winpcap
WinPcap 4.1 beta5
WinPcap is the industry-standard tool for link-layer network access in Windows environments. more>>
WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API.
Thanks to its set of features, WinPcap is the packet capture and filtering engine of many open source and commercial network tools, including protocol analyzers, network monitors, network intrusion detection systems, sniffers, traffic generators and network testers. Some of these tools, like Ethereal, Nmap, Snort, ntop are known and used throughout the networking community.
Winpcap.org is also the home of WinDump, the Windows version of the popular tcpdump tool. WinDump can be used to watch, diagnose and save to disk network traffic according to various complex rules.
Major Features:
1. Free.
WinPcap is released under the BSD open source licence. This means that you have total freedom to modify and use it with your application, even if its commercial.
2. High performance.
WinPcap implements all of the classic optimizations described in the packet capture literature (e.g., kernel-level filtering and buffering, context switch mitigation, partial packet copy), plus some original ones, like JIT filter compilation and kernel-level statistic processing. For these reasons, WinPcap outperforms other comparable approaches.
3. Popular.
WinPcap is used as the network interface by many tools -both free and commercial including protocol analyzers, network monitors, network intrusion detection systems, sniffers, traffic generators, network testers, etc. Some of these tools, like Wireshark, Nmap, Snort, WinDump, ntop are very well known in the networking community. WinPcap is downloaded thousands of times every day.
4. Tested and Reliable.
Many users have contributed over the years in testing WinPcap on a wide range of platforms, and in finding the most subtle bugs. WinPcap developers are experienced Windows driver writers, and their approach to software development emphasizes rock-solid stability. Remember: a buggy driver means blue screens.
5. Easy to use for the final user.
WinPcap is distributed as a single small executable that runs on every supported operating system. You launch the executable, and from that moment Windows is able to capture and send raw network traffic. It couldnt be easier.
6. Easy to use for the programmer.
Every version of WinPcap comes with a developers pack that includes documentation, libraries and include files needed to immediately start with your own new application. The developers pack contains a set of sample programs ready to be compiled both with Visual Studio and Cygnus, and are available as excellent starting points.
7. Multi-platform.
WinPcap is actively maintained on Windows NT, Windows 2000, Windows XP and Windows Server 2003. WinPcap can also work on Windows 95, Windows 98 and Windows ME, but these OSes are not maintained any longer. Windows Vista has a preliminary support, with some features disabled.
8. Portable.
WinPcap is completely compatible with libpcap. This means that you can use it to port your existing Unix or Linux tools to Windows. This also means that your Windows applications will be easily portable to Unix.
9. Well documented.
The WinPcap manual documents the API and the internals in an easy-to-follow hyperlinked manner. The documentation includes a tutorial that takes you step-by-step through all of the features of WinPcap.
10. Commercially Supported
Are you interested in professional WinPcap support? Do you want a phone number to call when something goes wrong? Do you need help in developing your low-level network code? CACE Technologies can help you!
WareSeeker Editor
WinPcap - WinPcap is the industry-standard tool for link-layer network. WinPcap. WinPcap is the industry-standard tool for link-layer networkCACE Technologies - WinPcap will allow programs to capture and transmit network packets bypassing the protocol stack. WinPcap. WinPcap will
WinPcap is popular among many users as a professional industry-standard tool for link-layer network access in Windows environments that allows applications to capture and transmitCACE Technologies - WinPcap is the industry-standard tool for link-layer network access in Windows environments. WinPcap. WinPcap is theWinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocolCACE Technologies - WinPcap will allow programs to capture and transmit network packets bypassing the protocol stack. WinPcap. WinPcap is the industry-standard tool for
WinTcpSpy 1.0.2
WinTcpSpy is a TCP packet sniffer. more>> WinTcpSpy is a TCP packet sniffer. It identifies processes that sends TCP packets (Winpcap does not do it !).
You can activate/deactivate service providers capture. Each send/receive message is displayed in a table.
This is a complete install/uninstall setup. It has only been tested on Windows XP. Welcome to test on Windows 2000, NT 4.0 and Me.<<less
It identifies processes that sends TCP packets (Winpcap does not do it !). You can activate/deactivate service providers capture. Every send and receive message will be displayed in a tableLicense:Freeware
WebVideoCap 1.37
This utility allows you to capture .flv (Flash Video) files and RTSP streams while the Web browser download and play them inside a Web page. more>>
WebVideoCap can capture the video files of most popular video-sharing sites, including YouTube, Google Video, Yahoo Video, iFilm, Metacafe, Putfile, and more...
