Here is one last and small warning/readme, before I post the src, for those wanting to play with raw sockets…I’ve noticed some weird behavior myself when testing the sniffer on Win7. If anyone knows how to correct the problem WITHOUT writing the fake Ethernet header, by just configuring wireshark correctly DO share. Well it worked like a charm, Wireshark correctly interpreted the packets and dissected the rest of the contents just as I was used to with normal captures.

As previously stated this was the final choice.

Add a fake Ethernet header to each packet.

Tried this for a while, then decided to go for the second option just for fun.

Understand / Configure wireshark to start directly with the IP interpretation.

So I came up with two possible solutions: When trying to open the file with Wireshark, it tries to interpret the first bytes as a Ethernet header which fails horribly.

I did not realize this until I had written the packets into a PCAP file. This means that the Ethernet header is lost and you directly receive the IP header. Now here comes the fun part, when sniffing the packets you get everything above the Physical Layer. That’s when it becomes interesting to save packets in the PCAP format, so I decided to write my own quick & dirty implementation. Usually when sniffing with raw sockets you are looking for something specific in the stream of data and can just output it to a good old plain text file…however sometimes you’d just like to capture everything that comes through the network interface.

Lucky for us you can also sniff traffic by using raw sockets(I’m assuming win32, for the rest of the blog entry). Now that doesn’t really do the job in all circumstances, since sometimes you don’t want to install an additional library. When writing sniffers you can use libpcap or it’s win32 version winpcap.

So this is one of those things that you don’t stumble upon until you are playing with it.

Wireshark portable xp