#include <Windows.h>
#include <iphlpapi.h>
 
#pragma comment(lib, "IPHLPAPI.lib")
 
 
 
int main(int argc, char **argv)
{ 
  int lRetVal = 0;
  PIP_ADAPTER_INFO lAdapterInfoPtr = NULL;
  PIP_ADAPTER_INFO lAdapter = NULL;
  DWORD lFuncRetVal = 0;
  UINT lCounter;
  struct tm lTimeStamp;
  char lTemp[MAX_BUF_SIZE +1 ];
  errno_t error;
  ULONG lOutBufLen = sizeof (IP_ADAPTER_INFO);
 
 
 
  if ((lAdapterInfoPtr = (IP_ADAPTER_INFO *) HeapAlloc(GetProcessHeap(), 0, 
      sizeof (IP_ADAPTER_INFO))) == NULL)
  {
    printf("Error allocating memory needed to call GetAdaptersinfo\n");
    lRetVal = 1;
    goto END;
  }
 
 
  if (GetAdaptersInfo(lAdapterInfoPtr, &lOutBufLen) == ERROR_BUFFER_OVERFLOW) 
  {
    HeapFree(GetProcessHeap(), 0, lAdapterInfoPtr);
    if ((lAdapterInfoPtr = (IP_ADAPTER_INFO *) HeapAlloc(GetProcessHeap(), 0, 
        lOutBufLen)) == NULL)
    {
      printf("Error allocating memory needed to call GetAdaptersinfo\n");
      lRetVal = 2;
      goto END;
    }
  }
 
 
  if ((lFuncRetVal = GetAdaptersInfo(lAdapterInfoPtr, &lOutBufLen)) == NO_ERROR) 
  {
    for (lAdapter = lAdapterInfoPtr; lAdapter; lAdapter = lAdapter->Next)
    {
      printf("\n\n\tComboIndex: \t%d\n", lAdapter->ComboIndex);
      printf("\tAdapter Name: \t%s\n", lAdapter->AdapterName);
      printf("\tAdapter Desc: \t%s\n", lAdapter->Description);
      printf("\tAdapter Addr: \t");
 
      for (lCounter = 0; lCounter < lAdapter->AddressLength; lCounter++) 
      {
        if (lCounter == (lAdapter->AddressLength - 1))
          printf("%.2X\n", (int) lAdapter->Address[lCounter]);
        else
          printf("%.2X-", (int) lAdapter->Address[lCounter]);
      }
 
      printf("\tIndex: \t%d\n", lAdapter->Index);
      printf("\tType: \t");
 
      switch (lAdapter->Type) 
      {
         case MIB_IF_TYPE_OTHER:
              printf("Other\n");
              break;
         case MIB_IF_TYPE_ETHERNET:
              printf("Ethernet\n");
              break;
         case MIB_IF_TYPE_TOKENRING:
              printf("Token Ring\n");
              break;
         case MIB_IF_TYPE_FDDI:
              printf("FDDI\n");
              break;
         case MIB_IF_TYPE_PPP:
              printf("PPP\n");
              break;
         case MIB_IF_TYPE_LOOPBACK:
              printf("Lookback\n");
              break;
         case MIB_IF_TYPE_SLIP:
              printf("Slip\n");
              break;
         default:
              printf("Unknown type %ld\n", lAdapter->Type);
              break;
      }
 
      printf("\tIP Address: \t%s\n", lAdapter->IpAddressList.IpAddress.String);
      printf("\tIP Mask: \t%s\n", lAdapter->IpAddressList.IpMask.String);
      printf("\tGateway: \t%s\n", lAdapter->GatewayList.IpAddress.String);
      printf("\t***\n");
 
      if (lAdapter->DhcpEnabled) 
      {
        printf("\tDHCP Enabled: Yes\n");
        printf("\t  DHCP Server: \t%s\n", lAdapter->DhcpServer.IpAddress.String);
        printf("\t  Lease Obtained: ");
 