Major Features:
- Currently, WebVideoCap can only capture the following types of video streams:
- Flash video files (with .flv extension).
- Microsoft Windows media files (with .wmv extension).
- RTSP streams. (RTSP protocol is used by many news and live TV/radio Web sites)
- MMS streams. (MMS protocol is used by many news and live TV/radio Web sites)
Be aware that WebVideoCap cannot capture streams of RTMP protocol. Support for more types of video or audio streams may be added in future versions.
- While capturing RTSP/MMS streams, WebVideoCap save the video raw data into the file in a format that you won't be able to play it. Only after you press the 'Stop Capture' button, the captured .wmv file is converted into a format that will allow you to play it with a Video player.
- If you use the Windows Media Player to play a video file captured from RTSP/MMS stream, you won't be able to move it forward or backward.
- If the video file is already saved in your browser's cache, WebVideoCap won't be able to capture it. However, in that case, you can retrieve the cached video file by using the VideoCacheView utility. Alternatively, you can simply clear the cache of your Web browser, and then reload the video Web page.
Enhancements:
- Fixed bug: WebVideoCap crashed on some mms/RTSP streams.
Requirements:
- This utility works on Windows 2000/XP/2003/Vista. Older versions of Windows are not supported. Be aware that under Windows 2000/XP, WebVideoCap can only capture the video files if you log on as a user with admin rights.
- In order to use WebVideoCap under Windows Vista with SP1, you must download and install the WinPcap driver, and select the WinPcap driver as the capture method.
WareSeeker Editor
Nmap 4.75
Uses raw IP packets in novel ways to determine what hosts are available on the network more>> Uses raw IP packets in novel ways to determine what hosts are available on the network
The name Nmap stands for Network Mapper. Nmap was designed to be a free utility for network exploration or security auditing.
Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.
It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and both console and graphical versions are available.
Main features:
- Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, version detection, ping sweeps, and more. See the documentation page.
- Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.
- Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.
- Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.
- Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.
- Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, and tutorials. Find them in multiple languages here.
- Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list.
- Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.
- Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities.
System requirements:
- WinPcap 4.x+
Enhancements:
- [Zenmap] Removed services.dmp and os_dmp.dmp and all the files that referred to them. They are not needed with the new search interface. Also removed an unused search progress bar. And some broken fingerprint submission code.
- [Zenmap] Added "%F" to the Exec link in the new Zenmap desktop file. We expect (hope) that this will allow dragging and dropping XML files onto the icon.
- [Zenmap] The -o[XGASN] options can now be specified, just as you can at the console.
- [Zenmap] You can now shrink the scan window below its default size thanks to NmapOutputViewer code enhancements.
- [Zenmap] Removed optional use of the Psyco Python optimizer since Zenmap is not the kind of CPU-bound application which benefits from Psyco.
- [Zenmap] You can now select more than one host in the "Ports / Hosts" view by control-clicking them in the column at left.
- [Zenmap] The profile editor now offers the --traceroute option.
- Zenmap now uses Unicode objects pervasively when dealing with Nmap text output, though the only internationalized text Nmap currently outputs is the users time zone.
- Unprintable characters in NSE script output (which really shouldnt happen anyway) are now printed like xHH, where HH is the hexadecimal representation of the character.
- Nmap sometimes sent packets with incorrect IP checksums, particularly when sending the UDP probes in OS detection. This has been fixed. Thanks to Gisle Vanem for reporting and investigating the bug.
- Fixed the --without-liblua configure option so that it works again.
- In the interest of forward compatibility, the xmloutputversion attribute in Nmap XML output is no longer constrained to be a certain string ("1.02"). The xmloutputversion should be taken as merely advisory by authors of parsers.
- Zenmap no longer leaves any temporary files lying around. Nmap only prints an uptime guess in verbose mode now, because in some situations it can be very inaccurate.
ViperChat 2.25.4
ViperChat - Realtime, Scriptable LAN Chat System using WinPcap and Lua more>>
It uses UDP communication over WinPcap packet capture drivers. Can be extended using Lua 5.0 programming language.
Possibility to listen the chat traffic without connecting (logging in) to any channel; Integrated Lua script editor with syntax highlighting;
Main features:
- Fast multithreaded application.
- Allows unlimited number of identities to be created in a single instance of running software, including Nick name, IP address, MAC address and all other user info requested by Vypress Chat protocol. Each of these identities act as a different user on chat.
- Allows unlimited number of running instances on the same UDP port, it can also run in parralel with Vypress Chat on the same port.
