LibPCAP Based Network Applications

For MSDOS/djgpp only

• libpcap v1.6, 13 February 2014
  libpcap is a platform independant API for capture of network data from several types of link-layers. libpcap was originally developed at Lawrence Berkeley National Laboratory. The official tcpdump & libpcap site is here. They merged this DOS-libpcap version into the offical libpcap a few years back, but that has fallen a bit behind. The most up-to-date version is the one above.
  
  DOS-libpcap supports Ethernet only. Currently only packet-drivers are considered stable to use. However, preparation for directly accessing an Ethernet board is built-in; refer ./pcap/device16.c for 16-bit devices (pkt-drvr and NDIS2) and ./pcap/device32.c for 32-bit devices (3c509 etc.). Some drivers for old 3Com card are made using modifed Linux drivers. But since I've not hacked so close to any hardware level in years, these drivers are left here as an historical interested. There will probably not be any more 32-bit network-drivers coming any time soon.

• tcpdump v3.5, 24 February 2004
  tcpdump is a tool for network monitoring using libpcap to capture data. The original distribution is available at www.tcpdump.org. Changes include detailed analysis of NetBIOS, SMB, SNMP, DECnet and IPv6 protocols. It may write to file, stdout or directly to screen (with option -C) for faster tracing. It can also read and analyse dump-files at real pace to simulate original network rate. It prints data contents in hex and/or ascii.

  Figure 1: shows output of tcpdump -Cq ip
  See windump below for how to build a Windows version of tcpdump yourself.

• libnet v1.0.1, 10 March 2000
  A C library for portable packet creation. Written by Mike D. Schiffman. Original version available here. Libnet is an API to help with the construction and handling of network packets. It provides a portable framework for low-level network packet writing and handling (use libnet in conjunction with libpcap and you can write some really cool stuff). Libnet includes packet creation at the IP layer and at the link layer as well as a host of supplementary and complementary functionality. Libnet is very handy with which to write network tools and network test code. See the manpage and sample test code for more detailed information. Don't confuse this libnet with the djgpp/Winsock library or Perl module of the same name.

• libnids v1.13, 12 April 2000
  Libnids is a library for Network Intrusion Detection Systems. Little testing has been done on this DOS/djgpp port. Take care... The primary libnids site is PacketFactory. Original coders are Dug Song and Nergal.

• nettop v1.0, 10 April 2000
  This is a nice tool for showing summary of network activity. Total packets / bytes received, average packet size, sorted on most active link / network -layer protocols. Originally made for Linux by Scott Parish. Requires SLang screen library.

  

• ngrep v1.37, 11 April 2000
  A grep tool for filtering network data. Filter using regular expressions or the BPF filter language built into libpcap. Author is Jordan Ritter.

• IPtraf v2.2, 1 March 2001
  An advanced curses-based network monitor with features such as: TCP connection view, tcpdump style filter expressions,
  statistics per host etc. This program originally made for Linux by Gerard Paul Java. Note: this version doesn't have reverse address lookup.

  

• ntop v1.1, 28 April 2000
  ntop is a tool that shows the network usage, similar to what the popular top command on Unix does. Written by Luca Deri. Look here for more information and latest version.

• tcpflow v0.12, 28 April 2000
  Similar to tcpdump, but tcpflow reconstructs the actual data streams and stores each flow (session) in a separate file for later analysis. The tool is of limited use on DOS because of the very long filenames produced. A fix is under way. Made by Jeremy Elson. For the latest information on tcpflow, please go here.

• tcpshow v1.0, 28 April 2000
  tcpshow reads a raw tcpdump save-file and decodes headers and data of Ethernet, IP, ICMP, UDP and TCP packets. BPF filter expression can be used on packet stream. Made by Mike Ryan.

• tcpslice v1.2, 28 April 2000
  tcpslice extract pieces of and/or glue together tcpdump save-files. Copies to stdout all packets from its input file(s) whose timestamps fall within a given range. Author is Vern Paxson, of Lawrence Berkeley National Laboratory. The current version is available here.

