cocowalla / snifter Goto Github PK
View Code? Open in Web Editor NEWSnifter is a raw socket IP packet capturing library/app for Windows, with a tiny CPU and memory footprint
License: Apache License 2.0
Snifter is a raw socket IP packet capturing library/app for Windows, with a tiny CPU and memory footprint
License: Apache License 2.0
As we know, IP, TCP and UDP protocols are transmitted in big-endian order. But BitConverter
Class is not always treat data as big-endian. Instead, they use machine endianness.
Quoted from MSDN:
Similarly, the order of bytes in the array and returned by the To_IntegerValue_ methods and the ToChar method depends on whether the computer architecture is little-endian or big-endian.
Although this is not matter in most scenarios where Snifter calls BitConverter
. This will lead to problems on a little-endian machine using -x
or -y
filters (port filters) as port filters uses C# built-in equality operators.
Please use a big-endian converter instead of BitConverter
in IPPacket.cs: L34-35
. Note that IPAddress
Class constructor assumes the Int64
value to be in network byte order, so that L29-30
should not be changed.
Hey Coco, thanks for writing and sharing this, it rocks! You saved me from writing it, or trying to use rawcap.exe which requires a very difficult to install .Net Framework 3.5 package.
https://www.netresec.com/?page=RawCap
Anyway, during use I noticed a small nit or two, and I wonder if you are taking PR's?
To monitor both sides of a port 8096 conversation, I had to use: snifter -i 3 -x -24545 -y -24545
Cameron
Pretty gratuitous enhancement, but it would be interesting to look at using Spectre.Console to turn Snifter.App into a TUI that shows more information.
$ ./Snifter.App.exe --interface=8 --filename=foo.txt
Unhandled Exception: System.IO.IOException: The handle is invalid.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)
at Snifter.App.Program.Main(String[] args)
Hi
Is it possible to monitor remote interfaces?
Split out the functionality into a library, so we'd have 2 projects: the library, and command line tool.
Library to go in NuGet.
Idea is that others could use the library for their own use cases.
Would it be at all possible to add a time to stop sniffing and packet count to stop sniffing option to this?
(Pretty much just the features from RawCap that I find pretty useful, especially when running the tool on a remote computer).
F:\Tools>RawCap.exe --help
NETRESEC RawCap version 0.1.5.0
http://www.netresec.com
Usage: RawCap.exe [OPTIONS] <interface_nr> <target_pcap_file>
OPTIONS:
-f Automatically flush data to file after each packet (no buffer)
-c <count> Stop sniffing after receiving <count> packets
-s <sec> Stop sniffing after <sec> seconds
https://www.netresec.com/?page=RawCap
Many thanks, love this tool!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.