- Powerful scripting language based on Lua 5.0, with extensions specific to Vypress Chat environment (receiving events, message sending functions, user list and indentities information access).
- Modern flat user interface.
- Allows users full access to the visual interface (message colors, emoticons, etc).
Enhancements:
- New channel dialog
- 2 channel modes
- macro menu
- few bugfixes
ViperChat 2.25.4ViperChat 2.25.4 Realtime, Scriptable LAN Chat System using WinPcap and Lua 5.0 ViperChat 2.25.4 - Electriczbif ViperChatElectriczbif - It uses UDP communication over WinPcap packet capture drivers. ViperChat. ViperChat 2.24.1 is a useful software which is used as a multithreading, scriptableVOIP Caller-ID Speak 1.0
You can use this application whenver you want it it speak Caller ID, and Call-Waiting Caller-ID. more>> You can use this application whenver you want it it speak Caller ID, and Call-Waiting Caller-ID.
VOIP Caller-ID Speak is a talking Caller-ID for your VOIP phone! No VOIP settings to configure or setup, everything is configured automatically. You just select the network card which is connected to the internet. This software will work for softphones, but also for ATA/Router based hardware VOIP phones.
The program does not have to run on the computer with your VOIP softphone!
It can run on any computer on the network, which shares the same internet connection as your VOIP softphone, or hardware VOIP phone.
In order for the program to work with hardware based VOIP ATA/Routers, the program must be running on a computer which is on the WAN (internet) side of the VOIP router. One example setup would be; you have a Wireless Router, and it directly connects to your dsl or cable internet at your house, and your VOIP ATA/Router WAN port is connected to the output of your wireless router, with the correct ports forwarded to your VOIP ATA/Router.
Main features:
- Speaks Caller ID, and Speaks Call-Waiting Caller-ID.
- Will works on any computer on the network.
- Will work on multiple computers simultaneously.
- No VOIP settings to configure or setup.
- Works for any VOIP service.
System requirements:
- WinPcap
EnjoiPacket 1.80
EnjoiPacket its a software for capturing network packet with Winpcap more>>
Also you can save the data as TCPDUMP format. Besides, you can modify the collected packets and resend.
Wireshark 1.1.0
A free network protocol analyzer for Windows and Unix more>> A free network protocol analyzer for Windows and Unix
The Ethereal network protocol analyzer has changed its name to Wireshark.
The name might be new, but the software is the same. Wiresharks powerful features make it the tool of choice for network troubleshooting, protocol development, and education worldwide.
Wireshark was written by networking experts around the world, and is an example of the power of open source
Wireshark is used by network professionals around the world for analysis, troubleshooting, software and protocol development and education.
The program has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. Its open source license allows talented experts in the networking community to add enhancements.
Main features:
- Data can be captured "off the wire" from a live network connection, or read from a capture file.
- Wireshark can read capture files from tcpdump (libpcap), NAIs Sniffer (compressed and uncompressed), Sniffer Pro, NetXray, Sun snoop and atmsnoop, Shomiti/Finisar Surveyor, AIXs iptrace, Microsofts Network Monitor, Novells LANalyzer, RADCOMs WAN/LAN Analyzer, HP-UX nettl, i4btrace from the ISDN4BSD project, Cisco Secure IDS iplog, the pppd log (pppdump-format), the AG Groups/WildPackets EtherPeek/TokenPeek/AiroPeek, or Visual Networks Visual UpTime. It can also read traces made from Lucent/Ascend WAN routers and Toshiba ISDN routers, as well as the text output from VMSs TCPIPtrace utility and the DBS Etherwatch utility for VMS. Any of these files can be compressed with gzip and Ethereal will decompress them on the fly.
- Live data can be read from Ethernet, FDDI, PPP, Token-Ring, IEEE 802.11, Classical IP over ATM, and loopback interfaces (at least on some platforms; not all of those types are supported on all platforms).
- Captured network data can be browsed via a GUI, or via the TTY-mode "tethereal" program.
- Capture files can be programmatically edited or converted via command-line switches to the "editcap" program.
- 602 protocols can currently be dissected
- Output can be saved or printed as plain text or PostScript.
- Data display can be refined using a display filter.
- Display filters can also be used to selectively highlight and color packet summary information.
- All or part of each captured network trace can be saved to disk.
