pcap-sharp RC1

by Chris on Mar.23, 2007, under C#, Linux

I have released pcap-sharp RC1. If you’re interested, give it a shot and let me know how it works for you.

10 Comments for this entry

Mark
December 4th, 2007 on 10:27 am
Hey There Chris,

Thanks for pcap-sharp – it seems to be exactly what I need. I am having some trouble using it though. I am working on Mono in Linux and I can compile a project with it but when I try to run the resulting binary, I always get an error like this:

System.DllNotFoundException: libpcap.so
at (wrapper managed-to-native) PcapSharp.PcapCall:pcap_findalldevs (intptr&,System.Text.StringBuilder)
at PcapSharp.Pcap.FindAllDevices () [0x00000]
[..snip..]

Can you suggest why this might be happening or how I can fix it?

Thanks,

Mark.
Chris
December 4th, 2007 on 1:39 pm
This means either the pcap or pcap-dev packages aren’t installed for your particular platform. pcap-dev often provides a symlink from libpcap.so to some particular version of libpcap, like libpcap.so.0.9.8 on my box. You can solve this any number of ways:

* Symlink libpcap.so to a versioned libpcap library.
* Do the same, but put the symlink in your application directory.
* Create a pcap-sharp.dll.config file. See http://www.mono-project.com/DllMap for information on doing this.
Mark
December 4th, 2007 on 5:11 pm
Ah! That worked a treat, thanks Chris. Does this mean that pcap-dev will be necessary for end-users to run the app?
Chris
December 4th, 2007 on 5:41 pm
Either require the -dev package or use a config dllmap to remap it to some specific version number. ABI-compatible libraries are supposed to have compatible old versions symlinked to a newer one, so you might dllmap it to libpcap.so.0.8 since that is the version I developed against. If a breaking change comes out then that symlink should not point to the ABI-incompatible library, and in fact should not exist, so your application will fail (as it should).
Mark
December 4th, 2007 on 5:47 pm
Ok thanks for the help. And thanks for distributing the lib.

Last question I promise

IList devices = Pcap.FindAllDevices();
foreach (InterfaceDefinition dev in devices)
{
MessageBox.Show(dev.Name);
}

I’m using the above code to list available interfaces but how can I lookup the ip address for each interface?
Chris
December 4th, 2007 on 10:40 pm
Currently you cannot. There are libpcap functions to do this but they use system structures like sockaddr_t to represent IP addresses, and I don’t want to get that platform-specific. I could use a glue library to do the dirty work but I wanted something simple and 100% managed, so I didn’t go that route.
Austin
February 2nd, 2008 on 3:07 pm
I am curious… I am looking to write a small sniffer app (.net) and I need some library help with the network layer… I am seeing your project here and I wonder if you might help me understand how libpcap differs from winpcap and how your product is different than another I have seen sharp-pcap.

I dont need a lot of power all I am doing is needing to 1. listen for arp packets on teh segment I am on… and 2 send out an arp packet for a given IP so I can get the mac.

Could you comment on this perhaps?
Thanks
Chris
February 3rd, 2008 on 10:13 pm
winpcap is the Windows port of libpcap. They should have the same API and ABI.

sharp-pcap is another project that wraps libpcap. It was a bit heavy for what I wanted to do, so I wrote a lighter wrapper. Note that mine does not fully wrap libpcap — specifically the parts that depend on host platform structures, like sockaddr_t.

As for ARP, you may want to have a look at a few classes I wrote as part of an experimental C# packet parsing library. Take a look at the classes in https://layla.chrishowie.com/svn/SharpNet/SharpNet/ and have a look at https://layla.chrishowie.com/svn/SharpNet/SharpStack/ for an unfinished proof-of-concept library that implements a network interface in C#. In its current state it does full ARP processing and replies to ICMP echo requests.
Boaz
October 18th, 2009 on 5:23 pm
Hey Chris,

What exactly are the benefits of wrapping LibPcap instead of WinPcap in .NET?

I’ve written a wrapper myself called Pcap.Net (available at http://pcapdotnet.codeplex.com/) that wraps almost all of WinPcap features and includes a packet parsing library and I’m not sure what am I losing by wrapping WinPcap instead of LibPcap.

Thank you,

Boaz.
Chris
October 18th, 2009 on 5:35 pm
WinPcap is a suite of components that includes libpcap. The upshot is that it provides network drivers and an API-compatible libpcap that connects to those drivers. If properly coded, a wrapper around libpcap will work across platforms, including Windows.

The primary advantage I can see to using pcap-sharp instead of Pcap.Net is that the latter library is managed C++, which is not portable. pcap-sharp is a pure managed library and so it will run on platforms where managed C++ is not supported, such as Linux.