        if (error = _localtime32_s(&lTimeStamp, 
                   (__time32_t*) &lAdapter->LeaseObtained))
          printf("Invalid Argument to _localtime32_s\n");
        else {
          if (error = asctime_s(lTemp, sizeof(lTemp), &lTimeStamp))
            printf("Invalid Argument to asctime_s\n");
          else
            printf("%s", lTemp);
        }
 
        printf("\t  Lease Expires:  ");
 
        if (error = _localtime32_s(&lTimeStamp, 
                   (__time32_t*) &lAdapter->LeaseExpires))
          printf("Invalid Argument to _localtime32_s\n");
        else {
          // Convert to an ASCII representation 
          if (error = asctime_s(lTemp, sizeof(lTemp), &lTimeStamp))
            printf("Invalid Argument to asctime_s\n");
          else
            printf("%s", lTemp);
        }
      } else
        printf("\tDHCP Enabled: No\n");
 
      if (lAdapter->HaveWins) 
      {
        printf("\tHave Wins: Yes\n");
        printf("\t  Primary Wins Server:    %s\n", 
                lAdapter->PrimaryWinsServer.IpAddress.String);
        printf("\t  Secondary Wins Server:  %s\n", 
                lAdapter->SecondaryWinsServer.IpAddress.String);
      } else
         printf("\tHave Wins: No\n");
    }
  } else
    printf("GetAdaptersInfo failed with error: %d\n", lFuncRetVal);
 
 
END:
  if (lAdapterInfoPtr)
    HeapFree(GetProcessHeap(), 0, lAdapterInfoPtr);
 
  return(lRetVal);
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
#define snprintf _snprintf
 
#define ETH_ALEN 6
#define IP_ALEN 4
 
#define ARP_REQUEST 1
#define ARP_REPLY 2
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
#pragma comment(lib, "Ws2_32.lib")
 
 
 
/*
 * Our data types
 *
 */
 
typedef struct ethern_hdr
{
  unsigned char ether_dhost[6];  // dest Ethernet address
  unsigned char ether_shost[6];  // source Ethernet address
  unsigned short ether_type;     // protocol (16-bit)
} ETHDR, *PETHDR;
 
typedef struct ipaddress
{
  unsigned char byte1;
  unsigned char byte2;
  unsigned char byte3;
  unsigned char byte4;
} IPADDRESS;
 
typedef struct iphdr
{
  unsigned char  ver_ihl;        // Version (4 bits) + Internet header length (4 bits)
  unsigned char  tos;            // Type of service 
  unsigned short tlen;           // Total length 
  unsigned short identification; // Identification
  unsigned short flags_fo;       // Flags (3 bits) + Fragment offset (13 bits)
  unsigned char  ttl;            // Time to live
  unsigned char  proto;          // Protocol
  unsigned short crc;            // Header checksum
  IPADDRESS      saddr;      // Source address
  IPADDRESS      daddr;      // Destination address
  unsigned int   opt;        // Option + padding
} IPHDR, *PIPHDR;
 
typedef struct icmpheader
{
  u_char  type;
  u_char  code;
  u_short checksum;
  u_short id;
  u_short sequence; 
  u_short data;
} ICMPHDR, *PICMPHDR;  
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data);
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen);
void processIP4(PIPHDR pIPHdr);
void processICMP(PICMPHDR pICMPHdr, int pTotLen);
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
  struct bpf_program lFCode;
  unsigned int lNetMask = 0;
 
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  lCounter = 0;
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 
	                          1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter.\n");
    lRetVal = 5;
	goto END;
  }
 
 
 
 
 
  /* 
   * Compiling + setting the filter
   *
   */
 
  if (lDevice->addresses != NULL)
    lNetMask = ((struct sockaddr_in *)(lDevice->addresses->netmask))->sin_addr.S_un.S_addr;
  else
    lNetMask = 0xffffff;	
 