System requirements:
- WinPcap 4.x
Enhancements:
- The following vulnerabilities have been fixed:
- The NCP dissector was susceptible to a number of problems, including buffer overflows and an infinite loop. Versions affected: 0.9.7 to 1.0.2
- Wireshark could crash while uncompressing zlib-compressed packet data. Versions affected: 0.10.14 to 1.0.2
- Wireshark could crash while reading a Tektronix .rf5 file. Versions affected: 0.99.6 to 1.0.2
- The following bugs have been fixed:
- 802.11 WPA/WPA2-PSK Unable to decode Group Keys. (Bug 1420)
- Packets could wrongly be dissected as "Redback Lawful Intercept" (Bug 2376)
- MIKEY dissector improvements (Bug 2400)
- tvb_get_bits{16|32} could read past the end of a tvbuff (Bug 2439)
- Incorrect wslua function names. (Bug 2448)
- Memory corruption in wslua. (Bug 2453)
- Unknown PPPoE TAGs which are present in a PPPoE discovery packet are not displayed under "PPPoE Tags" subtree/section. (Bug 2458)
- Following a TCP stream could incorrectly reassemble packets. (Bug 2606)
- SIP decode shows fully expanded "Content-Length" header instead of compact form. (Bug 2635)
- Segmentation fault loading trace containing NCP packets. (Bug 2675)
- SIP packets might incorrectly be displayed as malformed. (Bug 2729)
- RTCP BYE padding interpreted incorrectly. (Bug 2778)
- Reversed RTP stream is saved as silent .au file, forward stream saves correctly. (Bug 2780)
- Fix some lint warnings. (Bug 2822)
- Setting a duration on a capture file would capture for an extra second.
SwitchSniffer v0.8.3
SwitchSniffer is a program that can pull, collect all packets and can route them without other users recognition on the LAN. If you run this program and any sniffer program, you can even get and see a more>>
SwitchSniffer is a program that can scan computers alive and can pull, collect all packets and can route them without other users recognition on the LAN. It can also detect arpspoofer program running on the network and block sessions like firewall. If you run this program and any sniffer program, you can even get and see all user ids/passwords on the switch network.
1.1 features:
-.It can pull and collect all the packets on the LAN.
-.It can scan and show the active hosts on the LAN within a very short time.
-.While spoofing ARP tables, it can act as another gateway (or ip-forwarder) without other users recognition on the LAN.
-. It can collect and forward packets by selecting inbound, outbound, and both to be sent to the Internet.
-. An ARP table is recovered automatically in a little time (about 30 seconds). But, this program
can keep spoofing continuously with a periodic time.
-. Although one or more network interface cards are installed on a computer, this program can
scan and spoof by selecting one of NICs.
-.It can get traffic information about the amount of data transferred to and from the internet including I session information.
-. It can detect which computer is running an arpspoofer program on the local network.
-. It can scan all hosts automatically on the network.
-. It has a feature which filters or blocks sessions, local hosts and remote hosts.
-. No more installation of winpcap driver.
1.2 Benefits:
-.It can find out the hidden hosts on local area network.
-.It can check out if abnormal hosts are connected on the wireless network.
-.It protect your network from abnormal users.
-.It can check out if there are abnormal packets on the local network.
-.It can view users/passwords, chat sessions and web sessions etc., on the switch network by other application.
Schnauzer 1.0
A Windows based packet sniffer for displaying IP packets in promiscuous mode more>> A Windows based packet sniffer for displaying IP packets in promiscuous mode
The Schnauzer application was designed to be a Windows based packet sniffer for displaying IP packets in promiscuous mode. This needs WinPcap to be installed on the machine.
Version restrictions:
- WinPcap
ARPing 2.0.6
Sends ARP and/or ICMP requests to the specified host and displays the replies more>> Sends ARP and/or ICMP requests to the specified host and displays the replies
The ARPing application was designed to send ARP and/or ICMP requests to the specified host and displays the replies. The host may be specified by its hostname, its IP address, or its MAC address. One request is sent each second.
When pinging an IP an ARP who-has query is sent. When pinging a MAC address a directed broadcast ICMP Echo request is sent.
System requirements:
- First you need to setup Winpcap on Cygwin.
- You will also need Libnet 1.1.3:
GNS3 0.3 Beta
Design complex network topologies and to launch simulations on them. more>>
Main features:
- Designing high quality complex network topologies.
- Emulating Cisco routers.
- Simulating simple Ethernet, ATM and Frame Relay switches.
- Load-balancing between multiple hypervisors.
- Load and save in Dynagens INI-like format.
- Image export (JPEG, PNG, BMP and XPM).
