1

I want to sniff the arrival packets on a specific port for basic header checks (mainly source IP and the flags). It is easy to achieve by using winpcap. Also one can use Network monitor as suggested here. Network monitor is also bulky and installs the drivers which makes my setup a two step process. I wondered if there is a way to do same using pure .net?

I didn't find promiscuous mode socket listeners, however using:

IPGlobalProperties.GetIPGlobalProperties().GetActiveTcpConnections()

I can get all active connections and their flags. The only issues is that I did not find an event to bind my listener to. All I can do is to put the above code inside a loop and check which is not what I want:

while (true)
{
Connections = GetIPGlobalProperties().GetActiveTcpConnections().Where(c => c.LocalEndPoint.Port == xxx && c.State == TcpState.SynReceived);
//Do some operation on Connections
}

Any ideas or is there a way to bind a listener?

Community
  • 1
  • 1
beebee
  • 280
  • 3
  • 18
  • 1
    Have you looked at [this](http://www.drowningintechnicaldebt.com/RoyAshbrook/archive/2013/02/13/simple-sniffer-in-c.aspx)? Not related to your approach, but tells you how to do promiscuous sockets. – itsme86 Sep 16 '16 at 17:55
  • Thanks, that sounds like the direction I missed to find. I would mark as answer if you'd like to post it. Might be helpful to others too. – beebee Sep 16 '16 at 20:41

0 Answers0