They can also apply user-defined rules to filter the packets, dispatch raw packet to the network or collect statistical content on existing traffic. This type of software are provided the facilities to capture raw packets that pass through available network adapters as well as the ones exchanged by other computers on shared media. It can also create packet filters for particular sets of acquired packets.īy utilizing WinPcap, programs such as Wireshark, Nmap, Snort, nTop or Free HTTP Sniffer are able to work properly. The provided dynamic libraries generate a collection of system-independent functions used for obtaining the list of available network adapters, retrieving detailed information regarding specific adapters, sniffing the ongoing packets over a NIC (Network Interface Card), sending and saving packets. The packet capture and network analysis software deploys on the system as a device driver within the Windows kernel's network component alongside a set of DLLs that put together an easily exploitable programming interface for the above mentioned categories of applications.
WinPcap sets the Windows standard in direct packet access, creating a separate connection to raw network data for software such as network and protocol analyzers, network monitors / scanners, traffic loggers / generators, user-level bridges and routers, network intrusion detection systems or other security tools.
In this case, the low level details, such as packet reassembly and protocol handling, are managed by the OS that makes it easy for the applications to read the ongoing traffic. Usual networking application require only basic operating system elements like sockets to access the data on the network.
0 kommentar(er)
