[Ligeti]

Hello and welcome

Today I will be talking about WinPcap library, and I will be talking C/C++ here (mainly C), I am on Windows 7 (64 bits), and using Microsoft Visual C++ 2010
source: Jalal Sela (Ligeti++)

So what is WinPcap:

"WinPcap is an open source library for packet capture and network analysis for the Win32 platforms."--from the official documentation

WinPcap is used in many non-commercial and yet very powerful software like WireShark and Nmap/Zenmap, WinPcap is the Windows version of libpcap (Unix).

"WinPcap, even with a small amount of imagination, it can open doors to infinite ideas and opportunities"--Jalal Sela

You can download WinPcap here: http://www.winpcap.org/devel.htm, make sure to download the Developer's Pack (the one I am using is version 4.1.2), make sure to read the documentation, there you can find a step by step tutorial.

How to import the library to your project:

As for Microsoft Visual C++ 2010:

1- Select "Project" in the menu then click on "Properties"


2- Go to "Configuration Properties" => "C/C++" => "General"


3- In "Additional Include Directories" you need to insert the path to the "Include" folder in WinPcap, for example "C:\WinPcap\Include"

4- Go to "Processor" => "Processor Definitions" and add:

• WPCAP
  
• HAVE_REMOTE
  

5- After that go to "Linker" => "Additional Library Directories" and insert the path to the "Lib" directory if you are on 32 bits (x86) machine, or "\Lib\x64" if you are on 64 bits (x64)


6- Go to "Input" => "Additional Dependencies" and add:

• ws2_32.lib
  
• wpcap.lib
  

7- finally, in your code, include "pcap.h"

Notes:

• About HAVE_REMOTE: the documentation says:
  

  "If your program uses the remote capture capabilities of WinPcap, add HAVE_REMOTE among the preprocessor definitions. Do not include remote-ext.h directly in your source files."

  
  I checked the source code, and to use any function with _x postfix (or suffix if you like) they are (I think all) defined under #ifndef HAVE_REMOTE in remote-ext.h but remote-ext.h has functions that are both remote and local, I didn't figure this part out yet (too lazy to send them a message now) but I will, and I will let you know the answer if you are interested.
  
  
• Another strange issue is this statement (from the official documentation):
  

  "Set the options of the linker to include the wpcap.lib library file specific for your target (x86 or x64). wpcap.lib for x86 can be found in the \lib folder of the WinPcap developer's pack, wpcap.lib for x64 can be found in the \lib\x64 folder."

  
  This didn't work on my machine (I am as I said running a 64 OS), again... I will check this with the WinPcap people and let you know, but for the moment you can compile your application as x86 (I tested it and no problem)
  
  
• ws2_32.lib is for Windows Sockets 2 (win32API), you don't really need to know much about this now, later I will post something about Windows Sockets 2 (WS2)...
  
  
• You can actually browse the path you need instead of typing it, for example to insert a additional library directories, you could do the following:
  
  
  1. Click on the little arrow to open the menu the click on <Edit...>
     
     
     
  2. A little box will pop up, click on the little icon with the folder, then click on the little button with "..." written on it
     
     
     
  3. A file dialog will open and from there you know what to do... I hope :-)
     

Now you are ready to write your application using WinPcap library.

Here is a quick example that you can test your configuration with:

Code:

#include <stdlib.h> #include <stdio.h> #include "pcap.h" int main() { pcap_if_t * NetworkInterface = 0; pcap_if_t * tmpNetworkInterface = 0; int i = 0; char errbuf[PCAP_ERRBUF_SIZE]; if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &NetworkInterface, errbuf) == -1) { fprintf(stderr,"Error: %s\n", errbuf); exit(1); } for(tmpNetworkInterface= NetworkInterface; tmpNetworkInterface != NULL; tmpNetworkInterface=tmpNetworkInterface->next) { printf("Name: %s\n", tmpNetworkInterface->name); if (tmpNetworkInterface->description) { printf("Description: %s\n", tmpNetworkInterface->description); } else printf("N/A\n"); } pcap_freealldevs(NetworkInterface); return 0; }

Thank you, please leave your comments.

Ligeti

[Note] This is a reference that I will be using later in more detailed tutorials about WinPcap
[Note] This is in fact the same mechanism used to load any dynamic library into visual studio (Win Sockets, WAV API... etc.)