TCP filter ??

[acer20006]

hii all actually i had two questions

question no1 : _ can i sniff the packet which i get it from TCPRecv ??

>>> i have tcp connection with some server and i received the packets(that's good)_ all i want is to catch a specific packets

for example:--

i have this packets

(rv = received)

rv: 0x0400457401007F310300

rv: 04004574A28023AD0200

rv: 0400457456265D260600

rv: 0x040045740100B6870200 <<<<<<<<<<

rv: 0x04004574010091550100

rv: 0x0C0045B40200017F31030001360000000105

rv: 0x0C0045B4020001B687020001360000000105

rv: 0x0C0045B402000123AD020001530000000105

now i want to search for B6870200and automatically save the whole packet(line) at text file if the packet exist

question no2 : TCPRecv catch all the packet from/to (server~client)

i wounder if there's a way to make it catch only the packet which send from (server to client) or (client to server)

*****

any idea ??

*****

thx

[jvanegmond]

question no1 : _ can i sniff the packet which i get it from TCPRecv ??

I really don't understand the question. The word "sniff" implies that you want to intercept what you are getting in TCPRecv. But why? TCPRecv returns the data, you would otherwise sniff. Otherwise, if you actually mean you want to sniff on your AutoIt app, you can get Wireshark.

question no2 : TCPRecv catch all the packet from/to (server~client)

i wounder if there's a way to make it catch only the packet which send from (server to client) or (client to server)

TCPRecv only catches incoming messages. If you are the client, then it will only capture server->client. If you are the server, it will only capture client->server. Edited December 16, 2009 by Manadar

[darkjohn20]

StringRegExp()

[acer20006]

I really don't understand the question. The word "sniff" implies that you want to intercept what you are getting in TCPRecv. But why? TCPRecv returns the data, you would otherwise sniff. Otherwise, if you actually mean you want to sniff on your AutoIt app, you can get Wireshark.

i will Explain: i want to make something like analyzer at my autoit which can find a specific packet at my packets list _ and about Wireshark i don't have any idea about it and also i don't know how to attach it with autoit _ if you can send to me some example i will be grateful

TCPRecv only catches incoming messages. If you are the client, then it will only capture server->client. If you are the server, it will only capture client->server.

my client didn't connect to the server directly( i redirect my client ip&port to my local ip {something like proxy}) that's why my autoit(local ip)can't identify the client/server packets

***

any idea ??!

Edited December 16, 2009 by acer20006

[acer20006]

StringRegExp()

ty i will try it

[jvanegmond]

my client didn't connect to the server directly( i redirect my client ip&port to my local ip {something like proxy}) that's why my autoit(local ip)can't identify the client/server packets

I don't know what network setup you have there, but it's horrible wrong. I'm surprised you can even visit these forums, because I doubt any application handles it's own packets sent back to him well.

[acer20006]

I don't know what network setup you have there, but it's horrible wrong. I'm surprised you can even visit these forums, because I doubt any application handles it's own packets sent back to him well.

mmmmmm , forget this part i can handle packets & my net work connection . let's return to the main question how to catch specific packet at packets list ( my idea is like the search function_ is it possible ?? / or i have to find another way ?)

BTW ty for help

[jvanegmond]

How do you receive the packets?

[acer20006]

How do you receive the packets?

$IP = "127.0.0.1"
TCPStartUp()
$socket = TCPConnect($IP, 22580)  
While 1
    $Packet = TCPRecv($socket, 10000) 
    If $Packet <> "" Then 
        pkt("incoming >>  : " & $Packet)
    EndIf
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
    EndSwitch
WEnd

this is the connection's code part

Edited December 17, 2009 by acer20006

[jvanegmond]

$IP = "127.0.0.1"
TCPStartUp()
$socket = TCPConnect($IP, 22580)  
While 1
    $Packet = TCPRecv($socket, 10000) 
    If $Packet <> "" Then 
        If (StringInStr($Packet, "B6870200") Then
            FileWrite("packetlog.txt", $Packet)
            pkt("incoming >>  : " & $Packet)
        EndIf
    EndIf
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
    EndSwitch
WEnd

[acer20006]

$IP = "127.0.0.1"
TCPStartUp()
$socket = TCPConnect($IP, 22580)  
While 1
    $Packet = TCPRecv($socket, 10000) 
    If $Packet <> "" Then 
        If (StringInStr($Packet, "B6870200") Then
            FileWrite("packetlog.txt", $Packet)
            pkt("incoming >>  : " & $Packet)
        EndIf
    EndIf
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
    EndSwitch
WEnd

StringInStr _ that's was easy

ty Manadar i will try it