 
  ZeroMemory(&lFCode, sizeof(lFCode));
  if (pcap_compile(lIFCHandle, &lFCode, "", 1, lNetMask) < 0)
  {
    printf("Unable to compile the packet filter.\n");
    lRetVal = 3;
	goto END;
  }
 
 
  if (pcap_setfilter(lIFCHandle, &lFCode) < 0)
  {
    printf("Error setting the filter.\n");
    lRetVal = 4;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data)
{
  struct tm *ltime;
  char timestr[16];
  time_t local_tv_sec;
  PETHDR lEHdr = (PETHDR) pkt_data;
  char lSrcMAC[64];
  char lDstMAC[64];
  char lProto[MAX_BUF_SIZE + 1];
 
 
  ZeroMemory(lDstMAC, sizeof(lDstMAC));
  ZeroMemory(lSrcMAC, sizeof(lSrcMAC));
  ZeroMemory(lProto, sizeof(lProto));
 
 
  /*
   * Convert the timestamp to readable format
   *
   */
 
  local_tv_sec = header->ts.tv_sec;
  ltime=localtime(&local_tv_sec);
  strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
 
  MAC2String(lEHdr->ether_shost, lSrcMAC, sizeof(lSrcMAC) - 1);
  MAC2String(lEHdr->ether_dhost, lDstMAC, sizeof(lDstMAC) - 1);
  printf("\n\nTIME\t%s.%06d\nPHYS\t%s -> %s\n", timestr, header->ts.tv_usec,
	     lSrcMAC, lDstMAC);
 
 
 
  /*
   * Read source + destination MAC addresses
   *
   */
 
  switch (htons(lEHdr->ether_type))
  {
    case 0x0800 : printf("IPv4");
                  processIP4((PIPHDR) (pkt_data + 14));
                  break;
  }
}
 
 
 
/*
 *
 *
 */
 
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen)
{
  if (pOutput && pOutputLen > 0)
  {
    snprintf(pOutput, pOutputLen, "%02X:%02X:%02X:%02X:%02X:%02X", pMAC[0], 
             pMAC[1], pMAC[2], pMAC[3], pMAC[4], pMAC[5]);
  }
}
 
 
 
/*
 * Process IP packet
 *
 */
 
void processIP4(PIPHDR pIPHdr)
{
  int lIPLen = (pIPHdr->ver_ihl & 0xf) * 4;
  int lTotLen = ntohs(pIPHdr->tlen);
 
  printf("\tHdr lenght : %d\tTot length : %d\n", lIPLen, lTotLen);
  printf("\t%d.%d.%d.%d -> %d.%d.%d.%d\n", pIPHdr->saddr.byte1, 
	  pIPHdr->saddr.byte2, pIPHdr->saddr.byte3, pIPHdr->saddr.byte4,
	  pIPHdr->daddr.byte1, pIPHdr->daddr.byte2, pIPHdr->daddr.byte3, 
	  pIPHdr->daddr.byte4);
 
 
  /*
   *
   *
   */
 
  if (pIPHdr->proto == 1)
    processICMP((PICMPHDR) ((u_char*) pIPHdr + lIPLen), lTotLen);
}
 
 
 
 
/* 
 * Process ICMP packet
 *
 */
 
void processICMP(PICMPHDR pICMPHdr,  int pTotLen)
{
  char lTemp[MAX_BUF_SIZE + 1];
  char lData[MAX_BUF_SIZE + 1];
  int lDataLen = pTotLen - sizeof(IPHDR) - sizeof(ICMPHDR);
 
  ZeroMemory(lTemp, sizeof(lTemp));
  ZeroMemory(lData, sizeof(lData));
 
  strncpy(lData, (unsigned char *) pICMPHdr + sizeof(ICMPHDR), lDataLen);
 
