Windows Raw sockets capturing packets in wrong order

2k views Asked by At

I am developing a packet sniffer based on windows raw socket on windows 7. The program captures packet from IP layer. The issue i am facing here is, Program captures all packets but some of them are captured in wrong order, for eg. for a tcp connection establishment phase, instead of getting packets in SYN , SYN-ACK, ACK order i get it as SYN, ACK, SYN-ACK. Instead of capturing ACK after SYN-ACK(from remote), pgm gets ACK before SYN-ACK packet. Same thing is happening some times during data transfer phase also. Program captures the ACK packet of a data packet before the actual data packet. If i run a wireshark in parallel, it displays properly. I am using Visual Studio 2005 as the IDE.

#include "stdio.h"
#include "winsock2.h"
#include "ws2tcpip.h"
#include "pcap.h"
#include "MSTcpIP.h"

int main(int argc, char **argv)
{
    struct in_addr addr;
    int in, optval=1;
    struct hostent *local;
    WSADATA wsa;
    char *Buffer;

    //Initialise Winsock
    if (WSAStartup(MAKEWORD(2,2), &wsa) != 0)
    {
        printf("WSAStartup() failed.\n");
        return 1;
    }

    //Create a RAW Socket
    sniffer = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
    if (sniffer == INVALID_SOCKET)
    {
        printf("Failed to create raw socket.\n");
        return 1;
    }

    memset(&dest, 0, sizeof(dest));
    memcpy(&dest.sin_addr.s_addr,argv[1], sizeof(argv[1]));
    dest.sin_family = AF_INET;
    dest.sin_port = 0;

    printf("\nBinding socket to local system and port 0 ...");
    if (bind(sniffer,(struct sockaddr *)&dest,sizeof(dest)) == SOCKET_ERROR)
    {
        printf("bind(%s) failed.\n", inet_ntoa(addr));
        return 1;
    }
    printf("Binding successful");

    //Enable this socket with the power to sniff : SIO_RCVALL is the key Receive ALL ;)
    j=1;
    printf("\nSetting socket to sniff...");
    if (WSAIoctl(sniffer, SIO_RCVALL, &j, sizeof(j), 0, 0, (LPDWORD) &in , 0 , 0) == SOCKET_ERROR)
    {
        printf("WSAIoctl() failed.\n");
        wprintf(L"IOCTL failed with error %d\n", WSAGetLastError());
    if (WSAIoctl(sniffer, SIO_RCVALL, &j, sizeof(j), 0, 0, (LPDWORD) &in , 0 , 0) == SOCKET_ERROR) {
            printf("Failed again\n");
            wprintf(L"IOCTL failed again with error %d\n", WSAGetLastError());
        return 1;
    }
    }
    printf("Socket set.");
    if(setsockopt(sniffer, IPPROTO_IP, IP_HDRINCL, (char *)&optval, sizeof(optval))==SOCKET_ERROR)
    {
        printf("failed to set socket in raw mode.");
        return 0;
    }
    char *Buffer = (char *)malloc(65536); //Its Big!65536
    do
    {
        mangobyte = recvfrom(sniffer , Buffer , 2000 , 0 , 0 , 0); //Eat as much as u can

        if(mangobyte > 0)
        {
            writeCaptofile(Buffer, mangobyte);  //write the captured packet to file in pcap format
        }
        else
        {
            printf( "recvfrom() failed.\n");
        }
    }
    while ((mangobyte > 0) && (!StopSniffing));
    free(Buffer);

    closesocket(sniffer);
    WSACleanup();
    return 0;
}
0

There are 0 answers