0

I'm looking to write a quick program to read and inspect packets of a certain format and then blacklist ips with a certain style of packet-traffic (packet patterns of an attack against the network). Are there decent samples of reading and inspecting packet flow on a network?

franz
  • 11
  • 1
  • 3

3 Answers3

1

Instead of writing your own program you might consider using WireShark, which can collect packets and filter data to identify certain patterns.

Justin Ethier
  • 131,333
  • 52
  • 229
  • 284
  • It doesn't seem overly easy to interface with Wireshark though. Since I'd like this to be automated, I'm not sure how feasible that would be.. Maybe I've just never seen that done though. – franz Apr 06 '10 at 15:56
0

There's a related question here:

Which .NET library / wrapper do you recommend for sniffing packets?

Id have to suggest though, implementing software monitoring is almost guaranteed to add a bottleneck to your network, and there are plenty of existing hardware solutions.

Community
  • 1
  • 1
Russ Clarke
  • 17,511
  • 4
  • 41
  • 45
0

Wireshark, on Windows at least, uses libpcap. You could try that.

Also, if you're using Windows, I know several apps that use the Windows firewall stuff to remove themselves from a blacklist, so going the other way should be possible.

This is a lot easier on Unix... ;-P

Nate
  • 484
  • 3
  • 6