 
 
  switch (pICMPHdr->type)
  {
	case 0: strcpy(lTemp, "Echo reply");
           break;
    case 3: strcpy(lTemp, "Des. unreachable");
           break;
    case 4: strcpy(lTemp, "Source quench");
           break;
    case 5: strcpy(lTemp, "Redirect");
           break;
    case 8: strcpy(lTemp, "Echo request");
           break;
    case 11: strcpy(lTemp, "Time exceeded");
           break;
    case 13: strcpy(lTemp, "Timestamp request");
           break;
    case 14: strcpy(lTemp, "Timestamp reply");
           break;
    case 37: strcpy(lTemp, "DN request");
           break;
    case 38: strcpy(lTemp, "DN reply");
           break;
	default : strcpy(lTemp, "Somethig");
              break;
  }
 
  printf("ICMP\tType : %d -> %s\n", pICMPHdr->type, lTemp);
  printf("\tCode : %d\n", pICMPHdr->code);
  printf("\tData : \"%s\"\n", lData);
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
#define snprintf _snprintf
 
#define ETH_ALEN 6
#define IP_ALEN 4
 
#define ARP_REQUEST 1
#define ARP_REPLY 2
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
#pragma comment(lib, "Ws2_32.lib")
 
 
 
/*
 * Our data types
 *
 */
 
typedef struct ethern_hdr
{
  unsigned char ether_dhost[6];  // dest Ethernet address
  unsigned char ether_shost[6];  // source Ethernet address
  unsigned short ether_type;     // protocol (16-bit)
} ETHDR, *PETHDR;
 
typedef struct ipaddress
{
  unsigned char byte1;
  unsigned char byte2;
  unsigned char byte3;
  unsigned char byte4;
} IPADDRESS;
 
typedef struct iphdr
{
  unsigned char  ver_ihl;        // Version (4 bits) + Internet header length (4 bits)
  unsigned char  tos;            // Type of service 
  unsigned short tlen;           // Total length 
  unsigned short identification; // Identification
  unsigned short flags_fo;       // Flags (3 bits) + Fragment offset (13 bits)
  unsigned char  ttl;            // Time to live
  unsigned char  proto;          // Protocol
  unsigned short crc;            // Header checksum
  IPADDRESS      saddr;      // Source address
  IPADDRESS      daddr;      // Destination address
  unsigned int   opt;        // Option + padding
} IPHDR, *PIPHDR;
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data);
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen);
void processIP4(PIPHDR pIPHdr);
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
  struct bpf_program lFCode;
  unsigned int lNetMask = 0;
 
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  lCounter = 0;
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 
	                          1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter.\n");
    lRetVal = 5;
	goto END;
  }
 
 
 
 
 
  /* 
   * Compiling + setting the filter
   *
   */
 
  if (lDevice->addresses != NULL)
    lNetMask = ((struct sockaddr_in *)(lDevice->addresses->netmask))->sin_addr.S_un.S_addr;
  else
    lNetMask = 0xffffff;	
 
 
  ZeroMemory(&lFCode, sizeof(lFCode));
  if (pcap_compile(lIFCHandle, &lFCode, "", 1, lNetMask) < 0)
  {
    printf("Unable to compile the packet filter.\n");
    lRetVal = 3;
	goto END;
  }
 
 
  if (pcap_setfilter(lIFCHandle, &lFCode) < 0)
  {
    printf("Error setting the filter.\n");
    lRetVal = 4;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data)
{
  struct tm *ltime;
  char timestr[16];
  time_t local_tv_sec;
  PETHDR lEHdr = (PETHDR) pkt_data;
  char lSrcMAC[64];
  char lDstMAC[64];
  char lProto[MAX_BUF_SIZE + 1];
 
 
  ZeroMemory(lDstMAC, sizeof(lDstMAC));
  ZeroMemory(lSrcMAC, sizeof(lSrcMAC));
  ZeroMemory(lProto, sizeof(lProto));
 
 
  /*
   * Convert the timestamp to readable format
   *
   */
 
  local_tv_sec = header->ts.tv_sec;
  ltime=localtime(&local_tv_sec);
  strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
 
