dotpcap / sharppcap

Official repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
1.31k stars 267 forks source link

Packet manipulation #262

Open AcTiViSioN911 opened 3 years ago

AcTiViSioN911 commented 3 years ago

Hello. Is there any way to change the data of a packet before sending it? I could do it in Titanium Web Proxy, but it doesn't see tcp packets, only http. Sharppcap shows everything that wireshark sees, but I can't change the data ... am I doing something wrong, or is this not possible? Thank you.

maxlluky commented 3 years ago
var device = new WinDivertDevice();
// WINDIVERT_FLAG_DROP will cause the original packet to be dropped
// you can inject it back (after modifications) using `device.SendPacket()`
device.Flags = WINDIVERT_FLAG_DROP;
device.Open();
// You can use any Libpcap example as reference for receiving

WinDivert allows user-mode applications to capture/modify/drop network packets sent to/from the Windows network stack. In summary, WinDivert can:

If you want to block traffic, modify it and then send it forward, you need to implement the function of a router (a Proxy is a kind of Router). Such a programme would probably not be efficient.