• tcptrace v1.0, 19 July 2000
  tcptrace is a TCP connection analysis tool. It can tell you detailed information about TCP connections by sifting through dump files. Various dump file formats is supported. This version does not yet support plotting of graphs. Made by Shawn Ostermann. Check out http://jarok.cs.ohiou.edu/software/tcptrace/tcptrace.html for latest version.

For MinGW and/or Visual-C

• windump.zip February 2015
  tcpdump compiled using MSVC and a set of GNU makefiles for MinGW and Microsoft's Visual-C to compile it yourself if you want.
  These are some additional features I've hacked into it:
  • AirPcap for capturing raw IEEE-802.11 WLAN traffic.
    The interface option now alllows setting the AirPcap channel; e.g. windump -i5/3 selects device 5 and channel 3.
    A command like "c:\> start /size=600,1000 windump.exe -i5 wlan type mgt"
    gives something like this:
    
  • OpenSSL is used for TCP-header signature check, MD5 calculations, ESP/ISAKMP decoding etc. The tcpdump secret keys are set using options -E and -M.
  • Experimental plug-in support by Dustin Johnson.
    A simple no-op plugin is included in windump.zip. Refer \\ExampleDevice\#2 below.
  • Added option --color to print some parts of the protocol-trace in color. Colors are currently hard-coded in Win32/src/color_print.c.
  • Detailed interfaces information. A windump.exe -Dv print something like this:

          1: \\ExampleDevice\#2
             Descr: Example Device #2
             No network address
    
          2: \\ExampleDevice\#1
             Descr: Example Device #1
             No network address
    
          3: \\.\airpcap00
              Descr: AirPcap USB wireless capture adapter nr. 00
              No network address
              MAC-addr: 00:12:0E:11:C8:E4, MTU <failed>, link-type 802.11 Radio, UP?, 54Mb/s (AirPcap)
              Channel: 6, Encryption: OFF, name AirPcap Classic, USB bus, RX only, No ext-ant
              media: 802.11/b/g, band: 2GHz
    
          4: \Device\NPF_GenericDialupAdapter
              Descr: Adapter for generic dialup and VPN capture
              No network address
              MAC-addr: <failed>, MTU <failed>, link-type 802.3, UP?, 10Mb/s (NDIS-Wan)
    
          5: \Device\NPF_{7F56352E-EF2F-49F4-844C-BA1FA0105667}
              Descr: MS Tunnel Interface Driver
              No network address
              MAC-addr: 02:00:54:55:4E:01, MTU 1514, link-type 802.3, DOWN, 10Mb/s (NDIS)
    
          6: \Device\NPF_{8D3A23A7-9C6C-408B-A23B-6736F9E56510}
              Descr: Realtek 10/100/1000 Ethernet NIC
              Addr 0: 10.0.0.6 (mask 255.255.255.0)
              MAC-addr: 20:CF:30:90:56:99, MTU 4096, link-type 802.3, UP, 10Mb/s (NDIS)
    
          7: \Device\NPF_{37FC13D9-2F52-47CA-AB64-32B2B434C749}
              Descr: Realtek RTL8187 Wireless LAN USB NIC
              Addr 0: 10.0.0.5 (mask 255.255.255.0)
              MAC-addr: 00:18:4D:00:DE:76, MTU 1514, link-type 802.3 over Wireless LAN, UP, 54Mb/s (NDIS)
    
          8: \Device\NPF_{75451EE7-5145-471A-BAF5-124BE8439D10}
              Descr: WAN (PPP/SLIP) Interface
              Addr 0: 108.171.112.226 (mask 255.255.255.255)
              MAC-addr: <failed>, MTU <failed>, link-type 802.3, UP?, 0Mb/s (NDIS-Wan)
          

  • This windump also includes a resource section (with version information, but no Icon yet).
  • The capture count is shown in the console-title:
    
    So you can easily see the capture-count in the task-bar while windump is running in another shell or "background".
    You can launching it like this:
    

        c:\> start /min windump -i6 -ttt port 514

    to see only syslog at UDP (or TCP) port 514. Hence the otput is sent to a minimised console-window.