A New Hybrid Network Sniffer Model Based on Pcap Language and Sockets (Pcapsocks)

Nowadays, the protection and the security of data transited within computer networks represent a real challenge for developers of computer applications and network administrators. The Intrusion Detection System and Intrusion Prevention System are the reliable techniques for a Good security. Any detected intrusion is based on data collection. So, the collection of an important and significant traffic on the monitored systems is an interesting feature. Thus, the first task of Intrusion Detection System and Intrusion Prevention System is to collect information’s basis to treat and analyze them, and to make accurate decisions. Network analysis can be used to improve networks performances and their security, but it can also be used for malicious tasks. Our main goal in this article is to design a reliable and powerful network sniffer, called PcapSockS, based on pcap language and sockets, able to intercept traffic in three modes: connected, connectionless and raw mode. We start with the performances assessment performed on a list of most expanded and most recently used network sniffers. The study will be completed by a classification of these sniffers related to computer security objectives based on parameters library (libpcap/winpcap or libnet), filtering, availability, software or hardware, alert and real time. The PcapSockS provides a nice performance integrating reliable sniffing mechanisms that allow a supervision taking into account some low and high-level protocols for TCP and UDP network communications.

@article{GUEZZAZ2016,
  title     = {A New Hybrid Network Sniffer Model Based on Pcap Language and Sockets (Pcapsocks)},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {7},
  number    = {2},
  year      = {2016},
  publisher = {The Science and Information Organization},
  author    = {Azidine GUEZZAZ and Ahmed ASIMI and Yassine SADQI and Younes ASIMI and Zakariae TBATOU},
  doi       = {10.14569/IJACSA.2016.070228},
  url       = {https://doi.org/10.14569/IJACSA.2016.070228}
}