LabView (Ethernet, TCP/IP) Packet Capture

[Nuno Tavares]

I hope this post is not going offtopic.

I (a quite beginner to labview) am trying to use labview to quantizise (measure) incoming and outcoming traffic in a one-segment only LAN network. Technically, low-level speaking, this would be a matter of setting the Ethernet interfaces in promisc-uos mode, and make EOF-based readings of the ethernet buffer.

I've done a little digging on the forums, and Documentation before posting this, which means I've ran out of ideas by now, and didn't get to the solution.

I just want to:
1) set the device promisc-uous: I'm aware I have to install a Packet driver, but the links I've found (that packet32.zip thing) won't work under WindowsXP. I've installed WinPCAP, which might do the trick.

2) Bind the driver/device to LabView (in my case, I have 2 ethernet devices, (not) bridged). How do I select which one to use? How to set labview to use the pcap driver instead of winxp's ?

I also had a look to VISA "vi's", but I'm not sure if it will fit my purpose.

NOTE: I had to write an '-' to promisc.. so that my post could be submited. It seems promisc.. is considered a "profane" word 🙂

If you have any hint you think worth mentioning, please reply.

[JRA]

I have never heard of this being done with LabVIEW before, although I'm sure someone has tried. It's an interesting idea. I would suggest searching for a DLL someone may have created to do this and then accessing that through LabVIEW. I would bet that you can find one somewhere on the web. Let us know what you end up trying.

[Ben]

Until I rad your post, I was under the impresion that "packet32.zip" was the way to go.

Please post an update if you figure out an answer.

Ben

[Underflow]

I have heard recommendations for (but not had time to play with) www.ethereal.com for network capture. Open source too, if you feel like recompiling your own dll.

Good luck.

[Nuno Tavares]

I don't doubt there should be one implementation, and I'll be analysing Ethereal/Labview interface possibilities, until someone gives a better idea.

Now.. I don't know how to use and external DLL. How would I import it (just a reference) - LabView 5 or 6? I have plenty of source code that would be usefull, and no problem with C/C++/Pascal/Delphi/VisualBasic.

[Nuno Tavares]

Hello and thank you ALL for the reply. Ben, I've seen your name/nick on earlier posts on the subject, in this forum. packet32.zip is just an "ordinary" packet driver which delivers (as much as possible) low-level access to ethernet devices.

I've tried installing it in WindowsXP (by means of CPanel and .INF) with no success. I'm working now on Windows98SE, and packet32.zip didn't installed here either. This driver seems outdated (I read somewhere 1997), author's page doesn't exist anymore, and google.com gives no result to me.

Anyway, I've installed WinPCap (another packet driver) and managed to "sniff" the network, so this driver fits. Now the problem is how to bind to it with LabView. I've searched Examples and Online Help about Configuration Opt
ions to change the driver, with no success. It seems LabView will use the native Windows NDIS driver.

As JRA suggested, it seems I may call External DLL's functions. I have no problem with C/C++/Pascal/Delphi/VBasic, but don't know how to link DLL's to LabView. That would be awesome! I have plenty of code I could link to what I'm doing. Can anyone give me a reference?

[Underflow]

There are many references for this subject. I would recommend searching the NI site for "Using External Code". A link that I ran across doing that is here.

[Ben]

Go with Underflow's link to get you started.

Please let me know if you need help. This topic is near and dear to my heart.

I concider myself one of the co-authors (the other was Robert Schmalstieg now with HP Support) of the first e-net sniffer. The data was collected using a program written in VAX-Macro and wrote to a file called "Olfactory.dat".

I have not had a need to re-write that app since then but I would hate to losse an ability I once had.

Give me a yell, I'll do what I can to help.

Ben

[Nuno Tavares]

Well, just tried to interface LabView with WinPCap (BTW, this WinPCap thing is Windows port of Unix-flavours libcap, thus it's OpenSource too). I've implemented the C structures with clusters and I think I got the idea on DLL importing. But..

I have to work with pointers and many kind of C structures. I'm just trying to do the interface promisc-uous "open", but LabView crashes (using WinXP, I'll try Win98 tomorrow). I don't know if it's my mistake, so I'd like to check the code if you can, it's available at http://bars2.gaesi.com/~nmct/labview/
You will need all the files, as I use (from the examples section) G
etMemoryByPtr() and SizeOf() .

I'd like that someone pointed me my mistake, because I've spent some time building this little thing, otherwise I'll have to try Ethereal (as Underflow) interface, though it's not WinPCap fault, for certain...

Technically, what this VI does is:

I assumed C pointers are treated as I32 (in C, pointers are usually cast'ed to "long int", so I referred to this), then I get the memory position returned by pcap_open_live(). I also assume that GetMemoryByPtr() stops on NULL (otherwise it should be a valid pointer). Then I've instructed the control FlattenFromString to split that memory block in a cluster I've designed (which represents C "struct pcap" - and its composed by other structs/clusters).

Note: Use TestApp.EXE to test your device (after installing WinPCap) to get to WPCAP devi
ce.

[Ben]

Sorry about the delay, I've been on-site for a while.

I down loaded your code and did the install. Your VI's seem to open OK and the test runs OK (the exe).

THis question warrents a better investigation for me to be abel to help. I will take this up at an earlier hour soon. THe componenets you have located look real promissing.

I don't know if you ran across a technique in your adventures but here goes (based on memory). You can right click on termianlof your dll calls and select "adapt to type". Onone version or another of LV (can't remember off-hand) there is function that will generate the function call that is appropriate. By redefining your cluster wired tothe terminal, you adust the data types and order until the structureis right.

Like
I said,I have to take more time to follow thru.

Ben