How does an application like Wireshark work?

Im am wondering how 开发者_JS百科wireshark functions. What would be the design of an application that could listen to the traffic on all ports of a given machine? What is the kind of overheard that such an application generates? What would be a good way to go about writing an app that monitors traffic?

Thanks

Wireshark leverages libpcap on unix platforms and its port WinPcap on Windows. This library provides an API to capture packets (Wireshark is also able to capture frames but I haven't found in pcap docs that pcap is able to do that).

How the library does that is platform-specific, that's why a good way would be to use the library to do the heavy lifting for you; libpcap or tcpdump on unix (depending on how low-level you need it to be) and WinPcap or Windows Filtering Platform on Windows.

Documentation: http://www.tcpdump.org/pcap3_man.html http://www.winpcap.org/docs/docs_412/html/main.html

One way would be to use the Windows Filtering Platform (this is for Vista+, but a similar feature was possible in XP- - the WFP just makes things easier). The WFP lets you listen to "callouts" in the driver that call your code at various points in the packet-processing stack so that you can capture, filter, and even modify the data as it moves around.