稳定版本:WinPcap 4.0.2

最近版本:WinPcap 4.1 beta5

WinPcap是Windows环境访问链路层的工业标准级别的工具。允许应用程序绕过协议栈抓取和传输网络包，且有以下有用特性，包括内核级包过滤，网络统计引擎并支持远程抓包。

WinPcap包括一个继承操作系统以提供底层网络访问的驱动，和一个用来轻松访问底层网络的库。该库也包含Unix下的API libpcap。

由于众多特性，WinPcap成为许多开源或商业网络工具的抓包和过滤引擎，包括协议分析，网络监控，网络入侵检测系统，嗅探器，流量生成器和网络测试器。其中一些工具，像Wireshar，Nmap,Snort,ntop在网络社区被广泛使用。

WinPcap同时也是WinDump诞生之地，WinPcap是windows版本的流行tcpdump,能被用来按照各种各样复杂的规则监视，分析网络流量并存盘。

看看基于WinPcap开发出的众多知名产品:Ethereal,Windump等等，当然还包括国内有名(非常有用但被人滥用又十分讨厌)的网络剪刀手，P2P终结者，网络执法官等等.还包括基于它开发的不同语言的库，如JPcap(用于Java)，pypcap(用于Python)，sharpcap(.NET)

• 0x4553-Intercepter
  This program offers the following features:
  – Sniffing passwords\hashes of the types:
     ICQ\IRC\AIM\FTP\IMAP\POP3\SMTP\LDAP\BNC\SOCKS\HTTP\WWW\NNTP\CVS\TELNET\MRA\DC++\VNC\MYSQL\ORACLE
  – Sniffing chat messages of ICQ\AIM\JABBER\YAHOO\MSN\GADU-GADU\IRC\MRA
  – Changing MAC address of LAN adapters
  – Raw mode (with filtering rules)
  – Capturing packets and post-capture (offline) analyzing
  – Remote traffic capturing via RPCAP daemon
  – Reconstruction of SMTP\POP3 messages
  http://intercepter.nerf.ru
• Aerosol
  Wardriving utility for Windows.
  http://www.remoteassessment.com/?op=pub_archive_search&query=wireless
• AirSnare
  AirSnare is an intrusion detection system to help you monitor your wireless network.
  http://home.comcast.net/~jay.deboer/airsnare/
• Analyzer
  Analyzer is a fully configurable Network Analyzer for Win32. It includes several functionalities that are needed by network management operator. Analyzer is based on WinPcap and it is able to capture packets on most Win32 platforms (and link-layer technologies). Analyzer 3.0 comes out with some event logging, LAN monitoring and traffic monitoring capabilities. However, Analyzer 3.0 most valuable point is the ability to parse network packets according to the protocol description contained into some external files, which can be modified at run-time by the user.
  http://analyzer.polito.it/
• AnetTest
  AnetTest is a integrated packet generator and sniffer for Ethernet, but also works with blocks of data over TCP connection. Enables you to use scripts for automated testing, monitoring, imitating of various network objects, creating custom network tools.
  http://anettest.sourceforge.net/
• Archaeopteryx
  Archaeopteryx is a Passive mode OS Identification Tool. It is                based off Siphon v.666 by SubTerrain. It has a GUI and a highly                configurable OS signature file.
  http://members.fortunecity.com/sektorsecurity/projects/archaeopteryx.html
• ARP0c
  ARP0c is an ARP redirector and bridging engine. ARP requests                from various sources in a switched environment get false ARP                response which point to the host running ARP0c. Packets from                these hosts are bridged to the real destination address to allow                normal network operation and keep TCP connections alive.
  http://www.phenoelit.de/arpoc/
• Asn1Browser
  The Asn1Browser analyzer decodes ASN1 binary data and provides an advanced display for the user.
  http://www.unigone.com/Asn1Solutions/Asn1Browser_eng.html
• assniffer
  assniffer can monitor a network, and for every HTTP transfer it sees, save a copy of the transferred data.
  http://www.cockos.com/assniffer/
• AutoScan-Network
  AutoScan-Network is a network discovering and managing application.
  http://autoscan-network.com/
• BillSniff
  BillSniff is a free (freeware) sniffer under MS Windows.
  http://billsniff.prv.pl/
• CAS BACnet Explorer
  Automatically discover all the BACnet® IP, BACnet® Ethernet and BACnet® MSTP devices, objects, and their properties on your network. The objects and devices are arranged in an easy to use tree format with braches for each network, object, and device.
  http://www.sfintegration.com/cbe_main.html
• Bit-Twist
  Bit-Twist is a simple yet powerful WinPcap-based Ethernet packet generator. It is designed to compliment WinDump, which by itself has done a great job in capturing network traffic. With Bit-Twist, you can now regenerate the captured traffic onto a live network! Packets are generated from windump trace file (.pcap file). Bit-Twist also comes with a comprehensive trace file editor to allow you to change the contents of a trace file.
