pcap-sharp RC1

12 Replies to “pcap-sharp RC1”

1. Hey There Chris,

   Thanks for pcap-sharp – it seems to be exactly what I need. I am having some trouble using it though. I am working on Mono in Linux and I can compile a project with it but when I try to run the resulting binary, I always get an error like this:

   System.DllNotFoundException: libpcap.so
   at (wrapper managed-to-native) PcapSharp.PcapCall:pcap_findalldevs (intptr&,System.Text.StringBuilder)
   at PcapSharp.Pcap.FindAllDevices () [0x00000]
   [..snip..]

   Can you suggest why this might be happening or how I can fix it?

   Thanks,

   Mark.

2. This means either the pcap or pcap-dev packages aren’t installed for your particular platform. pcap-dev often provides a symlink from libpcap.so to some particular version of libpcap, like libpcap.so.0.9.8 on my box. You can solve this any number of ways:

   * Symlink libpcap.so to a versioned libpcap library.
   * Do the same, but put the symlink in your application directory.
   * Create a pcap-sharp.dll.config file. See http://www.mono-project.com/DllMap for information on doing this.

3. Ah! That worked a treat, thanks Chris. Does this mean that pcap-dev will be necessary for end-users to run the app?

4. Either require the -dev package or use a config dllmap to remap it to some specific version number. ABI-compatible libraries are supposed to have compatible old versions symlinked to a newer one, so you might dllmap it to libpcap.so.0.8 since that is the version I developed against. If a breaking change comes out then that symlink should not point to the ABI-incompatible library, and in fact should not exist, so your application will fail (as it should).

5. Ok thanks for the help. And thanks for distributing the lib.

   Last question I promise 😉

   IList devices = Pcap.FindAllDevices();
   foreach (InterfaceDefinition dev in devices)
   {
   MessageBox.Show(dev.Name);
   }

   I’m using the above code to list available interfaces but how can I lookup the ip address for each interface?

6. Currently you cannot. There are libpcap functions to do this but they use system structures like sockaddr_t to represent IP addresses, and I don’t want to get that platform-specific. I could use a glue library to do the dirty work but I wanted something simple and 100% managed, so I didn’t go that route.

7. I am curious… I am looking to write a small sniffer app (.net) and I need some library help with the network layer… I am seeing your project here and I wonder if you might help me understand how libpcap differs from winpcap and how your product is different than another I have seen sharp-pcap.

   I dont need a lot of power all I am doing is needing to 1. listen for arp packets on teh segment I am on… and 2 send out an arp packet for a given IP so I can get the mac.

   Could you comment on this perhaps?
   Thanks

8. winpcap is the Windows port of libpcap. They should have the same API and ABI.

   sharp-pcap is another project that wraps libpcap. It was a bit heavy for what I wanted to do, so I wrote a lighter wrapper. Note that mine does not fully wrap libpcap — specifically the parts that depend on host platform structures, like sockaddr_t.

   As for ARP, you may want to have a look at a few classes I wrote as part of an experimental C# packet parsing library. Take a look at the classes in https://layla.chrishowie.com/svn/SharpNet/SharpNet/ and have a look at https://layla.chrishowie.com/svn/SharpNet/SharpStack/ for an unfinished proof-of-concept library that implements a network interface in C#. In its current state it does full ARP processing and replies to ICMP echo requests.

9. Hey Chris,

   What exactly are the benefits of wrapping LibPcap instead of WinPcap in .NET?

   I’ve written a wrapper myself called Pcap.Net (available at http://pcapdotnet.codeplex.com/) that wraps almost all of WinPcap features and includes a packet parsing library and I’m not sure what am I losing by wrapping WinPcap instead of LibPcap.

   Thank you,

   Boaz.

   1. WinPcap is a suite of components that includes libpcap. The upshot is that it provides network drivers and an API-compatible libpcap that connects to those drivers. If properly coded, a wrapper around libpcap will work across platforms, including Windows.

      The primary advantage I can see to using pcap-sharp instead of Pcap.Net is that the latter library is managed C++, which is not portable. pcap-sharp is a pure managed library and so it will run on platforms where managed C++ is not supported, such as Linux.

10. Hi,

    In mac, I can not find libpcap.so, Chris can you give me some guide line to install libpcap.so please ?

    Thanks in advance.
    Thanks
    Alpesh

11. Alpesh: I don’t use OS X, so I can’t give you any specific direction. You will need to find a libpcap binary built for your platform in order to use the wrapper.

Comments are closed.