Make a network interface receive (hear) a packet

Question

I need to make Microsoft Loopback Adapter receive (hear) a packet using PcapDotNet or anything else. How can I do that?

Thanks.

I tried sending the packet on Microsoft Loopback Adapter itself, but it doesn't hear the packets sent from it. The question is: does it hear anything? — Ali Momen Sani, Mar 14 '13 at 22:12

score 3 · Answer 1 · answered Mar 14 '13 at 22:32

3

You can't use PCAP to capture packets from the loopback adapter on Windows. However, you can use a tool called RawCAP to do it and output a .pcap file instead (that you can open in WireShark: http://wiki.wireshark.org/CaptureSetup/Loopback).

answered Mar 14 '13 at 22:32

Garo Yeriazarian

2,533
18
29

Couldn't he send an `ICMP` from PCap, then use `NetworkInformation` Class in the application to do a ping to his local `127.0.0.1` to verify it? Or even just use `NetworkInformation` by itself to send a ping (ICMP) request? – Greg Mar 14 '13 at 22:34
If he's using PCAP, he's trying to sniff packets on the network. Most likely trying to debug some inter-process communications that are using a local socket. – Garo Yeriazarian Mar 14 '13 at 22:37
I don't know if he means Capture the packet? I just realized you said Capture, yeah if he did mean that your indeed correct. – Greg Mar 14 '13 at 22:37
I can sniff packets on MS Loopback Adapter using Wireshark. I need to make MS Loopback adapter receive a packet. – Ali Momen Sani Mar 14 '13 at 22:43

score 0 · Answer 2 · answered Mar 14 '13 at 22:31

Your question is not specific nor very detailed, so you'll receive a broad explanation. Microsoft .Net Framework 4.5 actually has a class exactly to handle this called NetworkInterface.

The Microsoft Developer Network actually explains in great detail these class requirements.

This particular class encapsulates data for Network Interfaces, also known as adapters, on the local computer. You do not create instances of this class; GetAllNetworkInterfaces method returns an array that contains one instance of this class for each network interface on the local computer.

So as you can see it requires semi specific details, otherwise it will fail. As it may try adapters that aren't connected. Your question leaves me to believe, your trying to ping a valid packet to your local adapter to verify there is a response.

You even have the NetworkInformation Namespace which provides a slew of related information. A very, very simple implementation would be like:

Ping pingSender = new Ping();
PingOptions options = new PingOptions();

// Default Time To Live (TTL) but don't fragment request.
options.DontFragment = true;

// Create a buffer of 32 Bytes:
string data = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
byte[] buffer = Encoding.ASCII.GetBytes(data);

// Timeout
int timeout = 120;

// Ping and Request Reply
pingReply reply = pingSender.Send(args[0], timeout, buffer, options);
if(reply.Status == IPStatus.Success)
{
     Console.WriteLine("Address: {0}, reply.Address.ToString());
     Console.WriteLine ("RoundTrip time: {0}", reply.RoundtripTime);
     Console.WriteLine ("Time to live: {0}", reply.Options.Ttl);
     Console.WriteLine ("Don't fragment: {0}", reply.Options.DontFragment);
     Console.WriteLine ("Buffer size: {0}", reply.Buffer.Length); 
}

And you can simply use that Ping request to 127.0.0.1 as that is the Loopback Address to your Network Card that is currently in use.

The reply will indicate if it is receiving your packet.

Yes, a Loopback should receive a response to know your card is in use. It can be disregarded in most cases though; as the address only will display useful information when you've received a request.

Your other option if you don't like the Ping idea. Is simply to set your NetworkInterface to listen for a change:

NetworkInterface[] adapters = NetworkInterface.GetAllNetworkInterfaces();
foreach(NetworkInterface n in adapters)
{
      Console.WriteLine("   {0} is {1}", n.Name, n.OperationalStatus);
}

Those are two valid ways to test for a response from your card. As I stated above, a Loopback won't actively "receive" anything unless you specifically send a request to the loopback address.

Hopefully that helps.

I think the problem is that a loopback adapter doesn't receive packets at all. Event if I ping the adapter I can't see that the Local Area Connection Status of that loopback adapter telling me that a single packet is received. — Ali Momen Sani, Mar 14 '13 at 22:47
Was it changed, some Network Administrators change them. As by nature in there industry `127.0.0.1` is actually bad practice they usually recommend I think `127.0.1.1` or `127.0.0.5`. Can't fully remember though. That way people don't flood the local adapter. — Greg, Mar 14 '13 at 22:56

Make a network interface receive (hear) a packet

2 Answers2