C＃ - 如何在不依赖于WinPcap的嗅探在一个应用程序包？ [英] c# - how to sniff packets in an app without relying on WinPCap?

问题描述

背景：我现在明白了如何编写C＃应用程序，它可以监视数据包进入/出网卡的应用程序运行在PC机上。我知道这种方法依赖于 http://www.winpcap.org/ 被已经在PC上安装然而，然后我用一个C＃的包装，如 HTTP：//pcapdotnet.$c$cplex.com/ 或的http://sourceforge.net/projects/sharppcap/ 。

BACKGROUND: I now understand how to write a C# application that can monitor packets going in/out of the network card on the PC the application is running on. The approach I know relies on http://www.winpcap.org/ being already installed on the PC however, and then I use a C# wrapper such as http://pcapdotnet.codeplex.com/ or http://sourceforge.net/projects/sharppcap/ .

问：但是我的问题，那么我需要做的，能有一个C＃应用程序，它可以嗅探数据包不需要第三方应用程序/驱动程序为pre -installed？

QUESTION: My question however, what would I need to do to be able to have a C# application that can sniff packets that does NOT require a 3rd party application/drivers to be pre-installed?

澄清：这是我真正想要的应用程序，我现在有，但没有任何要求，我来告诉用户必须去下载/能够使用该应用程序之前安装XYZ。对于这个问题的目的，假设自动下载和安装第三方应用程序/驱动程序不允许任何。 （用Winpcap的我不知道，如果你可以捆绑它，但是我相信你不会在任何情况下，应该不幸）

CLARIFICATION: That is I really want the application I currently have but without any requirement for me to tell the user to have to go and download/install XYZ prior to being able to use the application. For the purpose of the question assume that automating the download and install of a 3rd party application/drivers is not allowed either. (with WinPCap I'm not sure if you can bundle it, however I believe you're not supposed to in any case unfortunately)

感谢

推荐答案

我个人坚持Winpcap的。但既然你问，就可以嗅出使用以下code，使原始套接字从网络上的数据包。

Personally I would stick to WinPCap. But since you asked, it is possible to sniff packets from the network using for the following code to enable raw sockets.

Socket s = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
s.Bind(new IPEndPoint(IPAddress.Parse("<IP Address Here of NIC to sniff>"), 0));
s.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, 1);
byte[] inBytes = new byte[] { 1, 0, 0, 0 };
byte[] outBytes = new byte[] { 0, 0, 0, 0 };
s.IOControl(IOControlCode.ReceiveAll, inBytes, outBytes);

一旦做到这一点，你可以使用 Socket.Receive 或 Socket.BeginReceive 读取原始IP数据包

Once this is done, you can use Socket.Receive or Socket.BeginReceive to read the raw IP packets.

这篇关于C＃ - 如何在不依赖于WinPcap的嗅探在一个应用程序包？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！