www.securityfriday.com "Capture packets with Winsock"

From: Manip (Manip@thelostsite.co.uk)
Date: 12/16/02 

From: "Manip" <Manip@thelostsite.co.uk>
Date: Mon, 16 Dec 2002 11:22:21 -0000

Capture packets with Winsock

Quote > > "
Winsock can capture Internet Protocol packets on your network with Windows
2000. The information of the network interface layer isn't contained in the
captured data. For example, the MAC address is not captured.

You require the administrator privilege of Windows 2000 to capture packets
with Winsock. You must set the network interface to promiscuous mode. The
function to do it is WSAIoctl() in Winsock 2." << Quote

This does not need to be said, it's like pointing out "If you are logged in
as admin you can sniff." So why bring Winsock into the issue? This is just a
space filler article with no real meaning or problem unless you give the
users on your network admin rights. I am only picking on this article
because it's getting very irritating people pointing out obvious security
holes like the one a while back about "Possible Trojan on default Windows
2000 Security" I mean duh.

(That "Possible Trojan on default Windows 2000 Security" was talking about
how users can read-write to C:(Root) by default)