analyze winpcap packet

[bimbim]

Hi,

I'm currently trying to get and analyze the packets received on the Ethernet lynk of my PC. I've found "WinPCap Labview 0_6" on the site and it seems to work well as far as I know.

As I'd like to  automize the analysis of the packets with LabVIEW, I have to be able to "traduce" the 152 characters length word provided by this VI (ex : 01005e00000700163857cf3208004560054cdaf800001b11fcf30a45c908ef0000070e4513890538e95f8021e400bbdc65a2d1575dc24701271ac2241d53c7d66854e36d8c0fb0ffa4fc8a24).

My knowledge concerning packet and everything around IP is poor so I'd be grateful if someone could help me to get the packet info from this word as Ethereal can do (source, destination, protocol, length, info).

Thank you in advance for your answer.

Bim

[unclebump]

Try here.

http://www.microsoft.com/technet/technetmag/issues/2005/05/HowITWorksTCPIP/default.aspx

http://www.networksorcery.com/enp/protocol/ip.htm

[bimbim]

Thank you for your links.

I'm still lost in this word, it seems like it will be longer than expected to understand the principle.

So, do you know if a dll can be called to provide the packet info as winpcap.dll is called for dumping?

I understand I'm leaving Labview issues but your help would be appreciated...!

Thank you in advance

Bim

[Ben]

Hi Bim,

I am only going to be off limited assistance here because I have to rely on my memory and I do not have time to go research this correctly.

I wrote one of the first Ethernet Sniffers about 16 years ago so some of that info stuck.

THe Ethernet packet was Source Destination Protocol in that order.

The source and destination were 6 (bytes) each and these should match up with the "Mac-address" of the senders and recievers.

The protocol was 2 (?) bytes.

After that I am fuzzy.

I believe it ended with a checksum.

If you post what you have so-far, I may have an opertunity to look at this this week-end (no promises!)

You may be very close to completing this part of the task now. I'd urge you to stick with your current approach.

Ben

Message Edited by Ben on 09-21-2006 12:49 PM

[bimbim]

Thank you Ben,

I 'll try to push things forward by myself now...

Thanks

Bim