Winpcap简介
深度剖析WinPcap之(一)
深度剖析WinPcap之(一)——WinPcap简介WinPcap是Windows平台下访问网络数据链路层的开源库，该库已达到工业标准的应用要求。
WinPcap允许应用程序绕开网络协议栈来捕获与传递网络数据包，并具有额外的有用特性，包括内核层的数据包过滤、一个网络统计引擎与支持远程数据包捕获。
1.1. 什么是WinPcap大多数网络应用程序通过被广泛使用的操作系统原语来访问网络，诸如sockets。
操作系统已经处理了底层的细节问题（如协议处理，数据包的封装等），并提供与读写文件类似的、熟悉的接口，这使得用该方法可以很容易的访问网络中的数据。
然而有些时候，这种“简单的方式”并不能满足任务要求，因为有些应用程序需要直接访问网络中的数据包。
也就是说，应用程序需要访问网络中的“原始”数据包，即没有被操作系统使用网络协议进行处理过的数据包。
WinPcap的目的就是为Win32应用程序提供这种访问方式。
WinPcap提供下列功能：捕获原始数据包，无论是发送到运行WinPcap机器上的数据包，还是在其它主机（共享介质）上进行交换的数据包在数据包分派给应用程序前，根据用户指定的规则过滤数据包将原始数据包发送到网络收集网络流量的统计信息1.2. WinPcap的优点1) 自由 WinPcap遵循BSD open source licence发布。
这意味着你的应用程序拥有全部自由来修改与使用它，即使应用程序是商业化的。
2) 高性能 WinPcap实现了有关数据包捕获文献中描述的所有典型的优化方法（比如内核级的过滤与缓冲，减少上下文交换，数据包部分内容复制），加上一些原创的优化方法，如JIT过滤器编辑（JIT filter compilation）与内核级的统计过程。
因为这些原因，WinPcap胜过其它可比的方法。
3) 普及 WinPcap被许多工具作为网络接口使用——无论是自由软件还是商业软件。
包括网络协议分析器、网络监视器、网络入侵检测系统、网络嗅探器、网络流量生成器、网络测试器等等。
WinPcap 原理技术
WinPcap 原理技术winpcap是windows平台下一个免费，公共的网络访问系统。
开发winpcap这个项目的目的在于为win32应用程序提供访问网络底层的能力。
1、网络及协议分析2、网络监控3、通信日志记录4、traffic generators5、用户级别的桥路和路由6、网络入侵检测系统（NIDS）7、网络扫描8、安全工具WinPcap导入WinPcap是一个开源的专业网络数据捕获开发包，其实，WinPcap的强大功能并不仅限于数据包的获取，主要功能：捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据包；在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；在网络上发送原始的数据包；收集网络通信过程中的统计信息。
Sniffer 嗅探原理Winpcap是针对Win32平台上的抓包和网络分析的一个架构。
它包括一个核心态的包过滤器，一个底层的动态链接库（packet.dll）和一个高层的不依赖于系统的库（wpcap.dll）Packet.dll提供更方便更易用的编程接口，wpcap.dll中的接口函数Sniffer嗅探器，是一种基于被动侦听原理的网络分析方式。
使用这种技术方式，可以监视网络的状态、数据流动情况以及网络上传输的信息。
当信息以明文的形式在网络上传输时，便可以使用网络监听的方式来进行攻击。
将网络接口设置在监听模式，便可以将网上传输的源源不断的信息截获。
Sniffer技术常常用于网络故障诊断、协议分析、应用性能分析和网络安全保障等各个领域。
实现Sniffer 功能函数序列第一步：获取网络设备指针pcap_findalldevs_ex()第二步：打开网卡pcap_open()第三步：检查链路层pcap_datalink()第四步：编译BPF过滤规则pcap_compile第五步：设置过滤规则pcap_setfilter第六步：注册回调函数，循环捕获数据包pcap_loop()第七步：释放网络设备列表pcap_freealldevs()第八步：关闭WinPcap会话句柄pcap_close()获取网络设备指针（查找机器的所有网络设备接口，并使用链表结构返回）打开网络设备（打开一个用来捕获或发送流量的通用源（网卡））检查链路3层类型（检查链路层类型）编译BFP过滤规则（编译数据包过滤器，将程序中高级的过滤表达式（即过滤规则字符串）转换为能被内核级的过滤引擎所处理的内容）执行过滤规则（把一个过滤器绑定到WinPcap会话句柄）注册回调函数，循环捕获数据包（循环捕获数据包并分析）释放网络设备列表（释放链表空间）关闭WinPcap会话句柄（关闭一个和p关联的文件，并释放资源）数据包分析1.数据包的分析内容数据包(Packet)是TCP/IP协议通信传输中的数据单位,TCP/IP协议是工作在OSI模型第三层(网络层)、第四层(传输层)上的，而帧是工作在第二层(数据链路层)。
winpcap驱动
winpcap驱动WinPcap驱动是一种用于Windows操作系统的网络数据包捕获和分析的工具。
它提供了一种简单和有效的方式，使用户能够捕获和分析计算机与网络之间传输的数据包。
不管是网络管理员、安全专家还是网络开发人员，WinPcap驱动都是一个强大而有用的工具。
WinPcap驱动是一个开源项目，由意大利中科院主导开发，最初是为Unix-like系统设计的。
随着Windows操作系统的普及和用户的需求，WinPcap驱动很快被移植到了Windows平台上。
它可以兼容Windows 2000和后续版本的操作系统。
WinPcap驱动的主要功能是对计算机和网络之间的数据流进行捕获和分析。
通过捕获数据包，用户可以了解网络流量的实时情况、分析网络协议、排查网络问题以及进行网络安全监控等工作。
此外，WinPcap驱动还可以用于网络流量生成、网络性能测试和网络协议栈的开发调试等工作。
WinPcap驱动的使用非常灵活和简单。
用户只需要安装驱动程序，并在自己的应用程序中调用相关的库函数，即可实现数据包的捕获和分析。
WinPcap驱动提供了一组API，这些API可以通过编程语言（如C、C++、Python等）调用，从而方便用户编写自己的网络数据包分析和工具。
另外，WinPcap驱动还支持远程数据包捕获。
用户可以通过在远程计算机上安装WinPcap驱动，并通过网络连接进行远程数据包捕获。
这个功能对于网络管理员或者安全专家来说非常有用，可以在分布式环境中实时监控多个计算机的网络流量。
虽然WinPcap驱动提供了强大的功能和方便的接口，但是用户在使用时也需要注意一些安全和隐私问题。
首先，WinPcap驱动具有高权限的操作系统级别的访问权限，因此需要用户具备足够的权限来安装和使用。
其次，在进行网络流量分析时，用户应当严格遵守相关法律法规，并保护用户隐私和网络安全。
总的来说，WinPcap驱动是一个强大而实用的工具，可以帮助用户更好地理解和分析网络数据包。
第11讲 WinPCap
过滤数据包
int pcap_compile ( pcap_t * p, struct bpf_program * fp, char * str, //过滤表达式 int optimize, bpf_u_int32 netmask ) //掩码 int pcap_setfilter ( pcap_t * p, struct bpf_program * fp ) pcap_compile() 编译一个包过滤器。将一个高级的、布尔形式表 示的字符串转换成低级的、二进制过滤语句，以便被包驱动使用。 pcap_setfilter() 在核心驱动中将过滤器和捕获过程结合在一起。从 这一时刻起，所有网络的数据包都要经过过滤，通过过滤的数据 包将被传入应用程序。
打开一个适配器开始捕获数据包
pcap_t * pcap_open_live ( const char * device, int snaplen, int promisc, int to_ms, char * ebuf ) pcap_t *adhandle= pcap_open_live(d->name, 65536,1, 1000, errbuf );
解析数据包
不同的网络使用不同的链路层协议，不知道网络类型就无法定位数 据帧（frame） ，所以，首先使用如下函数对网络类型进行判断： int pcap_datalink ( pcap_t *p ) 它返回适配器的链路层标志，例如DLT_EN10MB表示以太网（10Mb, 100Mb,1000Mb及以上），DLT_IEEE802表示令牌环网。可以在设 置过滤条件之前先对各个设备的网络类型进行探测，以获知物理层 的数据帧格式，接下来就可以针对不同的帧格式解析出封装在其中 的报文（packet），例如IP报文，继而拆封IP报文得到TCP或者UDP 等报文，再深层次的拆封就是应用程序数据了。
winpcap的简介
WinPcap的简介winpcap(windows packet capture)是windows平台下一个免费，公共的网络访问系统。
开发winpcap这个项目的目的在于为win32应用程序提供访问网络底层的能力。
它提供了以下的各项功能：1> 捕获原始数据报，包括在共享网络上各主机发送/接收的以及相互之间交换的数据报；2> 在数据报发往应用程序之前，按照自定义的规则将某些特殊的数据报过滤掉；3> 在网络上发送原始的数据报；4> 收集网络通信过程中的统计信息。
winpcap的主要功能在于独立于主机协议（如TCP/IP)而发送和接收原始数据报。
也就是说，winpcap 不能阻塞，过滤或控制其他应用程序数据报的发收，它仅仅只是监听共享网络上传送的数据报。
因此，它不能用于QoS调度程序或个人防火墙。
目前，winpcap开发的主要对象是windows NT/2000/XP，这主要是因为在使用winpcap的用户中只有一小部分是仅使用windows 95/98/Me，并且微软也已经放弃了对win9x 的开发。
因此本文相关的程序T-ARP也是面向NT/2000/XP用户的。
WinPcap的安装和例程调试By 曹佳caojia@1.DownLoad2.安装解压得三文件：WinPcap_4_0_1_drivel.exe，WpcapSrc_4_0_1_Source_code.zip和WpdPack_4_0_1_Include_Lib.zip，第一个是驱动的安装程序，第二个是驱动的源代码，第三个是使用Winpcap所要用到的所有.h文件和.lib文件。
1)安装驱动（WinPcap_4_0_1_drivel.exe）2)WpdPack_4_0_1_Include_Lib.zip解压到一个“正式的”位置（用来配置编程环境）3)配置VC6.0环境在Tools->options->Directories里面加入解压以后的include文件夹，在Tools->options->Directories的lib里面加入解压以后的lib文件夹。
Winpcap使用
前言随着网络入侵的不断发展,网络安全变得越来越重要,于是网络入侵取证系统的研究也变得日益重要。
在网络入侵取证系统中,对网络上传送的数据包进行有效的监听即捕获包是目前取证的关键技术,只有进行高效的数据包捕获,网络管理员才能对所捕获的数据进行一系列的分析,从而进行可靠的网络安全管理。
1winpcap简介WinPcap是由伯克利分组捕获库派生而来的分组捕获库,它是在Windows操作平台上来实现对底层包的截取过滤。
WinPcap为用户级的数据包提供了Windows 下的一个平台。
WinPcap是BPF模型和Libpcap函数库在Windows平台下网络数据包捕获和网络状态分析的一种体系结构,这个体系结构是由一个核心的包过滤驱动程序,一个底层的动态连接库Packet.dll和一个高层的独立于系统的函数库Libpcap组成。
底层的包捕获驱动程序实际为一个协议网络驱动程序,通过对NDIS中函数的调用为Win95、Win98、WinNT、和Win2000提供一类似于UNIX系统下Berkeley Packet Filter的捕获和发送原始数据包的能力。
Packet.dll是对这个BPF驱动程序进行访问的API接口,同时它有一套符合Libpcap接口(UNIX下的捕获函数库的函数库。
WinPcap的结构图如图1。
WinPcap包括三个部分:第一个模块NPF(Netgroup Packet Filter,是一个虚拟设备驱动程序文件。
它的功能是过滤数据包,并把这些数据包原封不动地传给用户态模块,这个过程中包括了一些操作系统特有的代码。
第二个模块packet.dll为win32平台提供了一个公共的接口。
不同版本的Windows系统都有自己的内核模块和用户层模块。
Packet.dll用于解决这些不同。
调用Packet.dll的程序可以运行在不同版本的Windows平台上,而无需重新编译。
第三个模块Wpcap.dll是不依赖于操作系统的。
WinPcap 原理技术
WinPcap 原理技术winpcap是windows平台下一个免费，公共的网络访问系统。
开发winpcap这个项目的目的在于为win32应用程序提供访问网络底层的能力。
1、网络及协议分析2、网络监控3、通信日志记录4、traffic generators5、用户级别的桥路和路由6、网络入侵检测系统（NIDS）7、网络扫描8、安全工具WinPcap导入WinPcap是一个开源的专业网络数据捕获开发包，其实，WinPcap的强大功能并不仅限于数据包的获取，主要功能：捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据包；在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；在网络上发送原始的数据包；收集网络通信过程中的统计信息。
Sniffer 嗅探原理Winpcap是针对Win32平台上的抓包和网络分析的一个架构。
它包括一个核心态的包过滤器，一个底层的动态链接库（packet.dll）和一个高层的不依赖于系统的库（wpcap.dll）Packet.dll提供更方便更易用的编程接口，wpcap.dll中的接口函数Sniffer嗅探器，是一种基于被动侦听原理的网络分析方式。
使用这种技术方式，可以监视网络的状态、数据流动情况以及网络上传输的信息。
当信息以明文的形式在网络上传输时，便可以使用网络监听的方式来进行攻击。
将网络接口设置在监听模式，便可以将网上传输的源源不断的信息截获。
Sniffer技术常常用于网络故障诊断、协议分析、应用性能分析和网络安全保障等各个领域。
实现Sniffer 功能函数序列第一步：获取网络设备指针pcap_findalldevs_ex()第二步：打开网卡pcap_open()第三步：检查链路层pcap_datalink()第四步：编译BPF过滤规则pcap_compile第五步：设置过滤规则pcap_setfilter第六步：注册回调函数，循环捕获数据包pcap_loop()第七步：释放网络设备列表pcap_freealldevs()第八步：关闭WinPcap会话句柄pcap_close()获取网络设备指针（查找机器的所有网络设备接口，并使用链表结构返回）打开网络设备（打开一个用来捕获或发送流量的通用源（网卡））检查链路3层类型（检查链路层类型）编译BFP过滤规则（编译数据包过滤器，将程序中高级的过滤表达式（即过滤规则字符串）转换为能被内核级的过滤引擎所处理的内容）执行过滤规则（把一个过滤器绑定到WinPcap会话句柄）注册回调函数，循环捕获数据包（循环捕获数据包并分析）释放网络设备列表（释放链表空间）关闭WinPcap会话句柄（关闭一个和p关联的文件，并释放资源）数据包分析1.数据包的分析内容数据包(Packet)是TCP/IP协议通信传输中的数据单位,TCP/IP协议是工作在OSI模型第三层(网络层)、第四层(传输层)上的，而帧是工作在第二层(数据链路层)。
WinPcap编程
WinPcap编程WinPcap是一个开源的、运行于Win32平台下的体系结构，它的主要功能是进行数据包捕获和网络分析。
它允许应用程序通过协议栈捕获和传输网络数据包，也包括内核级别的数据包过滤、网络静态引擎和支持远程数据包捕获等有用的功能。