  http://bittwist.sourceforge.net/
• Bochs
  Bochs is a highly portable open source IA-32 (x86) PC                emulator written in C++, that runs on most popular platforms. It                includes emulation of the Intel x86 CPU, common I/O devices, and                a custom BIOS.
  http://bochs.sourceforge.net/
• Busted!
  Busted! records AOL instant message conversations, web sites visited, applications used, keystrokes and takes periodic screen shots.
  http://www.pcsentinelsoftware.com/
• CableMon
  Cable traffic monitoring tool.
  http://www.cgsoftlabs.ro/
• Cain & Abel
  Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort.
  http://www.oxid.it/cain.html
• CarnivorePE
  Carnivore is a surveillance tool for data networks. At the heart of the project is CarnivorePE, a software application that listens to all Internet traffic (email, web surfing, etc.) on a specific local network. Next, CarnivorePE serves this data stream to interfaces called “clients.” These clients are designed to animate, diagnose, or interpret the network traffic in various ways.
  http://rhizome.org/carnivore/
• cdpr – Cisco Discovery Protocol Reporter
  cdpr is used to decode a Cisco Disovery Protocol (CDP) packet, by default it will report the device ID, the IP Address (of the device), and the port number that the machine is connected to. Optionally it will decode the entire CDP packet.
  http://www.monkeymental.com/nuke/index.php
• choozmail
  parental control software.
  http://www.choozmail.com/cgi-bin/dy01/chsindex.htm?usid=&scountry=&brname=Nets&brver=5
• CHScanner
  CHScanner allows you to scan in “style” from Windows XP SP2 and higher OS. It is IPv4 and IPv6 enabled, it has a skinnable interface and it has the ability to mimic various operating systems. Last but not least, it has many scanning methods.
  http://www.geocities.com/calinradoni/
• coLinux
  Cooperative Linux is the first working free and open source method for optimally running Linux on Microsoft Windows natively. More generally, Cooperative Linux (short-named coLinux) is a port of the Linux kernel that allows it to run cooperatively alongside another operating system on a single machine. For instance, it allows one to freely run Linux on Windows 2000/XP, without using a commercial PC virtualization software such as VMware, in a way which is much more optimal than using any general purpose PC virtualization software.
  http://www.colinux.org/
• CORE IMPACT
  Automated, comprehensive penetration testing product for assessing specific information security threats to an organization.
  http://www.coresecurity.com/products/coreimpact/index.php
• dasniff
  daSniff is an open source customizable sniffer for win32 systems.                It helps you to log your LAN traffic by specifying packet rules                as filters.
  http://demosten.com/dasniff/
• Deep Network Analyzer (DNA)
  DNA is an open, flexible and extensible deep network analyzer (software server) and architecture for gathering and analyzing network packets, network sessions and applications protocols, passively off enterprise class networks. DNA is designed to be used for Internet Security, Intrusion detection, Network Management, Protocol and Network Analysis, Information Gathering, Network Monitoring applications.
  http://dnasystem.sourceforge.net/
• dsniff
  dsniff is a collection of utilities to aid in sniffing                network data.
  http://www.datanerds.net/~mike/dsniff.html
• E.L.A
  E.L.A. identifies and counts the network traffic by any application. In addition the traffic is separated between local network(s) and Internet (external networks).
  http://nmsoft.3x.ro/ela_caracteristici.html
• EffeTech HTTP Sniffer
  EffeTech HTTP Sniffer is a HTTP protocol network sniffer, packet analyzer and file rebuilder based on Windows platform. Unlike most other sniffers, it is dedicated to capture IP packets containing HTTP protocol and to rebuild the HTTP communications and files sent through HTTP protocol.
  http://www.effetech.com/
• Engage Packet Builder
