Blizzhackers

Hi guys,

what options do i have to caputer packets from a certain process beside hooking the network functions of the process?

I tried to use WinPCap but at the moment i have an usb modem which is not supported by winpcap.

Any other options?

If you only want to capture packets, then you can just fire up Wireshark, do your thing, and then save out the capture.

Or if you need to do realtime packet capturing, then you have a few options:
Write a Winsock LSP (layered service provider) to do your capturing in software at the Winsock-level
Write a driver that interfaces with NDIS and do your capturing at the driver-level
Buy a hardware packet capturing device (pricey)

Or just use a send/recv hook. There's loads of fun methods of getting that working. By the way, what's your goal in doing this packet capturing?

I was just curious if there is another way to obtain the packet stream of a process.
Because when i try to capture packets with WPE Pro it doesnt catch the diablo 3 login packets. (WPE Pro hooks recv/send/sendto/recvfrom afaik). Maybe they load some kind of login module for the login process which isnt affected by the hook?


Sadly Wireshark uses WinPcap and so even wireshark doesnt work on my internet connection. It cannot find the USB modem.

Why are you trying to capture the D3 login packets? I think that the packet format for those is already documented somewhere.

Yes i know, i was just curious why the packets didnt show up on WPE Pro and if there is another possibility to capture them.

Run d3 in a vm with bridged network and capture the traffic from host to vm if you want to use wireshark with usb modem. (I think will work) does your usb modem not add a network device?

Try it in a Windows XP environment. I believe WinPcap has some limited functionality with certain PPP device capturing on x86 XP. I think it will translate it to some pseudo-ethernet dealio or something. Try Microsoft NetMon, too. It couldn't hurt. Otherwise, what DG2 said. Personally, I think a hardware sniffer is a good investment if you have the means to utilize it. I find mine useful.