How to make a Packet sniffer/filter?

Hey, I'm kinda new to C++ and know that I wont be able to make a packet sniffer/filter/whatever yet (unless its easier then I think), but for future reference, how would you make a program that captures packets that a certain program RECEIVES (not send) and make it so whenever it receives a certain packet it will filter it to a different one? Can you make it so it looks for a certain part of a packet and edits only that part? For example, if you receive a packet with the hex "FF 00 03 FE 23 2A" and only want to edit the "FE 23" part to "A2 34", how would you make a C++ program where all you have to do is click a button and the program will edit that packet for you whenever it receives it?


Thanks.

Interesting. You want to cloak the actual remote client and substitute a straw man? Could be dangerous.

Anyway, you'd either have to use some library that works with TCP, or you'd have to work with sockets directly. Sockets, which are the low-level layer of networking, are implementation-dependent. There's a lot out there on google.

As for the data manipulation, that's straightforward enough. The only thing you'd have to worry about is "endianness," or the ordering of the words within the data, bytes within the words, and bits within the bytes. You might use a mask:

Code:

---


#include <iostream>

int main()
{
    unsigned data = 0x45EFA6;
    unsigned wiper = 0xFF00FF;
    unsigned chunk = 0x00D200;

    data = (data&wiper) | chunk;
    std::cout << std::hex << data << std::endl;
}

---

Someone correct me if I'm wrong but I believe you would have to implement the equivalent of a software firewall, not a packet sniffer. Most implementations of packet sniffers merely watch the traffic and do not intercept it. Keep in mind that this sorta thing could slow down the traffic on that computer. If you wanted a real go at it, you could try jumping into the application you want filtered and try and hook into their socket read/writes.