Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any way to interact with a program's socket traffic without installing Winpcap?

I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more asking whether or not it is still safe from code injected into the program or something similar.

I figure a situation probably calls more for intercepting traffic through MITM or something, I'm just interested in how "low-level" this port rule applies.

share|improve this question
    
It is possible for Windows to share TCP/IP ports in certain situations –  makerofthings7 Dec 14 '12 at 14:00
add comment

2 Answers

You can use tcpdump for TCP/IP sockets

Unix domain sockets are something else.

share|improve this answer
    
So tcpdump will listen to traffic on an occupied port? (As opposed to listening on a port and occupying it) –  mellowmaroon Dec 18 '12 at 1:40
add comment

Firewalls interact with all port traffic and an (H)IDS audits port traffic, too. Neither of those things uses winpcap.

share|improve this answer
    
Firewalls/IDS's on the computer being tested, right? I said something quick about "MITM", but it'd be similar to an intermediary assuming that was what you were referring to. –  mellowmaroon Dec 18 '12 at 1:46
    
Each computer can have a firewall and (H)IDS, and those things listen to all traffic. So, a web server can be listening to port 80 and at the same time have firewall/IDS inspecting port 80 traffic, all on the same computer. The trick is that the traffic is not 'destined' for the firewall/IDS. –  schroeder Dec 18 '12 at 15:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.