WinPcap由两部分组成：1. 驱动程序: 扩展操作系统功能提供低层次的网络访问2. 动态链接库:运行在Win32平台上的应用程序可以非常方便地访问网络低层次的数据。
Ethereal是大名鼎鼎的捕获数据包专业软件，它的运行是在WinPcap的支持之下的，如果没有安装WinPcap，Ethereal也无法正常捕获数据包。
在正式WinPcap编程之前，要配置运行环境。
Win32 平台下WinPcap应用程序需要以下四个动态链接库才能正常运行：wpcap.dllPacket.dllWanPacket.dllpthreadVC.dll这四个动态链接库在WinPcap驱动程序里。
如果应用程序出现一下提示，那就是没有安装驱动程序的原因了。
被过滤广告也可以不安装WinPcap驱动程序。
但是需要把上面提到的四个动态链接库文件拷贝到系统分区/WINDOWS/system32目录下或者接下来配置编程环境。
如果一个源文件使用了WinPcap提供的库函数，那么就需要在该文件开始的位置添加pcap.h包含文件(或者在引用的文件中)，即#include “pcap.h”也许会出现下面的错误:fatal error C1083: 无法打开包括文件:“pcap.h”: No such file or directory这个错误表明找不到pcap.h文件这个头文件在驱动程序安装完成后也是没有的，它是开发包里面的一个头文件所以，如果要运行程序还需要到官方网站上去下载WinPcap SDK―WpdPackWinPcap SDk里面包含库文件，头文件，文档文件和一些例子。
解压缩后把Include目录添加到IDE的包含文件中（VC6.0 Tools->Option->Directory; VS 2003/2005 工具->选项->项目和解决方案/项目->VC++目录）error LNK2019: 无法解析的外部符号_pcap_findalldevs_ex，该符号在函数XXX 中被引用如果发生上面的错误就表明缺少库文件，需要添加wpcap.lib到工程中(VC6.0 Project->Settings->Link->Object/library modules; VS 2003/2005 项目->添加现有项->所有文件)error C2065: “PCAP_SRC_IF_STRING”: 未声明的标识符error C3861: “pcap_findalldevs_ex”: 找不到标识符error C2065: “PCAP_OPENFLAG_PROMISCUOUS”: 未声明的标识符error C3861: “pcap_open”: 找不到标识符新的版本里WinPcap支持远程数据包获取，发生上面的错误很有可能是新的版本导致不兼容的问题，所以还应当添加一个头文件remote-ext.h ，即#include "remote-ext.h"如果还有问题，可以到WinPcaP官方网站上找FAQ。
WinPcap：网络监控的基石
WinPcap：⽹络监控的基⽯稳定版本:WinPcap 4.0.2最近版本:WinPcap 4.1 beta5WinPcap是Windows环境访问链路层的⼯业标准级别的⼯具。
允许应⽤程序绕过协议栈抓取和传输⽹络包，且有以下有⽤特性，包括内核级包过滤，⽹络统计引擎并⽀持远程抓包。
WinPcap包括⼀个继承操作系统以提供底层⽹络访问的驱动，和⼀个⽤来轻松访问底层⽹络的库。
该库也包含Unix下的API libpcap。
由于众多特性，WinPcap成为许多开源或商业⽹络⼯具的抓包和过滤引擎，包括协议分析，⽹络监控，⽹络⼊侵检测系统，嗅探器，流量⽣成器和⽹络测试器。
其中⼀些⼯具，像Wireshar，Nmap,Snort,ntop在⽹络社区被⼴泛使⽤。
WinPcap同时也是WinDump诞⽣之地，WinPcap是windows版本的流⾏tcpdump,能被⽤来按照各种各样复杂的规则监视，分析⽹络流量并存盘。
看看基于WinPcap开发出的众多知名产品:Ethereal,Windump等等，当然还包括国内有名(⾮常有⽤但被⼈滥⽤⼜⼗分讨厌)的⽹络剪⼑⼿，P2P终结者，⽹络执法官等等.还包括基于它开发的不同语⾔的库，如JPcap(⽤于Java)，pypcap(⽤于Python)，sharpcap(.NET)0x4553-IntercepterThis program offers the following features: - Sniffing passwords\hashes of the types:ICQ\IRC\AIM\FTP\IMAP\POP3\SMTP\LDAP\BNC\SOCKS\HTTP\WWW\NNTP\CVS\TELNET\MRA\DC++\VNC\MYSQL\ORACLE -Sniffing chat messages of ICQ\AIM\JABBER\YAHOO\MSN\GADU-GADU\IRC\MRA - Changing MAC address of LAN adapters - Raw mode (with filtering rules) - Capturing packets and post-capture (offline) analyzing - Remote traffic capturing via RPCAP daemon -Reconstruction of SMTP\POP3 messagesAerosolWardriving utility for Windows.AirSnareAirSnare is an intrusion detection system to help you monitor your wireless network.AnalyzerAnalyzer is a fully configurable Network Analyzer for Win32. It includes several functionalities that are needed by network management operator. Analyzer is based on WinPcap and it is able to capture packets on most Win32 platforms (and link-layer technologies). Analyzer 3.0 comes out with some event logging, LAN monitoring and traffic monitoring capabilities. However,Analyzer 3.0 most valuable point is the ability to parse network packets according to the protocol description contained into some external files, which can be modified at run-time by the user.AnetTestAnetTest is a integrated packet generator and sniffer for Ethernet, but also works with blocks of data over TCP connection.Enables you to use scripts for automated testing, monitoring, imitating of various network objects, creating custom network tools.ArchaeopteryxArchaeopteryx is a Passive mode OS Identification Tool. It is based off Siphon v.666 by SubTerrain. It has a GUI and a highly configurable OS signature file.ARP0cARP0c is an ARP redirector and bridging engine. ARP requests from various sources in a switched environment get false ARP response which point to the host running ARP0c. Packets from these hosts are bridged to the realdestination address to allow normal network operation and keep TCP connections alive.Asn1BrowserThe Asn1Browser analyzer decodes ASN1 binary data and provides an advanced display for the user.assnifferassniffer can monitor a network, and for every HTTP transfer it sees, save a copy of the transferred data.AutoScan-Network AutoScan-Network is a network discovering and managing application.BillSniffBillSniff is a free (freeware) sniffer under MS Windows.CAS BACnet ExplorerAutomatically discover all the BACnet® IP, BACnet® Ethernet and BACnet® MSTP devices, objects, and their properties on your network. The objects and devices are arranged in an easy to use tree format with braches for each network, object, and device.Bit-TwistBit-Twist is a simple yet powerful WinPcap-based Ethernet packet generator. It is designed to compliment WinDump, which by itself has done a great job in capturing network traffic. With Bit-Twist, you can now regenerate the captured traffic onto a live network! Packets are generated from windump trace file (.pcap file). Bit-Twist also comes with a comprehensive trace file editor to allow you to change the contents of a trace file.BochsBochs is a highly portable open source IA-32 (x86) PC emulator written in C++, that runs on most popular platforms.It includes emulation of the Intel x86 CPU, common I/O devices, and a custom BIOS.Busted!Busted! records AOL instant message conversations, web sites visited, applications used, keystrokes and takes periodic screen shots.CableMonCable traffic monitoring tool.Cain & AbelCain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.CarnivorePECarnivore is a surveillance tool for data networks. At the heart of the project is CarnivorePE, a software application that listens to all Internet traffic (email, web surfing, etc.) on a specific local network. Next, CarnivorePE serves this data stream tointerfaces called "clients." These clients are designed to animate, diagnose, or interpret the network traffic in various ways.cdpr - Cisco Discovery Protocol Reportercdpr is used to decode a Cisco Disovery Protocol (CDP) packet, by default it will report the device ID, the IP Address (of the device), and the port number that the machine is connected to. Optionally it will decode the entire CDP packet.choozmailparental control software.CHScannerCHScanner allows you to scan in "style" from Windows XP SP2 and higher OS. It is IPv4 and IPv6 enabled, it has a skinnable interface and it has the ability to mimic various operating systems. Last but not least, it has many scanning methods.coLinuxCooperative Linux is the first working free and open source method for optimally running Linux on Microsoft Windowsnatively. More generally, Cooperative Linux (short-named coLinux) is a port of the Linux kernel that allows it to run cooperatively alongside another operating system on a single machine. For instance, it allows one to freely run Linux on Windows 2000/XP, without using a commercial PC virtualization software such as VMware, in a way which is much more optimal than using any generalpurpose PC virtualization software.CORE IMPACTAutomated, comprehensive penetration testing product for assessing specific information security threats to an organization.dasniffdaSniff is an open source customizable sniffer for win32 systems. It helps you to log your LAN traffic by specifyingpacket rules as filters.Deep Network Analyzer (DNA)DNA is an open, flexible and extensible deep network analyzer (software server) and architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks. DNA is designed to be used for Internet Security, Intrusion detection, Network Management, Protocol and Network Analysis, Information Gathering, Network Monitoring applications.dsniffdsniff is a collection of utilities to aid in sniffing network data.E.L.AE.L.A. identifies and counts the network traffic by any application. In addition the traffic is separated between local network(s) and Internet (external networks).EffeTech HTTP SnifferEffeTech HTTP Sniffer is a HTTP protocol network sniffer, packet analyzer and file rebuilder based on Windows platform. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol and to rebuild the HTTP communications and files sent through HTTP protocol.Engage Packet BuilderScriptable libnet-based packet builder for Windows platform.EthergrouikEthergrouik is a Windows open source project (C + GTK) whose main goal is to represent graphically connections by protocols on your network.EtherSnoopEtherSnoop is a basic network sniffer, that can capture all packets going through the network. It lists the captured data in real-time, using an easy-to-understand interface with a hex and text display of the packet content. EtherSnoop also offers basic filtering by protocol type and a tree-style packet explorer. The output can be saved to file and reloaded later if needed. ettercapEttercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis.FAP GuardFAP Guard allows DirecPC and DirecWay users to monitor their Fair Access Policy ( FAP ) download level, thus preventing them from getting throttled or disconnected. You might also find this application useful if you are paying for download, or have a download limit imposed by your ISP. It provides some interesting network traffic statistics as well.FanfareSVTThe Fanfare Group delivers one-click test automation™ for communication equipment manufacturers who need to reduce their time to market and improve product quality.FramePadFramePad is a Windows based packet sniffer and protocol analyzer, designed from the ground up with ease and functionality in mind. It allows you to examine data from a live network or from a capture file on disk.FTPXeroxFTPXerox grabs files that are transferred across the network using the FTP protocol. It implements a full end-to-end TCP re-assembly engine that watches for FTP transfers.Gamer's IPX Tunnel (GIT)GIT is a freeware utility to link LANs together over the internet for IPX-based network gameplay. It can also be used to bridge many configurations of IPX packets and frames from once point to another.GIPS IP Network SimulatorThe GIPS IP Network Simulator is a software tool that allows the user to emulate network behavior by delaying and/or dropping packets in an IP-network. Installed in a laptop it can be placed between two LAN’s, two gateways, or any two IP devices and simulate the network conditions experienced by the two end-points.Hammer Call AnalyzerThe Hammer Call Analyzer enables users to visualize signaling and voice quality problems in VoIP networks. For example, the unique call list and multistage call flow display features walk engineers through the legs of a particular call. In addition, the Hammer Call Analyzer displays waveforms and the Stream Quality Signature for any call. HiDownloadHiDownload is a multi-threaded download manager that allows you to download individual files (or lists of files) from web and FTP.HoneydHoneyd is a small daemon that creates virtual hosts on a network that enhances network security by providing "honeypot" decoys that enable network security officers to detect, monitor, and contain unauthorized network activities without the intruder knowing they are being tracked.hpinghping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.HTTP snoop A simple but functional HTTP sniffer application. It will display a few basic information about every "HTTP packet" that it sees on the NIC and decode all basics authentication header entries it finds (both for proxies and for web sites). It will also write everything in the HTTP request that is both in the same packet and before the firs null char.HttpTracerView web traffic between browser and any Internet server. HttpTracer is a windows program that runs as a proxy server on your desktop, catching and displaying all textual commands and data sent and recieved by a web browser. jNetPCAPjNetPCAP is a java library that is a wrapper around WinPcap. What makes this library unique is that it is a comprehensive and accurate wrapper around the libpcap library.JPcapA Java wrapper for WinPcap. It allows Java code to access to the WinPcap (and libpcap on UNIX) calls.IM SnifferIntercepts and decodes all instant message traffic received by the computer. A high performance engine delivers real time message decryption. Conversations can be viewed immediately or saved for later analysis. Freeware. iNetWatcheriNetWatcher© is based on Winpcap, may fully monitor the Internet activity of staff or students, record the E-mail transmitting through the Internet and Web Page; monitor the various real-time chatting messages and IM files sent; monitor the register table, hard disk, system information of the employee's computer; monitor FTP; monitor net flow of all staff. ipInterceptorTrace TCP/UDP Packets on your workstation. View packets in a logical sequence, with requests and responses grouped into conversations (showing the resulting response times). Set filters for tracing. View headers and data in text or HEX format. IpMaster/IpMasterProInternet/Network Ip address & data packet monitor.IP SnifferWindows 2000/XP packet sniffer with replay function. Monitor is a bandwidth analysis utility. Besides giving a graphical illustration of the bandwidth usage on your computer or the network it resides, you get a list of all incoming and outgoing connections. KolSnifferKolsniffer contains a component to write very small self-contained WinPcap applications with Delphi and the Key Object Library framework. The source code is a translation of the Tsniffer class that Umar Sears wrote earlier. The source code is freeware, with the permission of the original author. It was written by . The zip filecontains a demo with sources, that illustrates how to use the component. The Key Object Library framework itself is available fromLaBrea@HomeLaBrea@Home is a version of the original network administrator's tool "LaBrea" for home use. LaBrea is a way to combat both port scanners and worms such as Code Red and Nimda. The original network administrator's "LaBrea" creates phantom machines which hold scanners and worms in a sort of "tarpit", luring them in, and holding onto their communications with what they think are real machines.LeetGeek ICMP TunnelerAn ICMP tunneling