Anyone feel like testing my simple packet sniffer?

[Revtim]

Version that prompts user to choose interface:
http://users.adelphia.net/~tlaplaca/sps17.exe

Wow, what a pain in the butt. It took me almost as long to get the new prompt dialog working as it took to make the entire first version that worked perfectly on my PC.

[caphis]

@Revtim

Version that prompts user to choose interface:
http://users.adelphia.net/~tlaplaca/sps17.exe

Wow, what a pain in the butt. It took me almost as long to get the new prompt dialog working as it took to make the entire first version that worked perfectly on my PC.

Good job. Interesting results.

The first time I loaded it, I selected my active connection and hit Start. One line jumped into the listbox, then the program stalled again as in the past, but crashed.

The second time, I loaded it, selected my connection, hit Start, and the listbox filled up with what looked like packets, but then the program closed itself.

Tried a third time, same as second time.

I’m not sure what happened on the first try, but in subsequent results, the packets appeared to be filling up, but then the program just died.

[caphis]

Tried again, got same results as the first try. This line appeared in the listbox:

1080850610:108802 (1434)

And it crashed with “TODO: <File description>” as the titlebar of the crash.

Ran it once more, it started filling up with packets again, and I managed to screen cap it right before it crashed (it crashes within 1-2 seconds). Screen cap is here.

[Revtim]

Likely, the problem is that it cannot handle those humongous packets you are getting. For some reason, your packets are WAY bigger than mine (now I have packey envy…)

A buddy who tried this version out for me told me it crashes when he makes a SQL request over the network, which would likely also result in very large packets.

And indeed I think I found the problem, please try #18

http://users.adelphia.net/~tlaplaca/sps18.exe

And as always, thank you for trying this for me.

[caphis]

@Revtim

Likely, the problem is that it cannot handle those humongous packets you are getting. For some reason, your packets are WAY bigger than mine (now I have packey envy…)

A buddy who tried this version out for me told me it crashes when he makes a SQL request over the network, which would likely also result in very large packets.

And indeed I think I found the problem, please try #18

http://users.adelphia.net/~tlaplaca/sps18.exe

And as always, thank you for trying this for me.

New error: 404 Not found

[Revtim]

Heh, for a second there I thought “How the @*$& could my prog make a 404 error?”

Link should work now (I had misnamed it on the web space).

[Bambi_Hassenpfeffer]

Works a treat now, Revtim. I’ve been running it for about 10 minutes while I browse, and it’s displaying the packets just fine. Good work!

[Revtim]

@Bambi Hassenpfeffer

Works a treat now, Revtim. I’ve been running it for about 10 minutes while I browse, and it’s displaying the packets just fine. Good work!

Thank you so much for taking the time to try it.

[caphis]

@Revtim

Thank you so much for taking the time to try it.

Hmm… well, now I’m using a wireless connection (laptop), and I selected it. No packets were displayed, but no lockup either. Tried the other two, also, but no packets. :-/

I’ll try it on a regular, wired ethernet card shortly.

[Revtim]

@caphis

Hmm… well, now I’m using a wireless connection (laptop), and I selected it. No packets were displayed, but no lockup either. Tried the other two, also, but no packets. :-/

I’ll try it on a regular, wired ethernet card shortly.

I’m really sorry if this is a dumb question, but did you force some network activity? Is it possible there simply wasn’t any packets?

[caphis]

@Revtim

I’m really sorry if this is a dumb question, but did you force some network activity? Is it possible there simply wasn’t any packets?

heh, yeah, forced network activity

[Revtim]

@caphis

heh, yeah, forced network activity

I’m kinda stumped how to debug this wireless problem; in the meantime, have you tried it on the machine where it was crashing with the large packets? I strongly suspect it isn’t going to crash anymore, my buddy with the SQL reports it fixed in at least his situation.

[caphis]

@Revtim

I’m kinda stumped how to debug this wireless problem; in the meantime, have you tried it on the machine where it was crashing with the large packets? I strongly suspect it isn’t going to crash anymore, my buddy with the SQL reports it fixed in at least his situation.

I apologize… not yet, but I will tonight.

[Revtim]

No hurry man, thanks.

[Revtim]

OK, looks like WinPcap can’t detect every network device out there. From its FAQ at http://winpcap.polito.it/misc/faq.htm

Q-16: Which network adapters are supported?

A: The NPF device driver was developed to work primarily with Ethernet adapters. Support for other MACs was added during the development, but Ethernet remains the most tested one. The main reason is that all our development stations have Ethernet adapters. However, the current situation is:

* Windows 95/98/ME: the packet driver works correctly on Ethernet networks. It works also on PPP WAN links, but with some limitations (for example it is not able to capture the LCP and NCP packets). FDDI, ARCNET, ATM and Token Ring should be supported, however we did not test them because we do not have the hardware, so do not expect them to work perfectly.
* Windows NT4/2000: the packet driver works correctly on Ethernet networks. We were not able to make it work on PPP WAN links, because of binding problems on the NDISWAN adapter. As in Win9x,  FDDI, ARCNET, ATM and Token Ring should be supported, but are not granted to work perfectly.
* **Wireless adapters are not granted to work: some of them are not detected, other don't support promiscuous mode. In the best case, WinPcap is able to see an Ethernet emulation and not the real transiting packets**. The AirSnare website contains a page (http://home.comcast.net/~jay.deboer/airsnare/supported.htm) with a list of wireless adapters, specifying for each of them the ability to work with WinPcap.
* VPN: some implementations are not detected because of their unclean NDIS intermediate driver structure.

(Bolding mine)

So, it looks like the wireless problem is likely with WinpCap library.

[Revtim]

Made a new one, with just some minor UI changes.
http://users.adelphia.net/~tlaplaca/sps20.exe

1. Pops an error window if the user tries to enter invalid/non-existant interface number
2. Added “End Program” button to interface-choosing dialog
3. Fixed bug where user could close the interface-choosing dialog and result with invalid ‘0’ interface “chosen”.

[Revtim]

@caphis

I apologize… not yet, but I will tonight.

Had a chance yet?

[fruitbat]

Ok I am now dying of curiousity. I am a Liberal Arts guy. I view computers as alien life forms with whom I have an uneasy symbiotic relationship. Please to explain what a ‘packet sniffer’ is and what it does. I opened this thread expecting it was a coy sexual reference. It now seems certain that I will have no satisfaction on that count. I figure I should get something out of this thread.

[Revtim]

fruitbat, it’s a program that displays the raw data that passes through one’s network card.

It’s useful for diagnosing computer network problems (although ones that translate the data some are a lot more useful than my program.)

[caphis]

eep- sorry, thought I had posted. Tried it on my other machine without wireless-- worked like a charm!