Very Computer

In Windows 2000:

I want to be able to intercept data flowing on both sides of the transport
layer.

Thus I need to access and modify the relevant references to and from the
transport layer.  Ideally, I'd like to use the most robust technique
available.

Is there available documentation on how to do this, and if so then where?

subdomain.worldnet.att.net :

Quote:> In Windows 2000:

> I want to be able to intercept data flowing on both sides of the transport
> layer.

> Thus I need to access and modify the relevant references to and from the
> transport layer.  Ideally, I'd like to use the most robust technique
> available.

> Is there available documentation on how to do this, and if so then where?

I don't how TCP/IP savvy you are, but the IBM Redbook is a pretty good
indepth:
http://publib-
b.boulder.ibm.com/Redbooks.nsf/RedbookAbstracts/gg243376.html?Open

 As for 'how-to' texts, you *may* find something useful on PacketStorm
(.org):
http://packetstorm.decepticons.org/

or even SecurityFocus:

http://www.securityfocus.com

Cheers,
Gryph

--
I'm livin' in the 70's
I feel like I lost my keys
Got the right day but I got the wrong week
And I get paid for just bein' a freak

Quote:> I don't how TCP/IP savvy you are, but the IBM Redbook is a pretty good
> indepth:
> http://publib-
> b.boulder.ibm.com/Redbooks.nsf/RedbookAbstracts/gg243376.html?Open

>  As for 'how-to' texts, you *may* find something useful on PacketStorm
> (.org):
> http://packetstorm.decepticons.org/

> or even SecurityFocus:

> http://www.securityfocus.com

I'm sufficiently TCP/IP savvy.  My problem is that I'm not sufficiently
Windows savvy.

These sites that you've suggested are focussed on such things as the
structure of headers.  What I need to do, however, is intercept and modify
data between layers.

Upon research, it seems that I can figure out how to do this on one side of
the TCP layer by examining source of winsock.dll.  This leaves the problem
of data travelling between the TCP and the IP layer.  Microsoft supplies
these togther as tcpip.sys.  I'm staring at a single pice of machinery,
within which I know are some pipes that into which I need to splice.  To do
that, I have to identify where and how the relevant functions are
referenced.

I doubt if you'll be able to find the source to winsock.dll unless you work
for Microsoft ... it seems to me that you'll have more luck if you find out
about NDIS drivers and the like,

Cheers,

Phil

in message

Quote:> I doubt if you'll be able to find the source to winsock.dll unless you
> work for Microsoft ...

Ah, but I didn't need the source for MS's winsock.dll; I just needed source
for _some_ winsock.dll.  And, indeed, I got that.

That point is moot, as I've got better documentation for that side of
things.  I'm still seeking information on splicing between the TCP layer and
the IP layer.

Check out LSP's

markus