一种Windows网络嗅探器的检测原理与实现

Inspecting Principle and Realization of Sniffer in Windows

使用微软未公开的W indow s系统函数获取系统的所有句柄并进行分析.将进行嗅探的套接字挑出并建立嗅探套接字与进程之间的联系,有效地解决了本机嗅探器的检测与定位,弥补了其它的网络嗅探器检测软件不能方便地对嗅探程序进行确认的缺陷.

With private system function of Windows, all handles will be enumerated and analyzed. Picking up socket handle of sniffer and founding contact with its process,the sniffer can be effectively inspected and located. The shortage of other anti-sniffer software is avoided.