Build your own Network sniffer

Recently, I ve been developing a tool to monitor the Network Traffic as an assignment. Here, I wish to share my experience with all of you who are interested in building your own Sniffer.

Prerequisites : Java Programming capability, Knowledge on OOP(Object Oriented Programming) basics


My Environment:

I used the libraries specified for Java which is widely available.
I ran my application on Windows XP only. But the libraries can be easily integrated with Linux based systems.
I used NetBeans 6.1 version for development activities. But any other java IDE would do

In setting up the environment, first you need to download Jpcap jar found at http://sourceforge.net/projects/jpcap
Once you download this, you have to add this to your NetBeans project.
It can be done as follows.


















After adding the Jar file to the project, you need to download the WinPCap driver. It can be easily downloaded from http://www.winpcap.org/
It is required to get low level networking access regarding packets.
As for Unix users, there is a version named libpcap which can be used instead.
NOTE: In running built applications, you must allow administrative rights for the programme. Otherwise the driver may not be able to get the necessary information. As for Unix users, you need to run your programme as superuser.

The capturing of packets can be done via a simple set of commands.
For the sake of simplicity, I would just present the most basic commands which would enable you to get up and running. The details of the commands are available at the Jpcap website's tutorial found at http://netresearch.ics.uci.edu/kfujii/jpcap/doc/tutorial/

Write a java file and include the following code on the main method and run the class.

---

NetworkInterface[] interfaces=JpcapCaptor.getDeviceList();

NOTE: Be careful when using the class for the first time. There is a class with the same name undet java.net package. So, be careful to use jpcap.NetworkInterface[] under the package jpcap.

By using the static method "getDeviceList()" of class "JpcapCaptor", you can get an array of NetworkInterfaces fixed on your computer. The number depends on the computer you have. In my case, I get only one.(The Ethernet interface). But in other computers, you might get more.

---

Then you need to open a selected interface to start capturing packets.
You can do it in the following manner

JpcapCaptor captor=JpcapCaptor.openDevice(interfaces[0], 65535, true, 20);

Here I'm passing the wanted NetworkInterface as the 1st element of the array returned(In my case I get an array of length 1). Please reffer to the tutorial for precise information on the other parameters.(It does not depend on the machine, so it should work on your machine as well)

---

captor.processPacket(-1, new PacketPrinter());

The above Line of Code is used in actually capturing the packet. It accepts two paramenters. The first one saying how many packets to capture. Here I have put -1 which would mean infinitely. That means, I keep on capturing packets indefinitely.

The next parameter is an object which needs to implement the interface "PacketReceiver", an interface which is defined by jpcap library.
This interface has one method with the method signature.

public interface PacketReceiver{

public void receivePacket(Packet packet);

}

You need to write a class which implements this interface. Thus you need to implement the method in your class.

Here is my example:

public class PacketPrinter implements PacketReceiver{

public void receivePacket(Packet packet) {
System.out.println(packet);
}
}

My class PacketPrinter just has one method, and I'm implementing the interface here.

---

Now, compile this code and run the application. You should get the description of all the packets captured on your Standard output.

---

Filtering packets can be done via the following Line of Code.

NetworkInterface[] interfaces=JpcapCaptor.getDeviceList();
JpcapCaptor captor=JpcapCaptor.openDevice(interfaces[0], 65535, true, 20);
captor.setFilter("tcp", true);
captor.loopPacket(-1, new PacketPrinter());
captor.close();

The above code can be used to filter TCP packets only. If you need only other packets except TCP packets, then you can state "false" as the second parameter above.

---

I'm sure, this is going to get to up and running with your development as soon as possible. It is up to you to develop a software GUI tool which would satisfy your needs. If you need any help please do not hesitate to mail me.
ruchiram4@gmail.com

The following displays the Tool I prepared. It has special filtering capabilities and Graph to show network traffic.










Due to the request of some, I would like to add some functioning code segment for this.

Please copy the following Classes and try to run the code.

---

/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/
package ruch.net;

import java.io.IOException;
import java.util.logging.Level;
import java.util.logging.Logger;
import jpcap.JpcapCaptor;
import jpcap.NetworkInterface;

/**
*
* @author Ruchira
*/
public class SnifferExample {

JpcapCaptor captor;
NetworkInterface[] interfaceList;

//Change this number according to the Network Interface which you wish to Sniff
private static final int interfaceNumber=1;

public static void main(String[] str) {
SnifferExample sniff=new SnifferExample();
sniff.printNetworkInterfaceList();
try {
sniff.capture();
} catch (IOException ex) {
Logger.getLogger(SnifferExample.class.getName()).log(Level.SEVERE, null, ex);
}
}


/**
* Run this method first and it will list out the available network interfaces in your computer
* All of the interfaces will be put into an array (interfaceList)
*/
public void printNetworkInterfaceList() {

interfaceList = JpcapCaptor.getDeviceList();

System.out.println("Number of Network Interfaces Found :"+interfaceList.length);

for (int i = 0; i < interfaceList.length; i++) {
System.out.println("Index :" + i + ", Network Device Name :" + interfaceList[i].name + ", Description :" +
" " + interfaceList[i].description);
}
}

public void capture() throws IOException {

captor=JpcapCaptor.openDevice(interfaceList[interfaceNumber], 65535, true, 20000);
captor.loopPacket(-1, new PacketPrinter());
}
}

---

/*
* To change this template, choose Tools | Templates
* and open the template in the editor.
*/

package ruch.net;

import jpcap.PacketReceiver;
import jpcap.packet.Packet;

/**
*
* @author Ruchira
*/
public class PacketPrinter implements PacketReceiver{

public void receivePacket(Packet pkt) {
System.out.println("Paket :"+pkt.toString());
}

}

---