Is there any way to interact with a program's socket traffic without installing Winpcap?

I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more asking whether or not it is still safe from code injected into the program or something similar.

I figure a situation probably calls more for intercepting traffic through MITM or something, I'm just interested in how "low-level" this port rule applies.


You can use tcpdump for TCP/IP sockets

Unix domain sockets are something else.

  • So tcpdump will listen to traffic on an occupied port? (As opposed to listening on a port and occupying it) – bitflips Dec 18 '12 at 1:40

Firewalls interact with all port traffic and an (H)IDS audits port traffic, too. Neither of those things uses winpcap.

  • Firewalls/IDS's on the computer being tested, right? I said something quick about "MITM", but it'd be similar to an intermediary assuming that was what you were referring to. – bitflips Dec 18 '12 at 1:46
  • Each computer can have a firewall and (H)IDS, and those things listen to all traffic. So, a web server can be listening to port 80 and at the same time have firewall/IDS inspecting port 80 traffic, all on the same computer. The trick is that the traffic is not 'destined' for the firewall/IDS. – schroeder Dec 18 '12 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.