0

I have defined structures for ip packet headers (tcp, udp and icmp) and listening on a raw socket using.

socket(AF_INET, SOCK_RAW, IPPROTO_IP)

In a loop i cast every packet into the ip header struct and extract tcp, udp or icmp using the predefined structs and the protocol id of the ip packet struct. I know about libcap and wincap, i just want to do it "on my own" :P Is it correct that i cant capture ethernet frames (like arp) using winsock, right? Is there any way to get the frame data without any library except winsock? Maybe creating some kind of AF_PACKET socket?

Someone commented on Raw Ethernet Frames Using Winsock that "Nothing below layer 3 is allowed in windows"

Thanks in advance

2
  • I suspect libpcap installs a network filter driver. Isn't that the key to making raw packet capture work?
    – selbie
    Dec 7, 2019 at 5:35
  • nmap.org/npcap installs an NDIS driver. You could write your own, but there are driver signing issues that might slow you down.
    – user3657941
    Dec 7, 2019 at 5:39

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.