  MAC2String(lEHdr->ether_shost, lSrcMAC, sizeof(lSrcMAC) - 1);
  MAC2String(lEHdr->ether_dhost, lDstMAC, sizeof(lDstMAC) - 1);
  printf("\n\nTIME\t%s.%06d\nPHYS\t%s -> %s\n", timestr, header->ts.tv_usec,
	     lSrcMAC, lDstMAC);
 
 
 
  /*
   * Read source + destination MAC addresses
   *
   */
 
  switch (htons(lEHdr->ether_type))
  {
    case 0x0800 : printf("IPv4");
                  processIP4((PIPHDR) (pkt_data + 14));
                  break;
  }
}
 
 
 
/*
 *
 *
 */
 
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen)
{
  if (pOutput && pOutputLen > 0)
  {
    snprintf(pOutput, pOutputLen, "%02X:%02X:%02X:%02X:%02X:%02X", pMAC[0], 
             pMAC[1], pMAC[2], pMAC[3], pMAC[4], pMAC[5]);
  }
}
 
 
 
/*
 * Process IP packet
 *
 */
 
void processIP4(PIPHDR pIPHdr)
{
  int lIPLen = (pIPHdr->ver_ihl & 0xf) * 4;
  int lTotLen = ntohs(pIPHdr->tlen);
 
  printf("\tHdr lenght : %d\tTot length : %d\n", lIPLen, lTotLen);
  printf("\t%d.%d.%d.%d -> %d.%d.%d.%d\n", pIPHdr->saddr.byte1, 
	  pIPHdr->saddr.byte2, pIPHdr->saddr.byte3, pIPHdr->saddr.byte4,
	  pIPHdr->daddr.byte1, pIPHdr->daddr.byte2, pIPHdr->daddr.byte3, 
	  pIPHdr->daddr.byte4);
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
#define snprintf _snprintf
 
#define ETH_ALEN 6
#define IP_ALEN 4
 
#define ARP_REQUEST 1
#define ARP_REPLY 2
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
#pragma comment(lib, "Ws2_32.lib")
 
 
 
/*
 * Our data types
 *
 */
 
typedef struct ethern_hdr
{
  unsigned char ether_dhost[6];  // dest Ethernet address
  unsigned char ether_shost[6];  // source Ethernet address
  unsigned short ether_type;     // protocol (16-bit)
} ETHDR, *PETHDR;
 
typedef struct arphdr   
{   
  unsigned short  htype;   // format of hardware address 
  unsigned short  ptype;   // format of protocol address
  unsigned char   hlen;   // length of hardware address
  unsigned char   plen;    // length of protocol address 
  unsigned short  opcode;    // ARP/RARP operation
  unsigned char   sha[6];  // sender hardware address
  unsigned char   spa[4];     // sender protocol address
  unsigned char   tha[6];  // target hardware address
  unsigned char   tpa[4];      // target protocol address
} ARPHDR, *PARPHDR;   
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data);
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen);
void processARP(PARPHDR pARPData);
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
  struct bpf_program lFCode;
  unsigned int lNetMask = 0;
 
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  lCounter = 0;
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 
	                          1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter.\n");
    lRetVal = 5;
	goto END;
  }
 
 
 
 
 
  /* 
   * Compiling + setting the filter
   *
   */
 
  if (lDevice->addresses != NULL)
    lNetMask = ((struct sockaddr_in *)(lDevice->addresses->netmask))->sin_addr.S_un.S_addr;
  else
    lNetMask = 0xffffff;	
 
 
  ZeroMemory(&lFCode, sizeof(lFCode));
  if (pcap_compile(lIFCHandle, &lFCode, "", 1, lNetMask) < 0)
  {
    printf("Unable to compile the packet filter.\n");
    lRetVal = 3;
	goto END;
  }
 
 
  if (pcap_setfilter(lIFCHandle, &lFCode) < 0)
  {
    printf("Error setting the filter.\n");
    lRetVal = 4;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data)
{
  struct tm *ltime;
  char timestr[16];
  time_t local_tv_sec;
  PETHDR lEHdr = (PETHDR) pkt_data;
  char lSrcMAC[64];
  char lDstMAC[64];
  char lProto[MAX_BUF_SIZE + 1];
 
