I have one question about IP packet trace: is it possible to watch an IP-packet trace in my Windows 7 system? I recieve IP-packets and I want to know - where do this data move: which DLLs do they use, which functions do they call and etc.
Thanks.
Well the most likely solution would be a packetsniffer tool of some kind.
Simply a packet sniffer captures all of the packets of data that pass through a network. Typically, the packet sniffer would only capture packets that were intended for the machine in question. However, if placed different modes, the packet sniffer is also capable of capturing ALL packets travelling over the network regardless of destination.
Hope this helps
Dan
http://www.visualiptrace.com
Related
The old question is here. But I still cannot find useful solutions in the question so that I rewrite this question here.
How can i filter (allow, deny etc) outgoing packets in Windows? I want to filter IP packets through particular bits eg. the BPF rule IP[2:2] > 189. And then transmitted these filtered packages to other programs to resolve the packets. But I read the information on Windows Filtering Platform, it allow developers to write a middleware which I think it is hard for me to do.
So is there a relative way to filter packets in Windows xp or 2003 and then transmitted the packets to other applications?
In want to modify the TCP/IP portion of the Linux kernel where i can to intercept every packet going out to each interface. I need to intercept them and modify the IPv6 destination Options header. I am not sure how to start with this. Any pointers would be greatly appreciated.
Regards,
N
You can modify packets using a Python library called scapy. It is not necessary to modify kernel code in order to do so. However, keep in mind that you must set up a Man-in-the-middle in order to sniff a communication.
http://www.secdev.org/projects/scapy/
I discovered almost accidentally that my machine was sending and receiving UDP packets to a machine in Poland. Not that I have any problem with Poland, I just don't know why my laptop has the need to communicate with a server there. Reverse DNS shows just the ISP providing the address to some end user. Using Wireshark, I can monitor the messages, which were indecipherable as they were probably encrypted. All packets sent from my machine had the same source port, so clearly the application that sent them opened this UDP socket to use it. I am searching for ways to:
1) enumerate all current sockets open in the system, including the process that created it and, for both TCP and UDP, what ports and addresses they are current bound to.
2) because applications can open these sockets, use them, and close them right away, I would love to find (or perhaps even write) a program that once started would somehow get notification each time a socket gets created, or really more importantly when bound to a source and/or destination address and port. For UDP, I would love to also be able to monitor/keep track of the destination IP addresses and ports that socket has sent messages to.
I don't want to monitor the traffic itself, I have Wireshark if I want to view the traffic. I want to be able to then cross reference to discover what application is generating the packets. I want to know if it is from a process I trust, or if it is something I need to investigate further.
Does anybody know of any applications (for the Windows platform) that can do this? If not, any ideas about a .NET or Windows API that provides this capability, should I want to write it myself?
Edit:
After further research - looks like the APIs to use are GetExtendedUdpTable and GetExtendedTcpTable, CodeProject.com has some samples wrapping these in .NET (see http://www.codeproject.com/Articles/14423/Getting-the-active-TCP-UDP-connections-using-the-G). So a combination of this API and some sniffer code would be needed to monitor and keep track of what hosts at what ports using what protocol any particular application on your machine is talking to. If I ever get some free time, I'll consider creating this, if you know of an app that does all this, please let me know.
Try SysInternals TCPView. Despite its name, it handles UDP as well.
netstat -b to enumerate all ports along with the process names.
You can try using SysInternals' Process MOnitor (ProcMon.exe or ProcMon64.exe).
It allows for filtering of Processes by "UDP Send" Operation - and provides detailed UDP Connection data, including source and destination addresses(IP) and ports etc.
I am looking for UDP debugger tool, for the following requirement
1) netstat -s, shows udpInOverflows=23000 and this counter is increasing continuously.
how can I check udp packets which are thrown because of no buffer space.
2) what are the possible reason for this problem to occur and how to solve it.
3) is there any way to check incoming UDP packet which are received by kernel after all verification like udp socket is open for that port and no check sum error, snoop will not work because it capture direct from network interface.
Regards
Nitin
If you are willing to spend a little time with kernel source you should be able to use dtrace to get at the information you want. For example "dtrace -n 'fbt::udp_input:entry{stack();}' will show you how packets are getting into udp_input (not all that interesting). You should also check the mib::: probes and fbt:ip:ip_drop*:. This is all dependent on the version of Solaris you are using of course.
I am trying to find the most used Network card on windows 200 or XP. I planned to obtain the number of packets sent trough each NIC to determine the main NIC.
I thought IP Helper might give me this information but also it looks like the functions in IP helper only give stats for all interfaces. I know this can be done. Any ideas?
Many Thanks...
Have you looked at WMI ? Here's an example of interrogating the set of network adaptors. Note that it includes stats such as the number of forwarded packets for each adaptor.
You could use from any number of available packet sniffer programs out there: Top Packet Sniffers
Also look here: wiki