System requirements:
- Dynamips 0.2.8 RC1
- WinPCAP 4.0.1
NetBoar 1.371b
This tool will allow you to visualize the network traffic, displaying its summary. more>>
NetBoar will sniff all the traffic on from your network connection, and display a summary on your screen.
You?ll see several ?known? protocols, with the option to see every single TCP/UDP port used.
Protocols are also color-coded to see them at a glance. NetBoar will let you select only special kinds of traffic, writing BPF filters.
The syntax may be found in any libpcap main page. Also some pre-set filters can be found in NetBoar. As you will realize, lists are always sorted backwards from high volume traffic.
System requirements:
- .Net Framework 2.0
- WinPcap
CartoReso 0.31
A free and open source network mapping software. more>> A free and open source network mapping software.
The CartoReso application was designed to be a free and open source network mapping software. It has been designed to rapidly analyze and scan very large networks.
The results are displayed on a map with interesting information (IP address, MAC address, OS, open/filtered/closed TCP ports...) for each host found in the analyzed network.
How to use CartoReso? Very simple: CartoReso is distributed as an application which can be launched directly from Windows. You can also easily build the sources on Linux and there is also an ISO file you can burn on a CD. Boot your computer on the CD and enjoy! You dont need to be a network administrator to set it up. One click is enough to run the analysis! The networks to analyze will be automatically detected. If you want, you can set up several parameters too, like the level of aggressiveness, the networks to scan and map, time limits, etc.
Five strategies can be used for the scan, depending on the wanted accuracy and speed. The passive one only listens to what the computer receives and it does not generate traffic on the network. On the contrary, the other strategies send IP packets in order to determine the presence of other hosts on the network: it can be basic (ICMP and Traceroute [UDP] only) or more aggressive regarding the number of ports to scan.
System requirements:
- WinPcap
-
SUMI Anonymous P2P 0.8.15
SUMI is a new file sharing program that aims for total anonymity for the uploader more>>
Features
Anonymous serving with adjustable source addresses
No proxies needed = no slow down
Resuming
Cross-platform client GUI
Open source
UDP, ICMP direct, ICMP echo modes (use any pingable host as a proxy)
Integrate with mIRC, xchat, AIM, or Tor
XDCC-like server file listing
Optional raw socket proxy and raw socket priviledge seperation program for better security
Strong Cryptography
Torrent-like .sumi files (in 0.8.13 or newer)
[edit]News
2005-09-15: Summer is over. Development will proceed slowly as I will no longer have all day to work on SUMI. Sorry. Feedback is, as always, appreciated. Interested programmers even more so. I will be back... --Shellreef 06:46, 16 Sep 2005 (BST)
P.S.: The (unreleased) code in Subversion adds scripting support and the allows the client to join multicast groups.
2005-09-12: 0.8.14 is out, featuring: more bugfixes, CRC-32 in every packet, SHA-1 for file verification, and an improved uninstaller. This is the first release with the source code in Subversion. Due to the CRC-32 and SHA-1, the protocol is backwards-incompatible, so youll need to upgrade in order to access the sample servers.
2005-09-01: 0.8.13 released, notably featuring:
Many bugfixes
Torrent-like .sumi files--see sample files above
WinPcap is included with installer to simplify installation
modirclib is back, with full crypt_req support
Drag-and-drop support (can drop a .sumi file onto the sumigetw window to open it)
GUI enhancements: upgraded to wxPython 2.6.1.0, add context-menu options to resume and abort
Additionally, the Tor and irclib sample SUMI servers are back up.
2005-08-30: Moved SUMI Wiki to BerliOS. Lets hope it is faster...
2005-08-27: Created this Wiki, powered by MediaWiki, hosted on SourceForge
2005-08-25: Temporarily shutdown the sample server due to MTU/MSS incompatibilities introduced in CVS. Will be restored with next release.
2005-08-21: 0.8.12 released! Featuring full file data encryption, and the ability to use Tor (http://tor.eff.org/) as a transport. A sample server should be up soon.
2005-07-31: 0.8.11 is now out, with sharing integrated within the GUI and optional request encryption
2005-07-02: 0.8.10 released, featuring Windows 95/98/Me sumiserv compatibility, UDP checksums, optional Ethernet address spoofing, a better transport plugin mechanism for sumiserv, and AIM support in sumiserv.
2005-06-20: development resumed
2005-06-15: #sumi moved to irc.xtc-dreams.com and after many months, the sample SUMI server sumi-00 is back up.
Using a NAT? As of v0.8.5, a new program, rawproxd is included to run on NATs (particularly the WRT54GS) to enable SUMI serving.
Limitations: None