program.LibnetLibnet is a high-level API (toolkit) allowing the application programmer to construct and inject network packets. It provides a portable and simplified interface for low-level network packet shaping, handling and injection.LibnidsLibnids is an implementation of an E-component of Network Intrusion Detection System. It emulates the IP stack of Linux 2.0.x. Libnids offers IP defragmentation, TCP stream assembly and TCP port scan detection.LineAge UtilsLineAge Utils is tool that allows editing of colored chat, and NPC/mob description in Lineage 2 game. It also has integrated sniffer which allows user to import game character inventory and warehouse into material calculator, which is also part of LineAge Utils.lwIPlwIP is a small independent implementation of the TCP/IP protocol suite. The focus of the lwIP TCP/IP implementation is to reduce the RAM usage while still having a full scale TCP.MSN Protocol AnalyzerMSNProtocol Analyzer(MSNPAnalyzer) is a network utility that can monitor (or capture, monitor) the sessions of MSN Protocol. If you use this program in conbination with SwitchSniffer program, you can capture and see all the MSNP sessions including conversations and MSN commandsMSN Webcam RecorderMSN Webcam Recorder is a tool that allows you to record video streamed to and from your computer by MSN Messenger's Webcam Feature.myNetMonmyNetMon is windows based network monitor and packet analyzing (sniffer).NemesisNemesis is a command-line network packet injection utility for UNIX-like and Windows systems. You might think of it as an EZ-bake packet oven or a manually controlled IP stack. With Nemesis, it is possible to generate and transmit packets from the command line or from within a shell script.Net::Pcap for Win32A Perl interface to the libpcap library. Net::PcapUtils is available on the same site.NETI@homeNETI@home is an open-source software package that collects network performance statistics from end-systems. It has been written for and tested on the Windows, Linux, and Solaris operating systems, with testing for other operating systems to be completed soon. NETI@home is designed to run on end-user machines and will collect various statistics about Internet performance. These statistics will then be sent to a server at the Georgia Institute of Technology (Georgia Tech), where they will be collected and made publicly available.NetCalibratorNetCalibrator offers statistical analysis of captured data in support of performance analysis. The approach being used provides ability to quantify performance issues for small as well as large (>500,000) number of packets. NetPredictorNetPredictor offers monitoring and prediction of application performance. It enables you to build, or to interactively discover, the path between an application user and the server.netwib, netwox and netwagNetwib provides sniff, spoof, client, server and most functions needed by network programs. Toolbox netwox helps to find and solve networks' problems. Netwag is a graphical network toolbox. Netwox and netwag contain over 150 tools.NetWitnessNetWitness gives an organization the ability to quickly understand and respond to network activity of interest, regardless of the device provisioning the data or the application producing the packets.NetworkMinerA passive network monitoring tool for Windows with an easy-to-use graphical interface. NetworkMiner can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off line analysis. The source code is available as open source.Network packet generatorNetwork Packet Generator (npg) is a free GNU GPL Windows packet injector (generator) that utilizes WinPcap to send specific packets out a single or multiple network interfaces. These packets and other extended options can be defined on the command line, in a packet file, or combination of the two.NeVODetermine vulnerabilities on your network through passive monitoring much like a sniffer. NeVO dynamically learns about your servers, services and vulnerabilities by performing signature and protocol analysis of the observed network sessions.NeWTEasy-to-use windows vulnerability scanner based on Nessus technology. NeWT installs on any Windows 2000 or Windows XP computer and can quickly scan several thousand hosts for vulnerabilities and produce detailed vulnerability reports. ngrepNgrep strives to provide most of GNU grep's common features, applying them to the network layerNmapNTNmap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques (determine what services the hosts are offering), and TCP/IP fingerprinting (remote host operating system identification). Nmap also offers flexible target and port specification, decoy scanning, determination of TCP sequence predictability characteristics, sunRPC scanning, reverse-identd scanning, and more.ntopntop is a tool that shows the network usage, similar to what the popular top Unix command does.Nuzzler IDSThe Securepoint Intrusion Detection System (Nuzzler) allows to analyse the network for intrusion detection. Nuzzler can detect possible attacks, viruses, trojans and other bad traffic.Oidview MIB BrowserMIB browser and snmp toolset for network fault management. Free download for network professionals.P2P WatchDogP2P WatchDog is a network sniffer which can monitor and block several Peer-to-Peer file transfer protocols, including FastTrack, Gnutella, DirectConnect, EarthStation5, eDonken, Filetopia, BitTorrent, MP2P, and Overnet.PacanalPacket capture and analyzer program. The source contains a C# reimplementation of the packet.dll WinPcap library. Packet ExcaliburA multi-platform graphical and scriptable network packet engine with extensible text based protocol descriptions.PacketVBIts an ActiveX for use with Visual Basic that wraps the function exported by the WinPcap API (packet.dll). PacketXPacketX is set of ActiveX classes that integrate winpcap packet capture functionality with Visual Basic or anyother programming environment supporting Microsoft ActiveX technology.PacketyzerPacketyzer is a Windows user interface for the Ethereal packet capture and dissection library.PcapyPcapy is a Python extension module that interfaces with WinPcap/libpcap. Pcapy enables python scripts to capture packets on the network. is a .net wrapper for WinPcap written in C++/CLI and C#. It Features almost all WinPcap features and includes a packet interpretation framework. It has different advantages over previously existing WinPcap wrappers and is still in development for new features and bug fixes and is written with pretty high standards of coding.PerformaSureSitraka PerformaSure allows J2EE development teams to identify sources of performance problems within an assembled application. PerformaSure coordinates the collection of performance metrics for any given transaction, following the path of execution from the initial HTTP request through load balancers, application servers, to the database and back again.PI IT MonitorPI IT Monitor collects real-time information