cocowalla/snifter

Snifter is a raw socket IP packet capturing library/app for Windows, with a tiny CPU and memory footprint

snifter's Issues

Split out functionality into a library [feature-request]

Split out the functionality into a library, so we'd have 2 projects: the library, and command line tool.

Library to go in NuGet.

Idea is that others could use the library for their own use cases.

The handle is invalid.

$ ./Snifter.App.exe --interface=8 --filename=foo.txt

Unhandled Exception: System.IO.IOException: The handle is invalid.

   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)
   at Snifter.App.Program.Main(String[] args)

Turn Snifter.App into a TUI

Pretty gratuitous enhancement, but it would be interesting to look at using Spectre.Console to turn Snifter.App into a TUI that shows more information.

Feature Request - time/packet count

Would it be at all possible to add a time to stop sniffing and packet count to stop sniffing option to this?

(Pretty much just the features from RawCap that I find pretty useful, especially when running the tool on a remote computer).

F:\Tools>RawCap.exe --help
NETRESEC RawCap version 0.1.5.0
http://www.netresec.com

Usage: RawCap.exe [OPTIONS] <interface_nr> <target_pcap_file>

OPTIONS:
 -f          Automatically flush data to file after each packet (no buffer)
 -c <count>  Stop sniffing after receiving <count> packets
 -s <sec>    Stop sniffing after <sec> seconds

https://www.netresec.com/?page=RawCap

Many thanks, love this tool!

Small issues PR?

Hey Coco, thanks for writing and sharing this, it rocks! You saved me from writing it, or trying to use rawcap.exe which requires a very difficult to install .Net Framework 3.5 package.
https://www.netresec.com/?page=RawCap

Anyway, during use I noticed a small nit or two, and I wonder if you are taking PR's?

To monitor both sides of a port 8096 conversation, I had to use: snifter -i 3 -x -24545 -y -24545

Cameron

[Bug] Regarding BitConverter and endianness

As we know, IP, TCP and UDP protocols are transmitted in big-endian order. But BitConverter Class is not always treat data as big-endian. Instead, they use machine endianness.

Quoted from MSDN:

Similarly, the order of bytes in the array and returned by the To_IntegerValue_ methods and the ToChar method depends on whether the computer architecture is little-endian or big-endian.

Although this is not matter in most scenarios where Snifter calls BitConverter. This will lead to problems on a little-endian machine using -x or -y filters (port filters) as port filters uses C# built-in equality operators.

Please use a big-endian converter instead of BitConverter in IPPacket.cs: L34-35. Note that IPAddress Class constructor assumes the Int64 value to be in network byte order, so that L29-30 should not be changed.

Monitor another IP within same network

Hi
Is it possible to monitor remote interfaces?