原理和协议,系统在以下2方面着重进行表现.(1)协议分层.目前实际应用的计算机网络都是基于TCPIP体系结构,整个网络协议分为4个层次,从下到上依次为接口层、网际层、传输层和应用层,每层又有若干协议.因此在捕获数据包后按协议进行拆分,把不同的协议数据归于相应的协议分层结构中,并把协议分层以层级的方式表示,从而把网络体系结构原理通过形象和具体的方式表示出来.(2)协议格式.实验系统的主要任务是将数据包中每层协议的数据提取出来,准确界定每个协议的起始和结束,把每个协议的数据标示出来,系统可以根据通信数据,自动分析各协议中每个字段的含义,必须根据具体的通信数据,利用所学的相应网络协议知识进行分析.为了了解协议分层结构的具体实现,本系统在开发时,采用整个数据包的数据完整连续显示,各协议的数据用突出颜色着重显示,通过观察不同协议的数据,可以了解计算机通信中,如何通过多层协议组装成完整的通信数据包.系统对通信数据的处理过程如图2所示.首先利用WinPCap的pcap—findalldevs函数获取计算机的网卡,并把可用的网卡(有的计算机可能有多个网卡)列表显示出来供用户选择.系统提供操作界面让用户选择网卡并设置通信数据包的过滤条件,系统根据用户的设置用WinPCap的pcap—open—live函数打开相应网卡接口,利用pcap—setfilter函数设置过滤条件,然后用pcap—dispatch或pcap—next —ex函数捕获通信数据包,并把数据包列表显示供用户选择.若用户选择某一数据包,系统对该数据包进行拆分,按协议分层的层次,以及各层协议的格式,界定并显示不同协议的数据.系统提供实验报告的一些辅助功能,如生成实验报告的模板,根据选择的计算机网络协议的数据,填人各字段的含义,生成并打印实验报告.实验系统的主界面如图3所示.界面主要包括:①网卡(网络适配器)列表,在上部显示;②捕获的数据包列表,在界面的中间部分显示,列表中显示了数据包的部分关键信息;③各协议及其数据,在最下部显示,这又包括2部分,左边部分显示协议名称,按协议分层的要求进行显示,右部是以十六进制表示的数据包数据,当在左边部分选择协议名称时,右部相应协议的首部数据以红色突出显示.该系统所占资源很少,因此可以在配置不高的计算机上正常运行,唯一的要求是计算机能够连入计算机网络,即使不连入Intemet,在局域网环境中也能方便地开展实验.实验时不需要专门的服务器'也不需要对计算机之间通信作特别设置,安装并运行该系统,只需要正常使用计算机进行适当的网络操作,例如用浏览器浏览学校主页,从而产生一定的网络通信数据包,系统自动捕获这些数据包并进行分析.系统的操作过程很简单,容易掌握,非常适于非计算机专业的使用,该系统已经在我校工业工程专业的"计算机网络技术"课程的实验中使用,效果良好.结语针对高校计算机网络课程的实验,开发了网络协议分析实验系统,以解决网络设备昂贵、更新换代快,教学单位无法拿出足够资金配置专门网络实验室,造成学生实验不足甚至无法实验,从而严重影响到教学质量的问题.利用该系统可以使学生了解计算机网络协议分层及其实现,并开展以太网帧格式分析、IP(目前主要是IPv4)数据包格式分析、IP控制管理协议一ICMP报文格式分析、TCP和UDP数据包分析、Hrll'P协议分析等实验教学内容.在计算机网络课程的教学和实验过程中使用网络协议实验软件系统,可以弥补网络原理教学过程抽象、枯燥的缺点,可以形象化地展示真实网络工作的过程,使学生更深入地理解计算机网络和互联网.。

Winpcap使⽤前⾔随着⽹络⼊侵的不断发展,⽹络安全变得越来越重要,于是⽹络⼊侵取证系统的研究也变得⽇益重要。

在⽹络⼊侵取证系统中,对⽹络上传送的数据包进⾏有效的监听即捕获包是⽬前取证的关键技术,只有进⾏⾼效的数据包捕获,⽹络管理员才能对所捕获的数据进⾏⼀系列的分析,从⽽进⾏可靠的⽹络安全管理。

1winpcap简介WinPcap是由伯克利分组捕获库派⽣⽽来的分组捕获库,它是在Windows操作平台上来实现对底层包的截取过滤。

WinPcap为⽤户级的数据包提供了Windows 下的⼀个平台。

WinPcap是BPF模型和Libpcap函数库在Windows平台下⽹络数据包捕获和⽹络状态分析的⼀种体系结构,这个体系结构是由⼀个核⼼的包过滤驱动程序,⼀个底层的动态连接库Packet.dll和⼀个⾼层的独⽴于系统的函数库Libpcap组成。

底层的包捕获驱动程序实际为⼀个协议⽹络驱动程序,通过对NDIS中函数的调⽤为Win95、Win98、WinNT、和Win2000提供⼀类似于UNIX系统下Berkeley Packet Filter的捕获和发送原始数据包的能⼒。

