WinSniff is the application for capturing packets on the network. It displays all the packets that are transmitted on the local network and gives detailed information about each header in the packet. In order to keep it simple, I am not dealing with application-level protocols. If you are interested, you can add features to support various application-level protocols, such as SMTP, FTP, NETBIOS, and so forth.

How It Works

When your machine is on the network, packets with different destination assignments arrive. By default (when the network adapter is in normal mode), these packets are rejected by the network adapter because they are intended for a different host. But, if you want, you can receive these packets by putting the network adapter in promiscuous mode. In this mode, it will accept all the packets irrespective of the destination address.

Hence, you can analyse the packets transmitted on your network. This trick is used for network management to determine the network traffic and so forth. However, there is one problem here. You will receive the packets with different destinations if you are using a HUB because a HUB uses a broadcasting technique to transmit packets to all the hosts attached to it. However, if you are using a SWITCH (an intelligent device), you won't receive any packet sent to other hosts on the network. The best place to install this application is on the gateway, where you can keep track of incoming and outgoing packets.


First, you have to get the device list and then open the device in promiscuous mode. While opening the device, you also can specify the size of the packet and its time out value.

// Get all devices for capturing the packet

//Open device in promiscous mode
   hdev=pcap_open_live( devname[index],    //name of the device
                        65536,             //size ->Capture whole packet
                        1,                 //promiscuous mode
                        1000,              //read timeout

Once you have opened the device, you will receive all packets. If you are interested in a particular packet—for example, only QUAKE packets (port 27960), ARP packets (arp), and the like—you can specify the filter expression. To learn how to specify a filter expression, you can refer to the WinPcap documentation.

//compile the filter

//now set the filter

Once you have opened the device and set the filter, you are ready to receive the packets. Once the packet is received, the header contains the length, time, and other information about the packet. pkt_data contains the exact contents of the packet starting from the Ethernet header.

// Do whatever you want..

To analyze the packet contents, you must be familiar with various header formats. Mainly, you must know the format of the following headers: ETHERNET, ARP, IP,TCP, UDP, ICMP, and IGMP. I have included the protocol.h file that contains the format information about all these headers. If you want more details, you can refer RFCs for the respective protocols.

Once you have done the job, it's time to safely close the device.

//close the device...


You need Winpcap (Windows version of Libpcap: packet capturing library) to run this application. It can be downloaded from this location. It contains the setup file along with good documentation that explains capturing and sending packet in detail. I advise you to go through the WinPcap documentation before going through the source code.

Running the Application

When you run the application, the main window pops up. Click on the startcapture menu item to start the capture. It displays a dialog box; now, select the device. Packets will be displayed in the main window. Click on the packet to see more details. You can save any packet by clicking the SaveFrame menu item. Later, you can open this saved frame.

If you don't have a network adapter or are not on the network, I have included some sample packets in the SamplePackets folder in the source zip file. You can open these files and view their contents.

If you have any queries or suggestions, feel free to drop a mail at



Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • VMware vCloud® Government Service provided by Carpathia® is an enterprise-class hybrid cloud service that delivers the tried and tested VMware capabilities widely used by government organizations today, with the added security and compliance assurance of FedRAMP authorization. The hybrid cloud is becoming more and more prevalent – in fact, nearly three-fourths of large enterprises expect to have hybrid deployments by 2015, according to a recent Gartner analyst report. Learn about the benefits of …

  • Live Event Date: December 11, 2014 @ 1:00 p.m. ET / 10:00 a.m. PT Market pressures to move more quickly and develop innovative applications are forcing organizations to rethink how they develop and release applications. The combination of public clouds and physical back-end infrastructures are a means to get applications out faster. However, these hybrid solutions complicate DevOps adoption, with application delivery pipelines that span across complex hybrid cloud and non-cloud environments. Check out this …

Most Popular Programming Stories

More for Developers

RSS Feeds