regarding the performance of various elements that compose an IT infrastructure. But in addition to collecting real-time values, PI IT Monitor archives such data and makes them available for use in reporting, analysis, troubleshooting, and decision making.PingPlotterPingPlotter is a network troubleshooting and diagnostic tool. It uses a combination of traceroute, ping, and whois to collect data quickly, and then allows you to continue to collect data over time to give you the information you really need to identify problems (both short-term and long-term trends).PromiScanSoftware for remotely monitoring computers on local networks to locate network interfaces operating in a promiscuous mode.PortScannerA TCP port scanner.PSentry Internet Policy Guard & SurveillancePSentry sniffs network traffic at gateway point, captures and records user activites like web surf, emails, web submissions, instant messager sessions (AOL aim, MSN, ICQ, Yahoo, QQ, googletalk). It can log or block ftp, p2p file transfers. PSentry deloys different Internet policies by IP/MAC address or by user, to controls which resource or servce is permited or blocked on a LAN.Pseud IP MasqueradePseud IP Masquerade is a Windows application and NT/2000 Serivce, that has some basic functions of "IP Masquerade".pypcapsimplified object-oriented Python extension module for libpcap - the current version, the legacy version shipping with some of the BSD operating systems, and the WinPcap port for Windows.QtNetworkMonitorThe project is a KISS network monitor that works under both Windows and Linux. It shows how much bandwidth you are taking on a daily basis.rawstuffrawstuff is a toolkit for totally raw (MAC level and with no TCP/IP installed) send and receive on Windows. SatoriSatori is a passive OS Fingerprinting tool for Windows. Unlike most other passive tools it parses and tries to use the following protocols for OS Identification: CDP, DHCP, EIGRP, HPSP , HSRP, ICMP, IGMP, HTTP, MDNS, OSPF, SAP, SCCP, SMB, SNMP, STP, TCP, and UPNP with new protocols being added from time to time.Show TrafficShow Traffic monitors network traffic on the chosen network interface and displays it continuously. It could be used for locating suspicious network traffic or to evaluate current utilization of the network interface.SIMHSIMH is a highly portable, multi-system simulator.SniphereSniphere is an another network wiretapping program for Windows using winpcap. Nevertheless, Sniphere is a pretty handy program with a lot of possibilities which most of free sniffers do not have.SmartSniffSmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump.snoopSnoop is component library encapsulating WinPcap used in Delphi.SnoopAnalyzerSnoopAnalyzer Standard is a network protocol analyzer based on network data capturing technology under Microsoft Windows platforms(95/98/Me/2000/NT/XP).SnoopMSNBlockSnoopMSNBlock is a software to block MSN messenger service used in your company. SnoopNetCoopSnoopNetCop Standard is a program that can detect possible packet sniffing attack on your network. snortSnort is a lightweight network intrusion detection system, capable of performing real-time traffic analysis andpacket logging on IP networks.snotSnot is an arbitrary packet generator, that uses snort rules files as its source of packet information. It can be used asan IDS evasion tool, by using specific decoy hosts, or just something to keep your friendly IDS monitoring staff busy. SOAPscopeSOAPscope is a Web services diagnostic system that collects and analyzes information about SOAP and WSDL by monitoring communications among SOAP endpoints.ssldumpssldump is an SSLv3/TLS network protocol analyzer. It identifies TCP connections on the chosen network interface and attempts to interpret them as SSLv3/TLS traffic. When it identifies SSLv3/TLS traffic, it decodes the records and displays them in a textual form to stdout. If provided with the appropriate keying material, it will also decrypt the connections and display the application data traffic.STINGA NGN Monitor:Protocol analyser focusing on SS7oIP from Utel Systems. Protocols like ISUP (ITU, ANSI, UK), SCCP, TCAP, MAP, INAP, CAP/CAMEL, SMS, IS-41, Megaco/H.248, MGCP, SIP, SDP, RTP, SIP-T (ITU, ANSI, UK, DPNSS/DASS2), SCTP,M2PA, M2UA, M3UA, SUA, IAU, DUA, V5UA, TCP, UDP, IP and others are decoded in detaild by this product.STINGA SIP SimulatorProtocol simulator for SIP and SDP protocol testing.SuperAgentThis product from NetQoS analyzes application response times without the need to deploy client-side agents. TCPKillNTTCPKillNT is a TCP connection "Reset" utility for Microsoft Windows NT platforms. It has the ability to send RST packets to already established TCP connections. Quite deadly on a LAN. It is very useful for IDS kind of products which need to terminate a TCP session.tingting is an OSI layer 4 connectivity assurance tool. It supports UDP multicast, unicast and TCP/IP. It makes use of the packet capture library to perform passive multicast monitoring.TJesNetMonitorBorland C++ Builder wrapper for WinPcap. Comes with a sample application.TraceDetTraceDet is a Traceroute Detector for Windows NT. Basically, it detects and logs if somebody trace routes to your host. The idea is that when somebody traces to your host, you receive IP packets with TTL value equal to 1. So, TraceDet looks out for suchpackets.tracetcptracetcp is a command line traceroute utility for WIN32 that uses TCP SYN packets rather than ICMP/UDP packets that the usual implementations use, thus bypassing gateways that block traditional traceroute packets.TrafficStatisticMZL & Novatech TrafficStatistic shows the consumed traffic volume comfortably in system tray.TrafficWatcherA tool to measure network traffic by service (FTP, mail, news, web, UDP etc)TrafMeterTrafMeter is an utility for accounting and realtime monitoring of Internet traffic to and from a local network. It includes flexible filter engine, extensive logging facility and friendly user interface.uIPuIP is an implementation of the TCP/IP protocol stack intended for small 8-bit and 16-bit microcontrollers. It provides the necessary protocols for Internet communication, with a very small code footprint and RAM requirements - the uIP code size is on the order of a few kilobytes and RAM usage is on the order of a few hundred bytes.Unsniff Network AnalyzerUnsniff features brand new visualization of packet data, advanced reassembly capabilities, full stream monitoring and several other enhancements over the current crop of network analyzers. What really sets Unsniff apart is its Scripting capabilities. Unsniff allows you to write your own network analysis scripts using the Ruby scripting language.You can also write powerful protocol handlers and other types of plugins using XML and/or C++. Unsniff is even available in Japanese.Url SnooperUrl Snooper is a a program written to help users locate the urls of audio and video files so that they can be recorded. VB.PCAPVB.PCAP