 
  ZeroMemory(lDstMAC, sizeof(lDstMAC));
  ZeroMemory(lSrcMAC, sizeof(lSrcMAC));
  ZeroMemory(lProto, sizeof(lProto));
 
 
  /*
   * Convert the timestamp to readable format
   *
   */
 
  local_tv_sec = header->ts.tv_sec;
  ltime=localtime(&local_tv_sec);
  strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
 
  MAC2String(lEHdr->ether_shost, lSrcMAC, sizeof(lSrcMAC) - 1);
  MAC2String(lEHdr->ether_dhost, lDstMAC, sizeof(lDstMAC) - 1);
  printf("\n\nTIME\t%s.%06d\nPHYS\t%s -> %s\n", timestr, header->ts.tv_usec,
	     lSrcMAC, lDstMAC);
 
 
 
  /*
   * Read source + destination MAC addresses
   *
   */
 
  switch (htons(lEHdr->ether_type))
  {
    case 0x0806 : printf("ARP");
                  processARP((PARPHDR) (pkt_data + 14));
                  break;
    case 0x8035 : printf("RARP");
  }
}
 
 
 
/*
 *
 *
 */
 
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen)
{
  if (pOutput && pOutputLen > 0)
  {
    snprintf(pOutput, pOutputLen, "%02X:%02X:%02X:%02X:%02X:%02X", pMAC[0], 
             pMAC[1], pMAC[2], pMAC[3], pMAC[4], pMAC[5]);
  }
}
 
 
 
 
 
/*
 * Process ARP packet
 *
 */
 
void processARP(PARPHDR pARPData)
{
  char lDMAC[64];
  char lDIP[64];
  char lSMAC[64];
  char lSIP[64];
 
  ZeroMemory(lDMAC, sizeof(lDMAC));
  ZeroMemory(lSMAC, sizeof(lSMAC));
  ZeroMemory(lDIP, sizeof(lDIP));
  ZeroMemory(lSIP, sizeof(lSIP));
 
  MAC2String(pARPData->sha, lSMAC, sizeof(lSMAC) - 1);
  MAC2String(pARPData->tha, lDMAC, sizeof(lDMAC) - 1);
 
 
  snprintf(lSIP, sizeof(lSIP) - 1, "%d.%d.%d.%d", pARPData->spa[0], 
	  pARPData->spa[1], pARPData->spa[2], pARPData->spa[3]); 
 
  snprintf(lDIP, sizeof(lDIP) - 1, "%d.%d.%d.%d", pARPData->tpa[0], 
	  pARPData->tpa[1], pARPData->tpa[2], pARPData->tpa[3]); 
 
  printf("\tHardware type: %s\n", (ntohs(pARPData->htype) == 1) ? "Ethernet" : "Unknown"); 
  printf("\tOperation: %s\n", (ntohs(pARPData->opcode) == ARP_REQUEST)? "ARP Request" : "ARP Reply"); 
  printf("\tSMAC %s (%s) - DMAC %s (%s)\n\n", lSMAC, lSIP, lDMAC, lDIP);
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
#define snprintf _snprintf
 
 
#define ETH_ALEN 6
#define IP_ALEN 4
 
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
#pragma comment(lib, "Ws2_32.lib")
 
 
 
/*
 * Our data types
 *
 */
 
typedef struct ethern_hdr
{
  unsigned char ether_dhost[6];  // dest Ethernet address
  unsigned char ether_shost[6];  // source Ethernet address
  unsigned short ether_type;     // protocol (16-bit)
} ETHDR, *PETHDR;
 
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data);
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen);
 
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
  struct bpf_program lFCode;
  unsigned int lNetMask = 0;
 
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  lCounter = 0;
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 
	                          1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter.\n");
    lRetVal = 5;
	goto END;
  }
 
