Question

Okay, so this probably sounds terribly nefarious, but I need such capabilities for my senior project. Essentially I’m tasked with writing something that will cut down outbound spam on a zombified pc through a system of packet interception and evaluation. We have a number of algorithms we’ll use on the captured messages, but it’s the actual capture — full on interception rather than just sniffing — that has me a bit stumped.

The app is being designed for windows, so I can’t use IP tables. I could use the winpcap libraries, but I don’t want to reinvent the wheel if I don’t have to. Ettercap seemed a good option, but a test run on vista using the unofficial binaries resulted in nothing but crashes.

So, any suggestions?

Update: Great suggestions. Ended up scaling back the project a bit, but still received an A. I’m thinking Adam Mintz’s answer is probably best, though we used WinPcap and Wireshark for the application.

Answer 1

Sounds like you need to write a Winsock LSP.

Once in the stack, a Layered Service Provider can intercept and modify inbound and outbound Internet traffic. It allows processing all the TCP/IP traffic taking place between the Internet and the applications that are accessing the Internet.