Comments (6)
kayoub5
commented on June 9, 2024
1
To accomplish this on a process level, I need to interrupt communication and check packet content to understand the packet belongs to which process and redirect them to over proxy?
Yes
For this case, can I use WinDivert or WinPktFilter as your suggestion? But one more thing I read is that WinDivert is recognized as malware by the Windows Driver signing service. For expand it to other clients who don't know me will create a trust problem.
- It can be done with Npcap, WinDivert or WinPktFilter, but out of those three, WinDivert is the only fully open source one.
- Those libraries will provide the packet itself, and the means to alter it, but not the means to know to what process it belongs to.
Another solution you can try, is to perform Socket hooking, using for example https://github.com/thenameless314159/SocketHook
from sharppcap.
kayoub5
commented on June 9, 2024
Windows or Linux?
from sharppcap.
ErcinDedeoglu
commented on June 9, 2024
@kayoub5 For first stage, Windows
from sharppcap.
kayoub5
commented on June 9, 2024
@ErcinDedeoglu you usually can force the whole OS, by using a tuntap device and making a VPN from it.
Or use the WinDivert or WinPktFilter driver to alter packets.
Npcap can also be used to alter packets, but it requires some registry changes.
The most difficult part is figuring out what process each packet belong to.
from sharppcap.
ErcinDedeoglu
commented on June 9, 2024
Thank you, @kayoub5.
I was trying to reverse engineer what the ProxyCap application is doing. After you pointed to the registry change, I realized that ProxyCap made a couple of changes to the Windows registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000001] "PackedCatalogItem"=hex:70,63,61,70,77,73,70,2e,64,6c,6c,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,66,00,02,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,08,00,00,00,53,c1,b5,20,ee,1a,be,4c,bd,f1,0b,0e,e4,\ 4d,71,16,fa,03,00,00,02,00,00,00,f9,03,00,00,f1,03,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,00,02,00,00,00,10,00,00,\ 00,10,00,00,00,01,00,00,00,06,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,50,00,52,00,4f,00,58,00,59,00,43,00,41,00,50,00,20,\ 00,4d,00,53,00,41,00,46,00,44,00,20,00,54,00,63,00,70,00,69,00,70,00,20,00,\ 5b,00,54,00,43,00,50,00,2f,00,49,00,50,00,5d,00,00,00,2e,00,64,00,6c,00,6c,\ 00,2c,00,2d,00,36,00,30,00,31,00,30,00,30,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 "ProtocolName"="PROXYCAP MSAFD Tcpip [TCP/IP]"
As I can see, it's easy for device-level proxy, and there are a lot of examples, most of them open-source.
What I understand from your reply;
To accomplish this on a process level, I need to interrupt communication and check packet content to understand the packet belongs to which process and redirect them to over proxy?
For this case, can I use WinDivert or WinPktFilter as your suggestion? But one more thing I read is that WinDivert is recognized as malware by the Windows Driver signing service. For expand it to other clients who don't know me will create a trust problem.
Could you advise me for direction, please?
from sharppcap.
kayoub5
commented on June 9, 2024
@ErcinDedeoglu just out of curiosity, where did quest lead you?
did you ever get it to work?
from sharppcap.
Related Issues (20)
- How to capture and parse HTTP protocol packets HOT 1
- zerotier-one support
- SendPacket latency question HOT 7
- Question: Write to stream instead of file HOT 2
- Are there any examples of monitoring http or https? HOT 1
- Unable to load DLL 'wpcap' or one of its dependencies HOT 3
- IPv4 Length exceeds Packet Length during live device capture HOT 2
- get the packet info not from event HOT 3
- Libpcap 1.10+ rfmon not supported HOT 1
- Unable to get libpcap (and by extension sharppcap) to work on Ubuntu 20.04 HOT 8
- Timeval unchanged between captured packets in Example03 HOT 4
- Integration request. Are you interested? HOT 2
- Unable to load DLL 'wpcap' HOT 1
- wpcap.so: cannot open on linux build HOT 5
- CaptureFileWriterDevice.Write((RawCapture p) ignores PacketLength field HOT 4
- WinPcapDevice still in descriptions HOT 1
- Unable to activate the adapter (NpcapRemoteCapture Example) HOT 14
- New Nuget release
- SharpPcap.PcapException: 'Failed to open Error Code: 3)'
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sharppcap.