|
CommView provides a simple TCP/IP interface that allows you to
process packets captured by CommView using your own application in
real time. Starting with version 5.0 you may also use this
interface for sending packets (similar to the Packet Generator
function in CommView).
Please note that the data format has changed compared to the
previous versions of CommView. The TS switch has also been
eliminated as all the information about a packet including the
timestamp is now sent in the header.
How It Works
CommView should be launched with a special command-line argument,
"MIRROR", that tells the program to mirror captured packets to an
IP address and TCP port of your choice.
Examples:
CV.EXE mirror:127.0.0.1:5555 // mirrors packets to the
loopback address, TCP port 5555
CV.EXE mirror:192.169.0.2:10200 // mirrors packets to
192.169.0.2, TCP port 10200
When CommView is launched with a switch like this, it tries to
establish a TCP session by connecting to the specified IP address
and port number. It means that you should already have your
application running and listening on the specified port. If
CommView fails to establish a connection, it will keep on trying to
connect every 15 seconds. The same happens if the connection is
broken: CommView will try to re-establish it every 15 seconds. If
the connection is successfully established, CommView sends the
packets it captures to the specified IP address as they arrive, in
real time.
Data Format
The data is transmitted in NCF format. Please refer to the
CommView Log Files
Format
chapter for the format description.
Sending Packets
Packets may not only be received by your application, but also sent
as if you were using Packet Generator. Data can be sent to CommView
using the same TCP connection over which you are receiving the
data. The data format is simple: You should send the packet length
(a two-byte unsigned integer in the standard little-endian byte
order) followed by the packet itself. If the adapter is not opened
or it does not support packet injection, the packet is silently
discarded.
Sample Projects
Two simple demo applications that listen for inbound connections,
extract packets from the stream, and display raw data are
available.
·http://www.tamos.com/products/commview/samp_mirr_c5.zip.
This is a Visual Studio project with C++ source code.
·http://www.tamos.com/products/commview/samp_mirr_d5.zip.
This is a Delphi project with Pascal source code. If you want to
compile the project, you'll need the popular ICS components suite
by Francois Piette, available at
http://www.overbyte.be.
Bandwidth
When mirroring data to a remote computer, make sure that the link
between CommView and the computer to which the data is being
mirrored is fast enough to transfer all the data being captured. If
CommView captures 500 Kbytes/sec, and your link can handle only 50
Kbytes/sec, you'd inevitably have "traffic jams", which might
result in various problems (e.g., Winsock may just stop sending
data under some Windows versions). If you are looking for a more
flexible solution that would feature smart buffering and remote
control, consider using
CommView Remote
Agent.
|
