Comments on: pcap-sharp RC1

By: Chris

Chris — Mon, 04 Feb 2008 03:13:53 +0000

winpcap is the Windows port of libpcap. They should have the same API and ABI.

sharp-pcap is another project that wraps libpcap. It was a bit heavy for what I wanted to do, so I wrote a lighter wrapper. Note that mine does not fully wrap libpcap — specifically the parts that depend on host platform structures, like sockaddr_t.

As for ARP, you may want to have a look at a few classes I wrote as part of an experimental C# packet parsing library. Take a look at the classes in https://layla.chrishowie.com/svn/SharpNet/SharpNet/ and have a look at https://layla.chrishowie.com/svn/SharpNet/SharpStack/ for an unfinished proof-of-concept library that implements a network interface in C#. In its current state it does full ARP processing and replies to ICMP echo requests.

By: Austin

Austin — Sat, 02 Feb 2008 20:07:00 +0000

I am curious… I am looking to write a small sniffer app (.net) and I need some library help with the network layer… I am seeing your project here and I wonder if you might help me understand how libpcap differs from winpcap and how your product is different than another I have seen sharp-pcap.

I dont need a lot of power all I am doing is needing to 1. listen for arp packets on teh segment I am on… and 2 send out an arp packet for a given IP so I can get the mac.

Could you comment on this perhaps?
Thanks

By: Chris

Chris — Wed, 05 Dec 2007 03:40:42 +0000

Currently you cannot. There are libpcap functions to do this but they use system structures like sockaddr_t to represent IP addresses, and I don’t want to get that platform-specific. I could use a glue library to do the dirty work but I wanted something simple and 100% managed, so I didn’t go that route.

By: Mark

Mark — Tue, 04 Dec 2007 22:47:54 +0000

Ok thanks for the help. And thanks for distributing the lib.

Last question I promise

IList devices = Pcap.FindAllDevices();
foreach (InterfaceDefinition dev in devices)
{
MessageBox.Show(dev.Name);
}

I’m using the above code to list available interfaces but how can I lookup the ip address for each interface?

By: Chris

Chris — Tue, 04 Dec 2007 22:41:40 +0000

Either require the -dev package or use a config dllmap to remap it to some specific version number. ABI-compatible libraries are supposed to have compatible old versions symlinked to a newer one, so you might dllmap it to libpcap.so.0.8 since that is the version I developed against. If a breaking change comes out then that symlink should not point to the ABI-incompatible library, and in fact should not exist, so your application will fail (as it should).

By: Mark

Mark — Tue, 04 Dec 2007 22:11:39 +0000

Ah! That worked a treat, thanks Chris. Does this mean that pcap-dev will be necessary for end-users to run the app?

By: Chris

Chris — Tue, 04 Dec 2007 18:39:42 +0000

This means either the pcap or pcap-dev packages aren’t installed for your particular platform. pcap-dev often provides a symlink from libpcap.so to some particular version of libpcap, like libpcap.so.0.9.8 on my box. You can solve this any number of ways:

* Symlink libpcap.so to a versioned libpcap library.
* Do the same, but put the symlink in your application directory.
* Create a pcap-sharp.dll.config file. See http://www.mono-project.com/DllMap for information on doing this.

By: Mark

Mark — Tue, 04 Dec 2007 15:27:24 +0000

Hey There Chris,

Thanks for pcap-sharp - it seems to be exactly what I need. I am having some trouble using it though. I am working on Mono in Linux and I can compile a project with it but when I try to run the resulting binary, I always get an error like this:

System.DllNotFoundException: libpcap.so
at (wrapper managed-to-native) PcapSharp.PcapCall:pcap_findalldevs (intptr&,System.Text.StringBuilder)
at PcapSharp.Pcap.FindAllDevices () [0x00000]
[..snip..]

Can you suggest why this might be happening or how I can fix it?

Thanks,

Mark.