Packet.dll是对这个BPF驱动程序进⾏访问的API接⼝,同时它有⼀套符合Libpcap接⼝(UNIX下的捕获函数库的函数库。

WinPcap的结构图如图1。

WinPcap包括三个部分:第⼀个模块NPF(Netgroup Packet Filter,是⼀个虚拟设备驱动程序⽂件。

它的功能是过滤数据包,并把这些数据包原封不动地传给⽤户态模块,这个过程中包括了⼀些操作系统特有的代码。

第⼆个模块packet.dll为win32平台提供了⼀个公共的接⼝。

不同版本的Windows系统都有⾃⼰的内核模块和⽤户层模块。

Packet.dll⽤于解决这些不同。

调⽤Packet.dll的程序可以运⾏在不同版本的Windows平台上,⽽⽆需重新编译。

第三个模块Wpcap.dll是不依赖于操作系统的。

TCP/IP协议的安全隐患造成操作系统漏洞的一个重要原因，就是协议本身的缺陷给系统带来的攻击点。

网络协议是计算机之间为了互联共同遵守的规则。

目前的互联网络所采用的主流协议TCP/IP，由于在其设计初期人们过分强调其开发性和便利性，没有仔细考虑其安全性，因此很多的网络协议都存在严重的安全漏洞，给Internet留下了许多安全隐患。

另外，有些网络协议缺陷造成的安全漏洞还会被黑客直接用来攻击受害者系统。

本文就TCP/IP协议自身所存在的安全问题和协议守护进程进行了详细讨论，指出针对这些安全隐患的攻击。

TCP协议的安全问题TCP使用三次握手机制来建立一条连接，握手的第一个报文为SYN包；第二个报文为SYN/ACK 包，表明它应答第一个SYN包同时继续握手的过程；第三个报文仅仅是一个应答，表示为ACK包。

若A放为连接方，B为响应方，其间可能的威胁有：1. 攻击者监听B方发出的SYN/ACK报文。

2. 攻击者向B方发送RST包，接着发送SYN包，假冒A方发起新的连接。

3. B方响应新连接，并发送连接响应报文SYN/ACK。

4. 攻击者再假冒A方对B方发送ACK包。

这样攻击者便达到了破坏连接的作用，若攻击者再趁机插入有害数据包，则后果更严重。

TCP协议把通过连接而传输的数据看成是字节流，用一个32位整数对传送的字节编号。

初始序列号（ISN）在TCP握手时产生，产生机制与协议实现有关。

攻击者只要向目标主机发送一个连接请求，即可获得上次连接的ISN，再通过多次测量来回传输路径，得到进攻主机到目标主机之间数据包传送的来回时间RTT。

已知上次连接的ISN和RTT，很容易就能预测下一次连接的ISN。

若攻击者假冒信任主机向目标主机发出TCP连接，并预测到目标主机的TCP序列号，攻击者就能伪造有害数据包，使之被目标主机接受。

IP协议的安全问题IP协议在互连网络之间提供无连接的数据包传输。

IP协议根据IP头中的目的地址项来发送IP数据包。

实验二 WINPCWP编程[实验目的]了解WINPCAP的架构学习WINPCAP编程[实验原理]WinPcap是一个基于Win32平台的，用于捕获网络数据包并进行分析的开源库.大多数网络应用程序通过被广泛使用的操作系统元件来访问网络，比方sockets。

这是一种简单的实现方式，因为操作系统已经妥善处理了底层具体实现细节〔比方协议处理，封装数据包等等〕，并且提供了一个与读写文件类似的，令人熟悉的接口。

然而，有些时候，这种“简单的方式”并不能满足任务的需求，因为有些应用程序需要直接访问网络中的数据包。

也就是说，那些应用程序需要访问原始数据包，即没有被操作系统利用网络协议处理过的数据包。

WinPcap产生的目的，就是为Win32应用程序提供这种访问方式；WinPcap提供了以下功能1.捕获原始数据包，无论它是发往某台机器的，还是在其他设备〔共享媒介〕上进行交换的2.在数据包发送给某应用程序前，根据用户指定的规则过滤数据包3.将原始数据包通过网络发送出去4.收集并统计网络流量信息以上这些功能需要借助安装在Win32内核中的网络设备驱动程序才能实现，再加上几个动态链接库DLL。

所有这些功能都能通过一个强大的编程接口来表现出来,易于开发，并能在不同的操作系统上使用。

这本手册的主要目标是在一些程序范例的帮助下，表达这些编程接口的使用。

WinPcap可以被用来制作网络分析、监控工具。

一些基于WinPcap的典型应用有：1.网络与协议分析器(network and protocol analyzers)2.网络监视器(network monitors)3.网络流量记录器(traffic loggers)4.网络流量发生器(traffic generators)5.用户级网桥及路由(user-level bridges and routers)6.网络入侵检测系统(network intrusion detection systems (NIDS))7.网络扫描器(network scanners)8.安全工具(security tools)[实验内容]通过学习WINPCAP架构，编写一个网络抓包程序。