Hi.

I'm prone to hire coders to build things I need.  But first, I need to
know the complexity of what I'm considering.

I'd like to hire one to build a tool that can extract (but not modify
or intercept) information from the TCP/IP traffic of other
applications.


Examples (for the sake of explanation)...

--) Maybe a perl script that logs all POP3 traffic

--) Maybe a java applet that logs all incoming traffic on port 80

--) Maybe a C applet that logs all DNS traffic.


There are MANY ways to accomplish the three things I listed.  But it's
not the examples I'm after -- it's the knowledge of how complex a
"listener application" must be to be able to "hear" the TCP/IP traffic
of another application.

I understand that perl and java may be too high-level to be
appropriate for port-listening.

Here are some elements of possible good answers...

--) It's very easy in C if you use this port-listening library
available at this URL...

--) This article talks about it and here's my brief summary/synthesis for you...

--) Listening to other threads' network traffic is a very tricky
process that will cost you a lot of money.  Here's some reasons why.

--) Perl and java can't listen to other threads' network traffic.

--) You do/don't need to write a device driver to listen to other
threads' network traffic.

--) The user of a port-listening application doesn't need to
reconfigure his network connection because...

Thank you.

Check out WinPcap, the Windows Packet Capture library
(http://winpcap.polito.it/). You can use it directly from C/C++, from
Python via Pcapy (http://oss.coresecurity.com/projects/pcapy.html),
from Perl via Win32::NetPacket (get it from CPAN), and from any COM or
ActiveX-capable language such as VB or VBA via the commercial PacketX
product from BeeSync (http://www.beesync.com/products.html).

I'm not one of Google's paid researchers, so you'll have to accept
this answer for free. :)

WinPcap can not only listen to all Ethernet traffic (including IP and
TCP) sent from or received by your Ethernet card, but can also put
most Ethernet interfaces into "promiscuous mode" and listen to other
traffic on the network segment. This technique is the basis for most
traffic analysers, including the open source packet sniffer Ethereal
(http://www.ethereal.com/), which relies on WinPcap on Windows
platforms.

Thanks for the excellent answer.  It's exactly what I'm looking for.

I've put in a recommendation to GA that you be a paid researcher.

Thanks again.