This is our old Q&A Site. Please post any new questions and answers at

Hello! Please help me deal with this problem. Need to analyze packets on a LAN in obtaining certain information to perform actions. Specifically, there is a computer network connected to it cisco ip phones and need to analyze packets SKINNY Protocol, which the phone communicates with the server. These packets arrive at port 2000 TCP protocol on the server. IP-address of the server such as, IP-address of the phone -, and the IP of the computer operator - My program is on the operator's computer. The problem is that my program can see only those packets that come from the server to the operator and vice versa. Packets that the server sends the phone and back, for some reason I can not see. Simply put, I need to make the program contained on computer 1, saw the packets that come from the computer 2 to computer 3. All computers on the same network, but in different subnets. Here's the source code. #include "stdafx.h" #define HAVE_REMOTE #include "pcap.h" #include <cstdlib> #include <iostream> using namespace std;

#pragma warning(push)
#pragma warning(disable:4035)
int Swap(int val)
    __asm mov eax,val;
    __asm bswap eax
#pragma warning(pop)

/* 4 bytes IP address */
typedef struct ip_address{
    u_char byte1;
    u_char byte2;
    u_char byte3;
    u_char byte4;

/* IPv4 header */
typedef struct ip_header{
    u_char  ver_ihl;        // Version (4 bits) + Internet header length (4 bits)
    u_char  tos;            // Type of service 
    u_short tlen;           // Total length 
    u_short identification; // Identification
    u_short flags_fo;       // Flags (3 bits) + Fragment offset (13 bits)
    u_char  ttl;            // Time to live
    u_char  proto;          // Protocol
    u_short crc;            // Header checksum
    ip_address  saddr;      // Source address
    ip_address  daddr;      // Destination address
    u_int   op_pad;         // Option + Padding

/* UDP header*/
typedef struct udp_header{
    u_short sport;          // Source port
    u_short dport;          // Destination port
    u_short len;            // Datagram length
    u_short crc;            // Checksum

/* prototype of the packet handler */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data);

int _tmain(int argc, _TCHAR* argv[])

pcap_if_t *alldevs;
pcap_if_t *d;
int inum;
int i=0;
pcap_t *adhandle;
char errbuf[PCAP_ERRBUF_SIZE];

    /* Retrieve the device list on the local machine */
    if (pcap_findalldevs_ex(PCAP_SRC_IF_STRING, NULL, &alldevs, errbuf) == -1)
        fprintf(stderr,"Error in pcap_findalldevs: %s\n", errbuf);

    /* Print the list */
    for(d=alldevs; d; d=d->next)
        printf("%d. %s", ++i, d->name);
        if (d->description)
            printf(" (%s)\n", d->description);
            printf(" (No description available)\n");

        printf("\nNo interfaces found! Make sure WinPcap is installed.\n");
        return -1;

    printf("Enter the interface number (1-%d):",i);
    scanf_s("%d", &inum);

    if(inum < 1 || inum > i)
        printf("\nInterface number out of range.\n");
        /* Free the device list */
        return -1;

    /* Jump to the selected adapter */
    for(d=alldevs, i=0; i< inum-1 ;d=d->next, i++);

    /* Open the device */
    if ( (adhandle= pcap_open(d->name,          // name of the device
                              65536,            // portion of the packet to capture
                                                // 65536 guarantees that the whole packet will be captured on all the link layers
                              PCAP_OPENFLAG_PROMISCUOUS,    // promiscuous mode
                              1000,             // read timeout
                              NULL,             // authentication on the remote machine
                              errbuf            // error buffer
                              ) ) == NULL)
        fprintf(stderr,"\nUnable to open the adapter. %s is not supported by WinPcap\n", d->name);
        /* Free the device list */
        return -1;

    printf("\nlistening on %s...\n", d->description);

    long netmask;
    bpf_program fcode;

    //Filter packets
    if (d->addresses != NULL)
        /* Retrieve the mask of the first address of the interface */
        netmask=((struct sockaddr_in *)(d->addresses->netmask))->sin_addr.S_un.S_addr;
        /* If the interface is without an address we suppose to be in a C class network */

    if (pcap_compile(adhandle, &fcode, "tcp port 2000", 1, netmask) < 0)
        fprintf(stderr,"\nUnable to compile the packet filter. Check the syntax.\n");
        /* Free the device list */
        return -1;

    if (pcap_setfilter(adhandle, &fcode) < 0)
        fprintf(stderr,"\nError setting the filter.\n");
        /* Free the device list */
        return -1;

     /* At this point, we don't need any more the device list. Free it */

    /* start the capture */
    pcap_loop(adhandle, 0, packet_handler, NULL);
    return 0;


/* Callback function invoked by libpcap for every incoming packet */
void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
    struct tm ltime;
    char timestr[16];
    ip_header *ih;
    udp_header *uh;
    u_int ip_len;
    u_short sport,dport;
    time_t local_tv_sec;

     * Unused variable

    /* convert the timestamp to readable format */
    local_tv_sec = header->ts.tv_sec;
    localtime_s(&ltime, &local_tv_sec);
    strftime( timestr, sizeof timestr, "%H:%M:%S", &ltime);

    printf("%s,%.6d len:%d\n", timestr, header->ts.tv_usec, header->len);

    /* retireve the position of the ip header */
    ih = (ip_header *) (pkt_data +
        14); //length of ethernet header

    /* retireve the position of the udp header */
    ip_len = (ih->ver_ihl & 0xf) * 4;
    uh = (udp_header *) ((u_char*)ih + ip_len);

    /* convert from network byte order to host byte order */
    sport = Swap( uh->sport );
    dport = Swap( uh->dport );

    /* print ip addresses and udp ports */
    printf("%d.%d.%d.%d.%d -> %d.%d.%d.%d.%d\n",


Thanks for the help

asked 08 Jan '11, 10:28

masterbloger's gravatar image

accept rate: 0%

This source code is irrelevant, you should read up on network capture setup and using tshark for your analysis.

If you insist writing your own code you should address the Wireshark developer mailing list.

permanent link

answered 08 Jan '11, 13:24

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 08 Jan '11, 10:28

question was seen: 3,520 times

last updated: 08 Jan '11, 13:24

p​o​w​e​r​e​d by O​S​Q​A