 
 
 
 
  /* 
   * Compiling + setting the filter
   *
   */
 
  if (lDevice->addresses != NULL)
    lNetMask = ((struct sockaddr_in *)(lDevice->addresses->netmask))->sin_addr.S_un.S_addr;
  else
    lNetMask = 0xffffff;	
 
 
  ZeroMemory(&lFCode, sizeof(lFCode));
  if (pcap_compile(lIFCHandle, &lFCode, "", 1, lNetMask) < 0)
  {
    printf("Unable to compile the packet filter.\n");
    lRetVal = 3;
	goto END;
  }
 
 
  if (pcap_setfilter(lIFCHandle, &lFCode) < 0)
  {
    printf("Error setting the filter.\n");
    lRetVal = 4;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, 
					const u_char *pkt_data)
{
  struct tm *ltime;
  char timestr[16];
  time_t local_tv_sec;
  PETHDR lEHdr = (PETHDR) pkt_data;
  char lSrcMAC[64];
  char lDstMAC[64];
  char lProto[MAX_BUF_SIZE + 1];
 
 
  ZeroMemory(lDstMAC, sizeof(lDstMAC));
  ZeroMemory(lSrcMAC, sizeof(lSrcMAC));
  ZeroMemory(lProto, sizeof(lProto));
 
 
  /*
   * Convert the timestamp to readable format
   *
   */
 
  local_tv_sec = header->ts.tv_sec;
  ltime=localtime(&local_tv_sec);
  strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
 
  MAC2String(lEHdr->ether_shost, lSrcMAC, sizeof(lSrcMAC) - 1);
  MAC2String(lEHdr->ether_dhost, lDstMAC, sizeof(lDstMAC) - 1);
  printf("\n\nTIME\t%s.%06d\nPHYS\t%s -> %s\n", timestr, header->ts.tv_usec,
	     lSrcMAC, lDstMAC);
 
}
 
 
 
/*
 *
 *
 */
 
void MAC2String(unsigned char pMAC[6], char *pOutput, int pOutputLen)
{
  if (pOutput && pOutputLen > 0)
  {
    snprintf(pOutput, pOutputLen, "%02X:%02X:%02X:%02X:%02X:%02X", pMAC[0], 
             pMAC[1], pMAC[2], pMAC[3], pMAC[4], pMAC[5]);
  }
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
 
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
  struct bpf_program lFCode;
  unsigned int lNetMask = 0;
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  for(lDevice = lAllDevs, lCounter = 0; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lCounter = 0, lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter.\n");
    lRetVal = 5;
	goto END;
  }
 
 
 
 
 
  /* 
   * Compiling + setting the filter
   *
   */
 
  if (lDevice->addresses != NULL)
    lNetMask = ((struct sockaddr_in *)(lDevice->addresses->netmask))->sin_addr.S_un.S_addr;
  else
    lNetMask = 0xffffff; 
 
 
  ZeroMemory(&lFCode, sizeof(lFCode));
  if (pcap_compile(lIFCHandle, &lFCode, "tcp and ip", 1, lNetMask) < 0)
  {
    printf("Unable to compile the packet filter.\n");
    lRetVal = 3;
	goto END;
  }
 
 
  if (pcap_setfilter(lIFCHandle, &lFCode) < 0)
  {
    printf("Error setting the filter.\n");
    lRetVal = 4;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    struct tm *ltime;
    char timestr[16];
    time_t local_tv_sec;
 
    /* convert the timestamp to readable format */
    local_tv_sec = header->ts.tv_sec;
    ltime=localtime(&local_tv_sec);
    strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
    printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
 
 
/*
 * Function forward declarations.
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);
 
 
 
 
/*
 * Program entry point
 *
 */
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs = NULL;
  pcap_if_t *lDevice = NULL;
  char lTemp[PCAP_ERRBUF_SIZE];
  char lAdapter[MAX_BUF_SIZE + 1];
  int lCounter = 0;
  int lIFCnum = 0;
  pcap_t *lIFCHandle = NULL;
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  for(lDevice = lAllDevs, lCounter = 0; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
 
