Sniffing Network Data

[Nuno Magalhaes]

Is it possible using .NET (or any other language) to sniff/analyze data
that travels between other computers in the network?

If it is possible how it is done? Because I have some VoIP Phones
linked to a switch that have it's own IP and how do I analyze the data
that travels between each phone? Is it possible? Can an application do
that? How if the protocol is embedded in the TCP/IP stack a single
software computer?

Thanks for any reply,
Nuno Magalhaes.

 

[Hasan O. Zavalsiz]

Hi Nuno,

Is it possible using .NET (or any other language) to sniff/analyze data
that travels between other computers in the network?

Actually the answer is not depent on the programming language. if you have
hub you can sniff network packets. Generally most networks have switch , if
you are not a network administrator , you will probably get all datas
forwarded to you .

If it is possible how it is done? Because I have some VoIP Phones
linked to a switch that have it's own IP and how do I analyze the data
that travels between each phone? Is it possible? Can an application do
that? How if the protocol is embedded in the TCP/IP stack a single
software computer?

There are two ways : using Wincap library or Windows Libraries. Actually
Wincap library is the simple solution to do.

 

[Nuno Magalhaes]

Thank you for your response,

But how would I use Wincap without having access to the network
gateway? On what IP would I bind my socket in order to analyze the
network data?

My doubt is how can I get all the data in the network forwarded to me?
I would have to have access to the network gateway... right? How could
I, programatically, sniff packets at the gateway using wincap?

I would appreciate a more detailed answer ,
Nuno Magalhaes.

 

[Hasan O. Zavalsiz]

Hi Nuno ,

Thank you for your response,

But how would I use Wincap without having access to the network
gateway? On what IP would I bind my socket in order to analyze the
network data?

first of all you have to set your network card in promicious mode, thats
any packet crossing your network arent be dropped. And then you can catch
all data.

My doubt is how can I get all the data in the network forwarded to me?
I would have to have access to the network gateway... right? How could
I, programatically, sniff packets at the gateway using wincap?

you have to pysical access to switch. Using you connect your computer
switchs uplink port. Thats the way you can get all packets. And you have to
set network card too.

There are more ways , just search. I cant remember but all the correct
choice is the one i told. Let me check my documents/presentation and forward
it to you. I have written a sniffer for Windows O.S

 

[Peter Bromberg [C# MVP]]

Nuno,
You might want to look into Ethereal, which is a freeware and very
sophisticated third party application. I use it extensively in my VOIP work
and it has saved my butt more times than I care to count...

http://www.ethereal.com/

Peter

 

[Kevin Spencer]

Ethereal is great! And it's free!

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
Ambiguity has a certain quality to it.