  Scriptable libnet-based packet builder for Windows platform.
  http://www.engagesecurity.com/products/engagepacketbuilder/
• Ethergrouik
  Ethergrouik is a Windows open source project (C + GTK) whose main goal is to represent graphically connections by protocols on your network.
  http://ethergrouik.sourceforge.net/
• EtherSnoop
  EtherSnoop is a basic network sniffer, that can capture all packets going through the network. It lists the captured data in real-time, using an easy-to-understand interface with a hex and text display of the packet content. EtherSnoop also offers basic filtering by protocol type and a tree-style packet explorer. The output can be saved to file and reloaded later if needed.
  http://www.arechisoft.com/
• ettercap
  Ettercap is a multipurpose sniffer/interceptor/logger for                switched LAN. It supports active and passive dissection of many                protocols (even ciphered ones) and includes many feature for                network and host analysis.
  http://ettercap.sourceforge.net/
• FAP Guard
  FAP Guard allows DirecPC and DirecWay users to monitor their               Fair Access Policy ( FAP ) download level, thus preventing them               from getting throttled or disconnected. You might also find this               application useful if you are paying for download, or have a               download limit imposed by your ISP. It provides some interesting               network traffic statistics as well.
  http://www.fapguard.com/
• FanfareSVT
  The Fanfare Group delivers one-click test automation™ for communication equipment manufacturers who need to reduce their time to market and improve product quality.
  http://www.fnfr.com/solutions/FanfareSVT.htm
• FramePad
  FramePad is a Windows based packet sniffer and protocol analyzer, designed from the ground up with ease and functionality in mind. It allows you to examine data from a live network or from a capture file on disk.
  http://www.beesync.com/framepad/index.html
• FTPXerox
  FTPXerox grabs files that are transferred across the network                using the FTP protocol. It implements a full end-to-end TCP                re-assembly engine that watches for FTP transfers.
  http://members.fortunecity.com/sektorsecurity/projects/ftpxerox.html
• Gamer\’s IPX Tunnel (GIT)
  GIT is a freeware utility to link LANs together over                the internet for IPX-based network gameplay. It can also be used                to bridge many configurations of IPX packets and frames from                once point to another.
  http://www.morpheussoftware.net/git/
• GIPS IP Network Simulator
  The GIPS IP Network Simulator is a software tool that allows the user to emulate network behavior by delaying and/or dropping packets in an IP-network. Installed in a laptop it can be placed between two LAN’s, two gateways, or any two IP devices and simulate the network conditions experienced by the two end-points.
  http://www.globalipsound.com/solutions/solutions_Tools.php
• Hammer Call Analyzer
  The Hammer Call Analyzer enables users to visualize signaling and voice quality problems in VoIP networks. For example, the unique call list and multistage call flow display features walk engineers through the legs of a particular call. In addition, the Hammer Call Analyzer displays waveforms and the Stream Quality Signature for any call.
  http://www.empirix.com/Empirix/Network+IP+Storage+Test/hammer+call+analyzer.html
• HiDownload
  HiDownload is a multi-threaded download manager that allows you to download individual files (or lists of files) from web and FTP.
  http://www.hidownload.com/
• Honeyd
  Honeyd is a small daemon that creates virtual hosts on a network that enhances network security by providing “honeypot” decoys that enable network security officers to detect, monitor, and contain unauthorized network activities without the intruder knowing they are being tracked.
  http://www.securityprofiling.com/honeyd/honeyd.shtml
• hping
  hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn\’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.
  http://www.hping.org/
• HTTP snoop