 
  /*
   * Dialog which adapter to open.
   *
   */
 
  printf("\n\nOn which adapter do you want to start the sniffer : ");
  scanf("%d", &lIFCnum);
  if ((lIFCnum > 9 && lIFCnum < 0))
  {
    printf("The adapter you chose does not exist\n");
	lRetVal = 2;
	goto END;
  }
 
 
 
  ZeroMemory(lAdapter, sizeof(lAdapter));
  lCounter = 0;
 
  for(lCounter = 0, lDevice = lAllDevs; lDevice; lDevice = lDevice->next, lCounter++)
  {
    if (lCounter == lIFCnum)
    {
      strcpy(lAdapter, lDevice->name);
      break;
    }
  }
 
 
  /*
   * Open interface.
   *
   */
 
  if ((lIFCHandle = pcap_open(lAdapter, 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, lTemp)) == NULL)
  {
    fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", argv[1]);
    lRetVal = 3;
	goto END;
  }
 
  // We dont need this list anymore.
  pcap_freealldevs(lAllDevs);
 
  // Start intercepting data packets.
  pcap_loop(lIFCHandle, 0, packet_handler, NULL);
 
 
 
 
 
END:
 
  /*
   * Release all allocated resources.
   *
   */
 
  if (lAllDevs)
    pcap_freealldevs(lAllDevs);
 
 
 
  return(lRetVal);
}
 
 
 
/* 
 * Callback function invoked by libpcap for every incoming packet 
 *
 */
 
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    struct tm *ltime;
    char timestr[16];
    time_t local_tv_sec;
 
    /* convert the timestamp to readable format */
    local_tv_sec = header->ts.tv_sec;
    ltime=localtime(&local_tv_sec);
    strftime( timestr, sizeof timestr, "%H:%M:%S", ltime);
 
    printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);
 
}

#define HAVE_REMOTE
#define MAX_BUF_SIZE 1024
 
#include <stdlib.h>
#include <stdio.h>
#include <pcap.h>
 
#pragma comment(lib, "wpcap.lib")
 
 
int main(int argc, char **argv)
{
  int lRetVal = 0;
  pcap_if_t *lAllDevs, *lDevice;
  char lTemp[PCAP_ERRBUF_SIZE];
  int lCounter;
 
 
 
  /*
   * Open device list.
   *
   */
 
  if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &lAllDevs, lTemp) == -1)
  {
    printf("Error in pcap_findalldevs_ex() : %s\n", lTemp);
    lRetVal = 1;
    goto END;
  }
 
 
 
  /*
   * Print device name + description.
   *
   */
 
  for(lDevice = lAllDevs, lCounter = 0; lDevice; lDevice = lDevice->next, lCounter++)
  {
    printf("\n%d. %s\n    ", lCounter, lDevice->name);
 
    if (lDevice->name)
      printf("%d : (%s)\n", lCounter, lDevice->description);
    else
      printf(" (%d : No description available)\n", lCounter);
  }
 
END:
 
  return(lRetVal);
}

using System;
using System.Diagnostics;
 
 
namespace MyProcesses
{
    class MyProcesses
    {
        static void Main(string[] args) 
        {
            Process lProc = new Process();
 
            /*
             * Starting an instance of IE. 
             * 
             */
 
            lProc.StartInfo.FileName = "iexplore.exe";
            lProc.StartInfo.Arguments = "www.megapanzer.com";
            lProc.Start();
 
            Console.WriteLine("Hit any key to kill IE");
            Console.Read();
 
 
            /*
             * Browsing through the process list and killing
             * all IE instances.
             * 
             */
 
            foreach (Process lProcess in Process.GetProcessesByName("iexplore"))
            {
                try
                {
                    lProcess.Kill();
                }
                catch (Exception e) {}
            }
        }
    }
}