is an "Open Source and completely free" packet capture library for Visual Basic (tested on VB5 andVB6, not tested on ) based on Winpcap. The library exposes a set of APIs, that wrap aroud Winpcap using the _stdcall convention. The library is the foundstone for a network analyzer in VB.Viper ChatViperChat is a FREE LAN chat client compatible with Vypress Chat™ protocol version 1.93. It uses UDP communication over WinPcap.VLADescu VLADescu is a network content sniffer, it is currently able to recognize gif, jpeg and audio mpeg files. VLADescu listens to network traffic and picks out images and mp3s from sniffed TCP streams. It can be used on local LAN or on wireless network (if your driver supports promiscuous mode, or even better, monitor mode).WallCoolerWallCooler is a powerful and flexible VPN solution to access Home or Office computers & networks from anywhere. All Windows based applications are supported, no need to use special applications or synchronize files. Users can remote access organization's databases, e-mails, remote desktops, product catalogue... from anywhere. WallCooler sits on the local company network, uses an existing Internet connection and automatically manages incoming connections via relay servers.Warp PipeWarp Pipe is free software that runs on your PC or Mac and is available for Windows, Mac OSX, Linux, and BSD operating systems. While running on your PC or Mac, Warp Pipe allows you to play LAN-enabled Nintendo GameCube games over the Internet with other GameCube gamers.Watt-32Watt-32 is a library for making networked TCP/IP programs in the language of C and C++ under DOS and Windows-NT. WebSnurfWebsnurf is a small application that follows a user web-surfing; that is to say, as you run WebSnurf on your PC, you can pursue web-surfing movements made on another PC. Obviously, you have to be connected over the same LAN.Win32::NetPacketWin32::NetPacket is an Object-Oriented interface to the WinPcap packet.dll library.Windows ARP SpooferWindows ARP Spoofer (WinArpSpoof) is a program that can scan the computers including network devices and can spoof their ARP tables on local area network and can act as a router while pulling all packets on LAN.Windows ToolboxThe Windows Toolbox is a comprehensive collection of software and information for Windows - a toolbox of high quality applications and utilities for a wide array of functions, all freely re-distributable and under Free, Open Source, Freeware, Shareware or similar licences; documents on installing, configuring and maintaining Windows and various software applications, for stability, performance, usability and security.WindumpWinDump is the Windows version of the famous tcpdump Unix tool. It's developed and maintained by the WinPcap team. WinfingerprintWinfingerprint is a Win32 Host/Network Enumeration Scanner. Winfingerprint is capable of performing SMB, TCP, UDP, ICMP, RPC, and SNMP scans.WinPcapArpWinPcapArp is ARP client library that works on Windows OS(NT and 2000). The main purpose of this library is to get a MAC address of the target ethernet NIC with the IP address.WinPcapDhcpCDWinPcapDhcpCD is a DHCP client demon library that works on Windows OS (NT and 2000). The purpose of this library is to get more than one IP addresses in your application program.winpcapyPython port of Winpcap functions using ctypes. Work with Python 2.x and 3 under Linux / Windows. This is a low level implementation, no object or pythonic way, so you need ctypes knowledge to use it.WinSniffWinSniff is an application for capturing packets on the network. It displays all the packets that are transmitted on the local network and gives detailed information about each header in the packet.WinWhifWinWhif allows any PC running Windows (95, 98, NT or 2000) to record the DICOM traffic between two machines on the same network. It can be useful in diagnosing DICOM communications problems.Wireshark/EtherealWireshark (formerly known as Ethereal) is the world's most popular network analyzer. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.wpa_supplicantwpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11authentication/association of the wlan driver.WIRE1xWIRE1x is an open source implementation of IEEE 802.1x client (supplicant). It supports various EAP authentication methods.YATTYATT is a project to replace the current proliferation of trace tools ( tcpTrace, proxyTrace, pcapTrace ), with a single extensible tracing tool. YATT features a new GUI built with WTL, complete with a Hex View mode, and currently ships with 2 Trace providers, one based on WinPCAP and one based on the W2K Raw sockets support.YorkYork logs ip/fqdn addresses if all traffic. It can save sniffed http and ftp files. Also you can sniff for HTTP, FTP, POP3, SMTP, SMB, VNC and AIM password/hash. Further you can see the web browsing from other users, so your browser will show the same pages as the selected user. A screensaver is included, it shows the pictures which are sniffed in a slide show manner.。
第三章Winpcap研究
第三章 WinPcap研究3.1 WinPcap简介WinPcap是由意大利的Fulvio Risso 和 Loris Degioanni等人实现的应用于Win32平台数据包捕获与分析的一种驱动软件包，并提供了在Windows操作系统下的开发源代码，是一套高性能API封装库，有一套标准的抓包接口专门用于网络数据包的截获，并在其基础上增加了自定义数据包的发送能力以及针对Win32平台的扩展函数，独立于Windows操作系统的协议栈。
不同版本的Windows系统都有自己的内核模块和用户层模块，所以使用Windows SDK开发的嗅探程序在不同的Windows操作系统版本下需要重新进行编译。
WinPcap为Win32平台提供了一个公共的接口Packet.dll，使得程序可以运行在不同版本的Windows平台上，而无需重新编译。
WinPcap的主要功能在于独立于主机协议和TCP-IP协议发送和接收原始数据包，也就是说，WinPcap不能阻塞、过于或控制其他应用程序对数据报的收发，它只是绕过系统原有的协议栈监听网络上传送的数据包。
因此，它不能用于QoS 调度程序或个人防火墙。
WinPcap有以下几方面的功能：（1）捕获原始数据包，无论它是发往某台机器的，还是在其他设备（共享媒介）上进行交换的。
（2）在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉。
（3）将原始数据包通过网络发送出去。
（4）收集并统计网络流量信息。
3.1.1 WinPcap框架的各个组成部分Packets Network图3-1 WinPcap框架的组成部分如图3-1所示，WinPcap包括内核级的数据包监听驱动NPF、低级动态链接库（Pcaket.dll）和高级系统无关库（Wpcap.dll）。
在利用WinPcap抓包时，要绕过操作系统的协议栈来访问网络上传输的原始数据包，这就要求WinPcap的一部分要运行在操作系统核心层，直接与网络接口驱动交互，这就是NPF驱动要完成的任务，它是依赖于操作系统。
Winpcap编程
接口
3.1 WinPcap组成--Packet.dll
packet.dll（Packet Driver
API) 提供了一个底层的API访问接 口，可以直接访问网卡，为win32 平台提供了一个公共的接口。
3.1 WinPcap组成
NPF功能: 数据捕获 流量监测 数据发送 dump to disk
1.什么是WinPcap
2.WinPcap的结构
3.WinPcap编程环境配置
环境配置
VC6.0 环境下的配置
1. 到/devel.htm 下载安装 包 和 Developer's Pack. 2.安装驱动。 3.开发时，解压Developer's Pack,分别找到LIB 和 Include 目录。打开VC++，首先在 Tools=>Options=>Directories,分别配置 lib 和 Include 目录。当中Show Directories for 可以指定相应 的文件目录 4.VC++环境配置。 Project=>Settings=>Link=>Object/Library Modules 里面添加需要的LIB. (Packet.lib wpcap.lib ws2_32.lib)
在同一下拉框中找到“库文件”，然后对应到开发包的lib目录；
设置编译条件；在项目属性页中：
配置属性->C/C++->预处理器->预处理器定义，增加 ;WPCAP;HAVE_REMOTE;每 一个预定义符用";"隔开； 在项目属性页中：配置属性->链接器->命令行->附加选项对应的文本 框中增加：“wpcap.lib ws2_32.lib”；
winpcap
