Hi
Mit folgendem Source lässt sich sehr einfach die Packets die an das Netzwerkinterface gesendet werden capturen.
Function ConnectSock(ByVal Host$, ByVal Port&, ByVal HWndToMsg&, ByVal Async%) _
As Long
Dim s&, SelectOps&, Dummy&
Dim RCVTIMEO As Long
Dim sockin As sockaddr
Dim ret As Long
'sockin = saZero 'Dummy
sockin.sin_family = AF_INET
sockin.sin_port = htons(Port) ' Diese Funktion konvertiert eine
' Integer-Zahl in einen Netzwerk Byte-Reihenfolge.
If sockin.sin_port = INVALID_SOCKET Then
ConnectSock = INVALID_SOCKET
MsgBox "INVALID_SOCKET"
Exit Function
End If
sockin.sin_addr = GetHostByNameAlias(Host$)
If sockin.sin_addr = INADDR_NONE Then
ConnectSock = INVALID_SOCKET
MsgBox "INVALID_SOCKET"
Exit Function
End If
s = socket(AF_INET, SOCK_RAW, IPPROTO_IP) 'erstellt ein Winsock-Socket
' Erwartet eine der "af" konstanten die beschreiben welcher art der
' Adresstyp des Protokolls ist.
' Erwartet eine der "prototype"-Konstanten die beschreiben welcher Typ des
' Protokolls benutzt werden soll.
' Erwartet das Protokoll der Verbindung, für das Internet kann hier der
' wert "0" übergegeben werden.
If s < 0 Then
ConnectSock = INVALID_SOCKET
MsgBox "INVALID_SOCKET"
Exit Function
End If
RCVTIMEO = 5000
ret = setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (RCVTIMEO), 4) 'The setsockopt
' function sets a socket option.
'Level at which the option is defined. Example: SOL_SOCKET.
'SO_RCVTIMEO int Receives time-out in milliseconds (available in the
' Microsoft implementation of Windows Sockets 2).
'When using the recv function, if no data arrives during the period specified
' in SO_RCVTIMEO, the recv function completes. In
'Windows versions prior to Windows 2000, any data received subsequently fails
' with WSAETIMEDOUT. In Windows 2000 and later,
'if no data arrives within the period specified in SO_RCVTIMEO the recv
' function returns WSAETIMEDOUT, and if data is received, recv returns SUCCESS.
If ret <> 0 Then
MsgBox "setsockopt failed"
If s > 0 Then Dummy = closesocket(s)
Exit Function
End If
'we could check if setsockopt did ok...
'Dim v As Long
'ret = getsockopt(s, SOL_SOCKET, &H1006, v, 4)
'Debug.Print v
ret = bind(s, sockin, Len(sockin)) ' The bind function associates a local
' address with a socket.
If ret <> 0 Then
If s > 0 Then Dummy = closesocket(s)
MsgBox "bind failed"
Exit Function
End If
Dim lngInBuffer As Long
Dim lngBytesReturned As Long
Dim lngOutBuffer As Long
lngInBuffer = 1
ret = WSAIoctl(s, SIO_RCVALL, lngInBuffer, Len(lngInBuffer), lngOutBuffer, Len( _
lngOutBuffer), lngBytesReturned, ByVal 0, ByVal 0) ' The WSAIoctl function
' controls the mode of a socket.
'Enables a socket to receive all IP packets on the network. The socket handle
' passed to the WSAIoctl function must be of AF_INET address family,
'SOCK_RAW socket type, and IPPROTO_IP protocol. The socket also must be bound
' to an explicit local interface, which means that you cannot bind toINADDR_ANY.
'Once the socket is bound and the ioctl set, calls to the WSARecv or recv
' functions return IP datagrams passing through the given interface. Note that
' you
'must supply a sufficiently large buffer. Setting this ioctl requires
' Administrator privilege on the local computer. SIO_RCVALL is available in
' Windows 2000 and later versions of Windows.
If ret <> 0 Then
If s > 0 Then Dummy = closesocket(s)
MsgBox "WSAIoctl failed"
Exit Function
End If
SelectOps = FD_READ 'Or FD_WRITE Or FD_CONNECT Or FD_CLOSE
ret = WSAAsyncSelect(s, HWndToMsg, WINSOCKMSG, ByVal SelectOps) ' The
' WSAAsyncSelect function requests Windows message-based notification of
' network events for a socket.
If ret <> 0 Then
If s > 0 Then Dummy = closesocket(s)
ConnectSock = INVALID_SOCKET
MsgBox "INVALID_SOCKET"
Exit Function
End If
ConnectSock = s
End Function Das Rawsocket wird so initalsiert ,dass wenn ein Packet eintrifft, dieses über eine Windowsmsg an das Fenster gesendet wird.
Soweit so gut. TCP sowie ICMP Packets lassen sich wunderbar capturen, doch UDP Packets nur, wenn ein Dienst dieses Packet empfängt. Ansonst werden die Packets vom Rawsocket nicht empfangen! Weshalb?
Source: http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=42170&lngWId=1
LG Joe |