Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

Is there any way to interact with a program's socket traffic without installing Winpcap?

I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more asking whether or not it is still safe from code injected into the program or something similar.

I figure a situation probably calls more for intercepting traffic through MITM or something, I'm just interested in how "low-level" this port rule applies.

share|improve this question
It is possible for Windows to share TCP/IP ports in certain situations – makerofthings7 Dec 14 '12 at 14:00

2 Answers

up vote 2 down vote

You can use tcpdump for TCP/IP sockets

Unix domain sockets are something else.

share|improve this answer
So tcpdump will listen to traffic on an occupied port? (As opposed to listening on a port and occupying it) – mellowmaroon Dec 18 '12 at 1:40
up vote 2 down vote

Firewalls interact with all port traffic and an (H)IDS audits port traffic, too. Neither of those things uses winpcap.

share|improve this answer
Firewalls/IDS's on the computer being tested, right? I said something quick about "MITM", but it'd be similar to an intermediary assuming that was what you were referring to. – mellowmaroon Dec 18 '12 at 1:46
Each computer can have a firewall and (H)IDS, and those things listen to all traffic. So, a web server can be listening to port 80 and at the same time have firewall/IDS inspecting port 80 traffic, all on the same computer. The trick is that the traffic is not 'destined' for the firewall/IDS. – schroeder Dec 18 '12 at 15:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.