winpcapWinPcap: A Powerful Network Packet Capture and Analysis ToolIntroductionWinPcap is a powerful network packet capture and analysis tool that allows users to monitor and analyze network traffic on Windows-based systems. It provides a convenient and efficient means to capture packets from network interfaces and analyze them for various purposes, such as network troubleshooting, security auditing, and network protocol analysis. In this document, we will explore the features and functionality of WinPcap, how to install and configure it, and discuss some use cases where it can be particularly beneficial.Features and FunctionalityWinPcap offers a range of features and functionality that makes it an indispensable tool for network administrators and security professionals. Some notable features include:1. Packet Capture: WinPcap allows users to capture network packets from various network interfaces, including Ethernet,Wi-Fi, and Bluetooth. It supports both live capture and offline analysis of packet traces.2. Protocol Support: WinPcap supports a wide range of network protocols, including Ethernet, IPv4, IPv6, TCP, UDP, HTTP, DNS, and many more. This extensive protocol support enables detailed analysis of network traffic.3. Filtering: WinPcap includes a powerful filtering engine that allows users to capture only the packets of interest. It supports both BPF (Berkeley Packet Filter) syntax and Wireshark display filter syntax, providing flexible filtering capabilities.4. Remote Packet Capture: WinPcap supports remote packet capture, allowing users to capture packets from remote systems over the network. This feature is particularly useful for network administrators managing distributed networks.5. Statistics and Analysis: WinPcap provides detailed statistics and analysis of captured packets. It includes features such as packet count, bandwidth usage, capture duration, and protocol distribution. These statistics help in identifying network bottlenecks and anomalies.Installation and ConfigurationInstalling and configuring WinPcap is a straightforward process. The following steps provide a basic guide:1. Download: Visit the official WinPcap website and download the latest version of WinPcap suitable for your Windows operating system.2. Installation: Run the downloaded setup file and follow the on-screen instructions to complete the installation. WinPcap installs as a Windows service and starts automatically upon system boot.3. Configuration: After installation, configure the network interface(s) you wish to capture packets from. This can be done using third-party tools like Wireshark or WinPcap's own command-line utility, pcap-config.Use CasesWinPcap finds applications in various domains and use cases. Some common use cases include:1. Network Troubleshooting: WinPcap's packet capture and analysis capabilities make it an excellent tool for network troubleshooting. By capturing and analyzing network packets, administrators can identify and diagnose network issues, such as network congestion, packet loss, or faulty network devices.2. Security Auditing: WinPcap helps in auditing network security by capturing and analyzing network packets for potential security threats. It enables the detection of suspicious network activity, such as unauthorized network access or malware communication.3. Protocol Analysis: WinPcap facilitates in-depth analysis of network protocols by capturing and examining packets at the protocol level. It helps in understanding protocol behavior, identifying protocol violations, and diagnosing protocol-related issues.4. Network Performance Testing: WinPcap's statistics and analysis capabilities make it an excellent tool for network performance testing. By analyzing packet capture data, administrators can measure network bandwidth, latency, and throughput, helping in optimizing network performance.ConclusionWinPcap is a powerful network packet capture and analysis tool that offers extensive features and functionality for monitoring and analyzing network traffic on Windows-based systems. Its capabilities in packet capture, protocol support, filtering, remote packet capture, and statistics make it an invaluable tool for network troubleshooting, security auditing, protocol analysis, and network performance testing. By leveraging WinPcap, network administrators and security professionals can gain valuable insights into their network infrastructure and effectively manage and secure their networks.。
WinpCap的详解（一）
WinpCap的详解（一）首先来百科一下Winpcap是一个什么东东。
Winpcap(windows packet capture)是windows平台下一个免费，公共的网络访问系统。
它有如下几个功能：1、捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据；2、在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；3、在网络上发送原始的数据包；4、收集网络通信过程中的统计信息。
从上面的功能来看，这个库文件提供了许多的API函数，可以让我们捕获网络上的数据包以及统计网络通信的信息。
为了更直观的反应这个库文件的作用，我们来看看利用这个库文件写出来的一个应用软件，wireshark。
界面如下图所示，这个界面只是捕获数据的一个小界面，里面有很多的设置，有兴趣可以下载一个试试。
他能统计在一个局域网的所有网络信息。
这里面重要一点，需要提醒的是：winpcap的主要功能在于独立于主机协议（如TCP-IP)而发送和接收原始数据包。
也就是说，winpcap不能阻塞，过滤或控制其他应用程序数据包的发收，它仅仅只是监听共享网络上传送的数据包。
也就是说，WinpCap主要功能不能截取网络中的数据，他只能监听里面的数据。
对于WinpCap的结构以及原理，我们自然可以不用理会啦，我们只需要知道他的用途就行啦！一、安装WinpCap1、首先我们来看看如何安装WinpCap这个库，首先是下载WinpCap安装文件，这里有许多的版本，可以在官网上下载，，这里重点提醒一下，特别需要注意一下版本，如果你的版本是4.02，那么你的安装包也必须下载对应的版本，这里特别注意下，你可以下载当前比较稳定的版本。
下载之后安装就ok啦！这里我用的是WinpCap4.02.2、下载WinpCap Develop's Packs，这里我也提供相同的版本WpdPack4.02.3、解压后会得一个目录WpdPack四个子目录：docsExamples-pcapExamples-remoteIncludeLib然后配置VC++tools --> options --> Projects and Solutions --> VC++ Directories :Include files ：WpdPackPath\includeLibrary files：WpdPackPath\lib4、经过上面的步骤之后，你的WinpCap应该就安装成功啦，之后就是运行一下里面提供的例程啦，如果有什么问题，就对应的把问题在网上查一查，总体来说有以下几个问题：第一个就是需要在工程的链接库上添加wpcap.lib链接库；第二个就是你的SDK太老了，需要添加更新你的SDK，相应的到官方网站上下载适合你电脑的SDK。
Winpcap使用介绍
Winpcap使用介绍1. Winpcap简介Winpcap（windows packet capture）是在Win32平台上的强大的、有较好扩展性的底层网络分析体系结构，是Unix下的lipbcap移植到windows下的产物，是Win32环境下数据包捕获的开放代码函数库。
Winpcap是第一个Win32开放式的捕获包的体系结构，能够支持大多数应用程序的需要。
如图A-1所示，Winpcap包含了一个内核级的数据包过滤器——NPF (Netgroup Packet Filter)、一个底层动态链接库（Packet.dll）和一个高层的独立于系统的库（Wpcap.dll）。
这三个模块中，NPF属于内核级，其他两模块属于用户级。
图A-1 Winpcap的结构图NPF模块过滤数据包，将数据包不做任何改动的传递给用户，它还包含了一些操作系统专用代码（如：时间戳管理）。
Packet.dll模块提供了Win32平台下的捕获包的驱动接口。
实际上，不同版本的Windows 都提供了不同的内核模块和应用程序之间的接口函数，Packet.dll有一套独立于系统的API 来处理这些差异。
基于Packet.dll编写的程序可以不经过重新编译就在各种Win32平台下实现捕获数据包。
Packet.dll还包含了其他一些函数。
它可以进行一些底层的操作，Packet.dll 和NPF都依赖于操作系统，并且由于Windows95/98和WindowsNT/2000之间操作系统结构的不同而在不同版本的操作系统上有所不同。
Wpcap.dll库不依赖于操作系统，并且它包含了一些其它高层的函数，比如：过滤器生成器、用户定义的缓冲区和高层特性（数据统计和构造数据包）。
Winpcap提供的功能包括四个方面：1)捕获原始数据包，包括在共享网络上各主机发送/接收的以及相互之间交换的数据包；2)在数据包发往应用程序之前，按照自定义的规则将某些特殊的数据包过滤掉；3)在网络上发送原始的数据包；4)收集网络通信过程中的流量信息。
WinPcap简介
什么是WinPcapWinPcap是一个基于Win32平台的，用于捕获网络数据包并进行分析的开源库.大多数网络应用程序通过被广泛使用的操作系统元件来访问网络，比如sockets。
这是一种简单的实现方式，因为操作系统已经妥善处理了底层具体实现细节（比如协议处理，封装数据包等等），并且提供了一个与读写文件类似的，令人熟悉的接口。
然而，有些时候，这种“简单的方式”并不能满足任务的需求，因为有些应用程序需要直接访问网络中的数据包。
也就是说，那些应用程序需要访问原始数据包，即没有被操作系统利用网络协议处理过的数据包。
WinPcap产生的目的，就是为Win32应用程序提供这种访问方式；WinPcap提供了以下功能∙捕获原始数据包，无论它是发往某台机器的，还是在其他设备（共享媒介）上进行交换的∙在数据包发送给某应用程序前，根据用户指定的规则过滤数据包∙将原始数据包通过网络发送出去∙收集并统计网络流量信息以上这些功能需要借助安装在Win32内核中的网络设备驱动程序才能实现，再加上几个动态链接库DLL。
所有这些功能都能通过一个强大的编程接口来表现出来,易于开发，并能在不同的操作系统上使用。
这本手册的主要目标是在一些程序范例的帮助下，叙述这些编程接口的使用。
如果您现在就想开始摸索这些功能，您可以直接进入WinPcap用户手册.哪些程序在使用WinPcapWinPcap可以被用来制作许多类型的网络工具，比如具有分析，解决纷争，安全和监视功能的工具。
