Capturing Another Application's Network Traffic

[piccolo]

Apart from winpcap where you need to install a lib you can find various other tools. For example analogx has some simple capture utility that can capture traffic (it is called packetmon). But if you look around. anyway using ethereal you got an awesome package too as already mentioned.
Another cool one that runs without a driver is BasicNetworkSniffer from planet-source-code I just compiled it.
There is a thing called ethernetspy with source code, which is interesting to read (use google).
There is also netcat which is a basic sniffer which uses hooking so also no drivers are needed.
One I really liked is poorsniff which also doesnt need drivers. Be aware tho that using raw packets can only be done under sp2 when you are not crafting packets (normally, although with hooking you might get it done anyway). Have fun.

@Big_or_what:
The question is what exactly you are trying to do:
- Do you have general admin access?
- Are you interested in the packets' data or in the packets themself?
- How will the program you're capturing data from access the network?
- Will the program run at Ring-3 or Ring-0?
- Will the data be encrypted?
- How much traffic do you expect to be captured?
- What transport and communication protocol will be used?

If you can't answer these questions, nobody can help you.

(for example: the sniffers posted here mostly capture all network traffic, not only one application; if SSL is used, all capturing will be useless; if you like to capture IGMP, most sniffers won't even know it; ...)

[aldente]

I could not log in to my account for quite a long time, so that's why it took me so long to answer.

Here are the answers to your questions:

- Do you have general admin access?

Sure. But I wanted to design my tool so it works without administrator rights. That seems to be impossibile though...

- Are you interested in the packets' data or in the packets themself?

I want to access the packets content.

- How will the program you're capturing data from access the network?

WinSocks.

- Will the program run at Ring-3 or Ring-0?

It's a normal usermode-application.

- Will the data be encrypted?

No, just unencrypted TCP-data.

- How much traffic do you expect to be captured?

Very little.

- What transport and communication protocol will be used?

Only TCP.


In the meantime I tried a network sniffer based on raw sockets and filtered out just the traffic of the target application. Anyway, the CPU-load of this sniffer is quite high when there are other applications which produce network traffic (a 250 kb/s download makes a 3-4% CPU load in the sniffer tool).
Installing a driver for the sniffing application is NOT an option, so WinPCap can't be used.

Any other ideas of howto get the traffic besides from raw sockets?
How about some winsock-tricks?

In this case you might want to try "Ultra Network Sniffer" (http://www.gjpsoft.com/UltraNetSniffer/).

It only needs admin rights once to install the driver and it captures traffic based on applications.

And if you don't intend to buy the application ( ), you might want to skip the strong RSA-1024 registration system and find the implementation error.

[aldente]

As I said, I don't want any solution which requires a driver!

To ensure you got me right: I don't want any network sniffer for myself, CommView is just perfect for that purpose and I don't need anything else.

I wan't a solution which I can easily integrate into my own tool, and I don't want to distribute any drivers with my tool!

But I already wrote that in the first sentence of the first post of this thread!