I have released pcap-sharp RC1. If you’re interested, give it a shot and let me know how it works for you.
This entry was posted
on Friday, March 23rd, 2007 at 9:37 pm and is filed under C#, Linux.
You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Thanks for pcap-sharp - it seems to be exactly what I need. I am having some trouble using it though. I am working on Mono in Linux and I can compile a project with it but when I try to run the resulting binary, I always get an error like this:
System.DllNotFoundException: libpcap.so
at (wrapper managed-to-native) PcapSharp.PcapCall:pcap_findalldevs (intptr&,System.Text.StringBuilder)
at PcapSharp.Pcap.FindAllDevices () [0x00000]
[..snip..]
Can you suggest why this might be happening or how I can fix it?
This means either the pcap or pcap-dev packages aren’t installed for your particular platform. pcap-dev often provides a symlink from libpcap.so to some particular version of libpcap, like libpcap.so.0.9.8 on my box. You can solve this any number of ways:
* Symlink libpcap.so to a versioned libpcap library.
* Do the same, but put the symlink in your application directory.
* Create a pcap-sharp.dll.config file. See http://www.mono-project.com/DllMap for information on doing this.
Either require the -dev package or use a config dllmap to remap it to some specific version number. ABI-compatible libraries are supposed to have compatible old versions symlinked to a newer one, so you might dllmap it to libpcap.so.0.8 since that is the version I developed against. If a breaking change comes out then that symlink should not point to the ABI-incompatible library, and in fact should not exist, so your application will fail (as it should).
Currently you cannot. There are libpcap functions to do this but they use system structures like sockaddr_t to represent IP addresses, and I don’t want to get that platform-specific. I could use a glue library to do the dirty work but I wanted something simple and 100% managed, so I didn’t go that route.
I am curious… I am looking to write a small sniffer app (.net) and I need some library help with the network layer… I am seeing your project here and I wonder if you might help me understand how libpcap differs from winpcap and how your product is different than another I have seen sharp-pcap.
I dont need a lot of power all I am doing is needing to 1. listen for arp packets on teh segment I am on… and 2 send out an arp packet for a given IP so I can get the mac.
winpcap is the Windows port of libpcap. They should have the same API and ABI.
sharp-pcap is another project that wraps libpcap. It was a bit heavy for what I wanted to do, so I wrote a lighter wrapper. Note that mine does not fully wrap libpcap — specifically the parts that depend on host platform structures, like sockaddr_t.
As for ARP, you may want to have a look at a few classes I wrote as part of an experimental C# packet parsing library. Take a look at the classes in https://layla.chrishowie.com/svn/SharpNet/SharpNet/ and have a look at https://layla.chrishowie.com/svn/SharpNet/SharpStack/ for an unfinished proof-of-concept library that implements a network interface in C#. In its current state it does full ARP processing and replies to ICMP echo requests.
Hey There Chris,
Thanks for pcap-sharp - it seems to be exactly what I need. I am having some trouble using it though. I am working on Mono in Linux and I can compile a project with it but when I try to run the resulting binary, I always get an error like this:
System.DllNotFoundException: libpcap.so
at (wrapper managed-to-native) PcapSharp.PcapCall:pcap_findalldevs (intptr&,System.Text.StringBuilder)
at PcapSharp.Pcap.FindAllDevices () [0x00000]
[..snip..]
Can you suggest why this might be happening or how I can fix it?
Thanks,
Mark.
This means either the pcap or pcap-dev packages aren’t installed for your particular platform. pcap-dev often provides a symlink from libpcap.so to some particular version of libpcap, like libpcap.so.0.9.8 on my box. You can solve this any number of ways:
* Symlink libpcap.so to a versioned libpcap library.
* Do the same, but put the symlink in your application directory.
* Create a pcap-sharp.dll.config file. See http://www.mono-project.com/DllMap for information on doing this.
Ah! That worked a treat, thanks Chris. Does this mean that pcap-dev will be necessary for end-users to run the app?
Either require the -dev package or use a config dllmap to remap it to some specific version number. ABI-compatible libraries are supposed to have compatible old versions symlinked to a newer one, so you might dllmap it to libpcap.so.0.8 since that is the version I developed against. If a breaking change comes out then that symlink should not point to the ABI-incompatible library, and in fact should not exist, so your application will fail (as it should).
Ok thanks for the help. And thanks for distributing the lib.
Last question I promise
IList devices = Pcap.FindAllDevices();
foreach (InterfaceDefinition dev in devices)
{
MessageBox.Show(dev.Name);
}
I’m using the above code to list available interfaces but how can I lookup the ip address for each interface?
Currently you cannot. There are libpcap functions to do this but they use system structures like sockaddr_t to represent IP addresses, and I don’t want to get that platform-specific. I could use a glue library to do the dirty work but I wanted something simple and 100% managed, so I didn’t go that route.
I am curious… I am looking to write a small sniffer app (.net) and I need some library help with the network layer… I am seeing your project here and I wonder if you might help me understand how libpcap differs from winpcap and how your product is different than another I have seen sharp-pcap.
I dont need a lot of power all I am doing is needing to 1. listen for arp packets on teh segment I am on… and 2 send out an arp packet for a given IP so I can get the mac.
Could you comment on this perhaps?
Thanks
winpcap is the Windows port of libpcap. They should have the same API and ABI.
sharp-pcap is another project that wraps libpcap. It was a bit heavy for what I wanted to do, so I wrote a lighter wrapper. Note that mine does not fully wrap libpcap — specifically the parts that depend on host platform structures, like sockaddr_t.
As for ARP, you may want to have a look at a few classes I wrote as part of an experimental C# packet parsing library. Take a look at the classes in https://layla.chrishowie.com/svn/SharpNet/SharpNet/ and have a look at https://layla.chrishowie.com/svn/SharpNet/SharpStack/ for an unfinished proof-of-concept library that implements a network interface in C#. In its current state it does full ARP processing and replies to ICMP echo requests.