特别地，一些基于WinPcap的典型应用有：∙网络与协议分析器(network and protocol analyzers)∙网络监视器(network monitors)∙网络流量记录器(traffic loggers)∙网络流量发生器(traffic generators)∙用户级网桥及路由(user-level bridges and routers)∙网络入侵检测系统(network intrusion detection systems (NIDS))∙网络扫描器(network scanners)∙安全工具(security tools)什么是WinPcap做不到的WinPcap能独立地通过主机协议发送和接受数据，如同TCP-IP。
课程设计(论文)_基于WinPcap的网络数据包捕获与分析
基于WinPcap的网络数据包捕获与分析一、WinPcap介绍1.WinPcap简介WinPcap是一个在Windows操作系统下的免费、公开的用于直接访问网络的开发工具包（编程API）。
大多数Windows网络应用程序都是通过Winsock API（Windows套接口）这类高级编程接口访问网络的。
这种方法允许在网络上进行简单的数据传送，因为操作系统的TCP/IP协议栈实现软件会处理底层细节（协议操作、流程重组等等），并提供一个类似于读写文件的函数接口。
然而，有时候“简便方法”并不能满足实际需要。
有些程序希望绕过TCP/IP协议栈，直接处理底层网络中的通信数据，它们需要对网络进行底层进行直接访问，即在没有类似协议栈（TCP/IP协议栈）的实体介入条件下对网络进行原始访问。
基于Winsock API编程，应用程序是通过调用操作系统提供的编程接口访问TCP/IP协议栈实现网络通信的。
基于WinPcap编程，网络程序实际上是绕开操作系统的TCP/IP协议栈直接通过底层网络发送数据，因此，网络程序可以实现一些更低级、更灵活的功能。
2.WinPcap的组成与结构如图1.1，WinPcap由一个数据包监听设备驱动程序（NPF）、一个底层的动态连接库（）和一个高层的不依赖于操作系统的静态库（）共三个部分构成。
这里，NPF在操作系统的内核级，、在用户级。
1）数据包监听设备驱动程序Array技术实现上，为了实现抓包，系统必须绕过操作系统的协议栈来访问在网络上传输的原始数据包（rawpacket）。
这就要求WinPcap的一部分运行在操作系统核心内部，直接与网络接口驱动交互。
由于这个部分是系统依赖（system dependent）的，在Winpcap的解决方案中它被视为是一个设备驱动，称作NPF（Netgroup Packet Filter）。
图1.1 WinPcap的组成和结构2）底层的动态连接库（）和高层静态库（）为了方便编程，WinPcap必须提供一个编程接口（API），这就是WinPcap的底层的动态连接库（）和高层静态库（）。
WinPcap的体系架构
WinPcap 的体系架构深度剖析WinPcap 之(四)——WinPcap 的体系架构(1) 2009-08-31 20:02:37 标签：架构WinPcapWinPcap 是Win32 平台下用于数据包捕获与网络分析的一个架构。
它包含一个内核层数据包过滤器，一个底层动态链接库( packet.dll )，与一个高层并独立于系统的库 (wpcap.dll )1.1 WinPcap 的主要组成WinPcap 的各个主要组成部分如图2-1 所示。
图2-1 WinPcap 的主要组成首先，为了访问网络上传输的原始数据，一个捕获系统需要绕过操作系统的协议栈。
这需要一部分程序运行于操作系统的内核中，来与网络接口驱动直接交互。
该部分与操作系统密切相关，WinPcap 的解决方案是实现一个叫做Netgroup Packet Filter (NPF )的设备驱动程序，并对Windows 95 、Windows 98 、Windows ME 、Windows NT 4 、Windows 2000 与Windows XP 等不同操作系统提供不同版本的驱动程序。
这些驱动程序提供了数据包捕获与发送的基本特性，同时也提供诸如一个可编程的过滤系统与一个监控引擎之类的更高级特性。
第一个特性可用于限制一个捕获会话，只捕获特定的网络数据包（比如，可以只捕获一个特定主机生成的ftp 数据包）。
第二个特性提供了一个强大但简单的方式，来获取网络流量的统计信息（比如，可以获取网络负载或两个主机间所交换数据的数量）。
其次，捕获系统必须导出一个接口，使得用户层应用程序可使用内核驱动所提供的特性。
WinPcap 提供两个不同的库：packet.dll 与wpcap.dll 。
第一个库提供一个底层的API ，可用来直接访问驱动程序的函数，提供一个独立于微软的不同操作系统的编程接口。
第二个库导出了更强大的、更高层的捕获函数接口，并提供与UNIX 捕获库libpcap 的兼容性。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
Winpcap简介分类:网络技术译自WinPcap Developer's pack ，3.0 alpha。
ps：traffic generators这个名词怎样译？今天上不了国外网，暂时还查不到资料。
capture series 是今后陆续要写的系列，包括翻译文档，自己的开发经验，以及去年发现并已修改的Jpcap里的一个大bug（伪首部及检验和）。
------------------------------------------------------------------------------------- Winpcap是一个免费公开的软件系统。
它用于windows系统下的直接的网络编程。
大多数网络应用程序访问网络是通过广泛使用的套接字。
这种方法很容易实现网络数据传输，因为操作系统负责底层的细节（比如协议栈，数据流组装等）以及提供了类似于文件读写的函数接口。
但是有时，简单的方法是不够的。
因为一些应用程序需要一个底层环境去直接操纵网络通信。
因此需要一个不需要协议栈支持的原始的访问网络的方法。
winpcap适用于下面的开发者：1.捕获原始数据包。
不管这个包是发往本地机，还是其他机器之间的交换包。
2.在数据包被发送到应用程序之前，通过用户定义的规则过滤。
3.向网络发送原始数据包。
4.对网络通信量做出统计。
这些功能依赖于Win32系统内核中的设备驱动以及一些动态链接库。
Winpcap提供了一个强大的编程接口，它很容易地在各个操作系统之间进行移植，也很方便程序员进行开发。
什么样的程序需要使用Winpcap很多不同的工具软件使用Winpcap于网络分析，故障排除，网络安全监控等方面。
Winpcap特别适用于下面这几个经典领域：1。
网络及协议分析2。
网络监控3。
通信日志记录4。
traffic generators5。
用户级别的桥路和路由6。
网络入侵检测系统（NIDS）7。
网络扫描8。
安全工具Winpcap有些方面不能做。
它不依靠主机的诸如TCP/IP协议去收发数据包。
这意味着它不能阻塞，不能处理同一台主机中各程序之间的通信数据。
它只能“嗅探”到物理线路上的数据报。
因此它不适用于traffic shapers，QoS调度，以及个人防火墙。
Winpcap内部结构Winpcap是一个Win32平台下用于抓包和分析的系统。
包括一个内核级别的packet filter，一个底层的DLL(packet.dll)和一个高级的独立于系统的DLL（Wpcap.dll）1。
捕获系统要能得到网络上原始传输数据必须绕过协议栈。
这就需要一个模快运行于操作系统内核，与网络设备驱动接口直接打交道。
这一部分极端依赖系统，也被认为是一种设备驱动。
现有版本有Windows 85，98，ME，NT 4，2000，Xp。
这些驱动提供一些如数据包的捕获与发送这些基本功能，还提供一些高级的可编程的过滤系统和监控引擎。
过滤系统可以约束只捕获特定的数据包（比如，只捕获特定主机发送的FTP报文）。
监控引擎提供了一种强大但简单的使用机制去获得网络通信的统计荷载数据。
2。
捕获系统要让用户程序使用内核提供的功能必须要有一个编程接口。
Winpcap提供了两个不同的库：packet.dll 和wpcap.dll。
packet.dll提供一个底层的API，通过这个API可直接访问网络设备驱动，而独立于Microsoft OS.wpcap.dll是一个高层的强大捕获程序库，与Unix下的libpcap兼容。
它独立于下层的网络硬件和操作系统。
关于winpcap的一些认识2006-08-29 15:36关于winpcap的一些认识一．Winpcap简介Winpcap是UNIX下的libpcap移植到windows下的产物,他是一个freeandopensource的项目。
Winpcap工作于驱动(Driver)层，所以能以很高的效率进行网络操。
Winpcap提供了以下强大的功能：1．捕获原始的数据包2．设置filter,只捕获自己敢兴趣的数据包3．方便的把捕获的数据包输出到文件和从文件输入4．发送原始的数据包5．统计网络流量6．…..(其它还有很多，我不知道了)二．Winpcap的安装使用方法1．到http://winpcap.polito.it下载winpcap的安装包，程序员开发包。
2．执行安装包，这样你的机子就能运行winpcap程序了3．解压开发包，在VC的option的include和lib中加入winpcap的include 和lib4.在你的程序中加入#include<pcap.h>,#include<remote-ext.h>.然后在工程的setting中加入预定义宏:WPCAP,HAVE_REMOTE.导入wpcap.lib库5．就可以编写wpcap程序了三．Winpcap的一些基本的功能的实现一）捕获数据包1. 枚举所有的可用的设备[pcap_findalldevs_ex]（可选）2. 通过名字打开一个设备[pcap_open()]在这里可以打开一个文件，只是在打开这个文件之前需要通过pcap_createsrcstr创建相应的namestring3. 设置Filter[pcap_compile,pcap_setfilter](可选)4. 捕获数据有几种捕获数据的方法（捕获数据的数据都是最原始的数据包，即包含数据链路层的数据头）a．是以回调的方式[pcap_loop,pcap_dispatch()].这两种方法基本相同，底层收集数据包，当满足一定的条件（timeout或者缓冲区满），就会调用回调函数，把收集到的原始数据包s,交给用户。
他们返回的数据缓冲区包含多个包b. pcap_next_ex()的方式每当一个包到到达以后，pcap_next_ex就会返回，返回的数据缓冲区里只包涵一个包。
二）发送包Winpcap中有发送单个包和发送多个包的方法。
这里只说说发送单个包1．通过名字打开一个设备[pcap_open]2．自己构造一个原始数据包（这个数据包会不经过任何处理就发送出去，所以必须把包中的各个字段设置好。
另外这个数据包是包含数据链路层报头的）3．使用pcap_sendpacket()发送数据包三）统计网络流量1.通过名字打开一个设备[pcap_open]通过 read_timeout来设置统计的时间间隔2.设置filter[pcap_compile,pcap_setfilter](可选)3. 设置设备的为统计模式[pcap_setmode(MODE_STAT);]4. 开始统计，pcap_loop/pcap_dispatch()5．在回调函数中的参数中就包含了统计信息，四.总结这些东西都是我在学习winpcap的过程中的一些经验和总结。
由于我学习winpcap的时间很匆忙，只是按照stepbystepguide来学习的，所以我对于winpcap的理解也就只能局限与此，希望能在以后有机会深入学习//下面是一个应用winpcap写的一个网络流量统计的例子，//nettraffic.cppefinestheentrypointfortheconsoleapplication.#include"stdafx.h"#include<pcap.h>#include<remote-ext.h>#include<iostream>#include<winsock2.h>usingnamespacestd;voiddispatcher_handler(u_char*user_data,conststructpcap_pkthdr*pkthdr ,constu_char*pktdata);intmain(intargc,char*argv[]){int i;pcap_if_t* alldevs;pcap_if_t* dev;char errorbuf[PCAP_ERRBUF_SIZE];int choice;pcap_t* stathandle;WSADATA wsadata;structtimeval timestamp;if(WSAStartup(MAKEWORD(2,2),&wsadata)!=0){cerr<<"WSAStartupfailed["<<WSAGetLastError()<<"]"<<endl; return(-1);}if(pcap_findalldevs_ex(PCAP_SRC_IF_STRING,NULL,&alldevs,errorbu f)==-1){WSACleanup();cerr<<"pcap_findalldevs_exfailed!("<<errorbuf<<""<<endl; return(-1);}for(i=0,dev=alldevs;dev!=NULL;dev=dev->next){cout<<++i<<'\t'<<dev->name<<endl;}if(i==0){WSACleanup();cerr<<"nodevicefound!"<<endl;return(-2);}while(1){cout<<"pleasechoiceadevice:";cin>>choice;if(choice>=1&& choice<=i)break;cerr<<"inputerror,youshallchoiceadevicefromuponlist"<<en dl;}for(i=0,dev=alldevs;i<choice-1;i++,dev=dev->next);if((stathandle=pcap_open(dev->name,100,PCAP_OPENFLAG_ PROMISCUOUS,500,NULL,errorbuf) )==NULL){cerr<<"opendevicefailed![device:"<<dev->name<<"]"<<errorbuf<<endl;pcap_freealldevs(alldevs);WSACleanup();return(-3);}cout<<"isStat"<<dev->name<<"..."<<endl;pcap_freealldevs(alldevs);pcap_setmode(stathandle,MODE_STAT);_sec=0;_usec=0;pcap_loop(stathandle,0,dispatcher_handler,(unsignedchar*)× tamp);pcap_close(stathandle);return0;}voiddispatcher_handler(u_char*user_data,conststructpcap_pkthdr*pkthdr ,constu_char*pktdata){staticstructtimeval tstamp=*((structtimeval*)user_data); LARGE_INTEGER Bps,Pps;unsignedlong delay;char strtime[32];delay=(pkthdr->__sec)*_usec+ pkthdr->_usec;Pps.QuadPart=((*(LONGLONG*)(pktdata))*1000000)/delay;Bps.QuadPart=((*(LONGLONG*)(pktdata+8))*1000000)/delay;structtm*ltime=localtime(&(pkthdr->_sec));strftime(strtime,sizeof(strtime),"%H:%M:%S",ltime);printf("%s:",strtime);printf("\tPps=%I64u\tBps=%I64u\r\n",Pps.QuadPart,Bps.QuadPart); tstamp=pkthdr->ts;。