Unable to read incoming responses using raw sockets

I am trying to read a response from a website via code by listening to a raw socket, though so far I've only been able to read the outgoing requests sent by my computer rather than the incoming responses that I'm actually interested in. How might I go about reading the incoming responses?

EDIT: Using Wireshark I've come to find that the data I'm looking for is being sent via TCP, I believe.

Socket listener = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Unspecified);
IPAddress localIP = Dns.GetHostByName(Dns.GetHostName()).AddressList[0];
listener.Bind(new IPEndPoint(localIP, 0));
byte[] invalue = new byte[4] { 1, 0, 0, 0 };
byte[] outvalue = new byte[4] { 1, 0, 0, 0 };
listener.IOControl(IOControlCode.ReceiveAll, invalue, outvalue);
while (true)
{
    byte[] buffer = new byte[1000000];
    int read = listener.Receive(buffer);
    if (read >= 20)
    {
        Console.WriteLine("Packet from {0} to {1}, protocol {2}, size {3}",
            new IPAddress((long)BitConverter.ToUInt32(buffer, 12)),
            new IPAddress((long)BitConverter.ToUInt32(buffer, 16)),
            buffer[9],
            buffer[2] << 8 | buffer[3]
        );
    }
}

port 0 says he will listen on all ports, i think you need to set ProtocolType.Unspecified to ProtocolType.IP instead.

new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.Raw); is for ipv6 from what i read on msdn only ProtocolType.IP is supported for ipv4 with raw sockets.

Also im thinking this is a connectionless socket right? Reciveall wouldnt really have an affect unless thats the case. if youre after the ip header u can get it by setting up the code like this:

Socket sck = new Socket( AddressFamily.InterNetwork  , SocketType.Raw  , ProtocolType.IP);
   sck.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, true);

hope this helps :)

Joe Mattioni

I had a similar problem in my C++ program using basically the same raw sockets setup. In my case I can see incoming packets in the debug build, but not in a release build. Outgoing packets are seen in both builds. I'm not sending any packets in this program.

I'm building with VS2008 native C++ under Win7 x64.

My issue was with the firewall. When the project was created in VS it apparently put an "Allow" entry in the firewall for network access by the project build, but only for the debug build of the program.

I had to add another entry for the release build and this then allowed incoming packets. The advance firewall settings under Win7 can also cause specific protocols to be blocked, so if you're getting only partial incoming messages check those settings for your program's entry.

Today I was wondering how to do the exact same thing! Here is my code which now seems to work, credit for getting this working is due to fellow answerer 'Tom Erik' for suggesting ProtocolType.IP.

    static void Main(string[] args)
    {
        // Receive some arbitrary incoming IP traffic to an IPV4 address on your network adapter using the raw socket - requires admin privileges
        Socket s = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);
        IPAddress ipAddress = Dns.GetHostEntry(Dns.GetHostName()).AddressList
            .Where((addr) => addr.AddressFamily == AddressFamily.InterNetwork)
            .Where((addr) => addr.GetAddressBytes()[0] != 127)
            .First();
        s.Bind(new IPEndPoint(ipAddress, 0));
        byte[] b = new byte[2000];
        EndPoint sender = new IPEndPoint(0, 0);
        int nr = s.ReceiveFrom(b, SocketFlags.None, ref sender);
    }

来源：https://stackoverflow.com/questions/4840902/unable-to-read-incoming-responses-using-raw-sockets

标签

raw-sockets