1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
|
void Capture_Packet()
{
UINT32 status = NO_ERROR;
UINT32 count_packet = 0;
unsigned long ip_src, ip_des;
HANDLE engineHandle = 0;
FWPM_FILTER filter = {0};
FWPM_FILTER_CONDITION filterCondition = {0};
status = FwpmEngineOpen(0,RPC_C_AUTHN_WINNT, 0,0,&engineHandle);
if(status != NO_ERROR)
{
goto EXIT;
}
filter.displayData.name = L"Capture packet";
filter.layerKey = FWPM_LAYER_INBOUND_IPPACKET_V4;
//filter.layerKey = FWPM_LAYER_OUTBOUND_IPPACKET_V4;
filter.action.type = FWP_ACTION_PERMIT;
filter.weight.type = FWP_EMPTY;
filter.filterCondition = &filterCondition;
filter.numFilterConditions = 0; // 0 capture all packet
//filterCondition.fieldKey = FWPM_CONDITION_ALE_PROMISCUOUS_MODE;
//filterCondition.conditionValue.type = FWP_UINT32 ;
//filterCondition.conditionValue.uint8 = ???
status = FwpmFilterAdd(engineHandle,&filter,0,&(filter.filterId));
if(status != NO_ERROR)
{
goto EXIT;
}
// in this case : network LAN using Proxy-Server or Web-Proxy
// filter engine at Server ( LAN++++++Server++++++Internet )
//capture all packet in LAN before the packet processing and forwarding to Proxy.
for (UINT32 i=0 ; i < count_packet ; i++)
{
// printf("Packet : %d from IP source : %s to IP destination : %s \n" ,i, inet_toa(ip_src) ????,inet_toa(ip_des) ????);
}
EXIT:
//FwpmFilterDeleteById(engineHandle,filter.filterId);
FwpmEngineClose(engineHandle);
}
|