Re: c# sniffer filter

Volodymyr M. Shcherbyna wrote:
Hello,

There are many ways of traffic interception. But in general, the most popular techniques are the following. In user mode: LSP component. In kernel mode: filters for TDI or NDIS layer.

For sure writing a device driver in C# is impossible [for now of course, Singularity is coming ;) ] . However, you can struggle with writing an LSP in C# and .NET framework. This will require much work on P/Invoke API functions and marshalling structures. I do not recommend to do it in managed environment. C++ and unmanaged world is more preferable way to solve this task. If your project is purely managed, you can take a look into direction of making a small C++ LSP which is communication with managed applications regarding the rules, etc.

Thank you, this solves my problem.
i 'll look into unmanaged c++ way.
.

Relevant Pages

  • Re: What driver i have to develope
    ... Maybe LSP in user mode with be enough for your? ... > 2) To filter URL's ... > What driver i have to develope? ...
    (microsoft.public.development.device.drivers)
  • Re: WinSock function hook?
    ... Writing and debugging ... LSP would take a lot of time. ... you can simply hook import table of ...
    (microsoft.public.win32.programmer.networks)