Aufgabe 2 - FH Wedel - Studenten Homepages der FH-Wedel

2.2 Nutzung zusätzlicher Monitoring-Komponenten
Unter der nachfolgenden Adresse finden Sie eine sehr praktische Komponentenbibliothek für
das Netzwerk-Monitoring (u.a. Paketaufzeichnung) und zugehörige Beispielprogramme.
Magenta Systems Internet Packet Monitoring Components v1.3
Quelle: http://www.magsys.co.uk/delphi/magmonsock.asp
Magenta Systems Internet Packet Monitoring Components are a set of Delphi components
designed to capture and monitor internet packets using either raw sockets or the WinPcap
device driver. Hardware permitting, ethernet packets may be captured and interpreted, and
statistics maintained about the traffic. Uses of packet monitoring include totalling internet
traffic by IP address and service, monitoring external or internal IP addresses and services
accessed, network diagnostics, and many other applications. The component includes two
demonstration applications, one that displays raw packets, the other that totals internet traffic.
The components include various filters to reduce the number of packets that need to be
processed, by allowing specific IP addresses to be ignored, LAN mask to ignore local traffic,
and ignore non-IP traffic such as ARP.
The components capture packets using two different techniques, with differing benefits
and features:
1. Raw sockets which are available with Windows 2000 and later. This uses WSocket V6
from the François Piette internet component suite, from http://www.overbyte.be/.
Major benefit is that no other software needs to be installed, but raw sockets don't
seem to work fully with some network adaptors, and ignore non-IP protocols. Some
adaptors may capture received packets, but ignore anything sent.
2. WinPcap (Windows Packet Library) device driver, needs to be installed (it installs two
small DLLs and a driver), but captures all packets including non-IP. WinPcap may be
downloaded from http://www.winpcap.org/, and version 4.0.2 is included in this
package. Note the Delphi WinPcap pcap.pas and packet32.pas modules were
originally written by Lars Peter Christiansen, but have several bug fixes and many
new features. In theory WinPcap will run on Windows 9x, but it's not been tested. Use
of the latest WinPcap version 4.0.2 9th November 2007 is strongly recommended, but
the component also supports older versions 3.1 5th August 2005 and 3.0 10 February
2003.
Komponenten-Übersicht:
There are two main low level components, TMonitorSocket in monsock.pas which supports
raw window sockets, and TMonitorPcap in monpcap.pas that supports WinPcap.
Both have very similar properties and return ethernet packets using identical events, formatted
identically, allowing the same application to use either or both low level components.
There are subtle differences, raw sockets monitors a specific IP address, whereas WinPcap
monitors all traffic on an adaptor. Both may potentially monitor traffic other than the local
PC, depending on LAN structure. Common functions and declarations are in packhdrs.pas
Praktikum Rechnernetze, Arbeitsbogen P1 Seite 6 / 14