   A simple but functional HTTP sniffer application. It will display a few basic information about every “HTTP packet” that it sees on the NIC and decode all basics authentication header entries it finds (both for proxies and for web sites). It will also write everything in the HTTP request that is both in the same packet and before the firs null char.
  http://www.arsware.org/cms/showpage.php?cid=101&PHPSESSID=77fa03bd7b6139b01280fe6adab1bbe4
• HttpTracer
  View web traffic between browser and any Internet server. HttpTracer is a windows program that runs as a proxy server on your desktop, catching and displaying all textual commands and data sent and recieved by a web browser.
  http://lazydogutilities.com/traceprev.htm
• jNetPCAP
  jNetPCAP is a java library that is a wrapper around WinPcap. What makes this library unique is that it is a comprehensive and accurate wrapper around the libpcap library.
  http://jnetpcap.sourceforge.net/
• JPcap
  A Java wrapper for WinPcap. It allows Java code to access to the                WinPcap (and libpcap on UNIX) calls.
  http://netresearch.ics.uci.edu/kfujii/jpcap/doc/index.html
  http://sourceforge.net/projects/jpcap/
• IM Sniffer
  Intercepts and decodes all instant message traffic received by the computer. A high performance engine delivers real time message decryption. Conversations can be viewed immediately or saved for later analysis. Freeware.
  http://imsniffer.sourceforge.net/
• iNetWatcher
  iNetWatcher© is based on Winpcap, may fully monitor the Internet activity of staff or students, record the E-mail transmitting through the Internet and Web Page; monitor the various real-time chatting messages and IM files sent; monitor the register table, hard disk, system information of the employee\’s computer; monitor FTP; monitor net flow of all staff.
  http://www.softbar.com/en
• ipInterceptor
  Trace TCP/UDP Packets on your workstation. View packets in a logical sequence, with requests and responses grouped into conversations (showing the resulting response times). Set filters for tracing. View headers and data in text or HEX format.
  http://lazydogutilities.com/ipprev.htm
• IpMaster/IpMasterPro
  Internet/Network Ip address & data packet monitor.
  http://www.bosstechinc.net/products.htm
• IP Sniffer
  Windows 2000/XP packet sniffer with replay function.
  http://erwan.l.free.fr/
• ItCan.Net Monitor
  ItCan.Net Monitor is a bandwidth analysis utility. Besides                giving a graphical illustration of the bandwidth usage on your                computer or the network it resides, you get a list of all                incoming and outgoing connections.
  http://itcan.programmer.nl/
• KolSniffer
  Kolsniffer contains a component to write very small self-contained WinPcap applications with Delphi and the Key Object Library framework. The source code is a translation of the Tsniffer class that Umar Sears wrote earlier. The source code is freeware, with the permission of the original author. It was written by Thaddy de Koning. The zip filecontains a demo with sources, that illustrates how to use the component. The Key Object Library framework itself is available from http://bonanzas.rinet.ru/
  http://members.chello.nl/t.koning8/kolsniffer.zip
• LaBrea@Home
  LaBrea@Home is a version of the original network administrator\’s                tool “LaBrea” for home use. LaBrea is a way to combat                both port scanners and worms such as Code Red and Nimda. The                original network administrator\’s “LaBrea” creates                phantom machines which hold scanners and worms in a sort of                “tarpit”, luring them in, and holding onto their                communications with what they think are real machines.
  http://www.hackbusters.net/LaBrea/lbathome.html
• LeetGeek ICMP Tunneler
  An ICMP tunneling program.
  http://www.leetgeek.net/programs.html
• Libnet
  Libnet is a high-level API (toolkit) allowing the application programmer to construct and inject network packets. It provides a portable and simplified interface for low-level network packet shaping, handling and injection.
  http://www.packetfactory.net/Projects/Libnet/
• Libnids
  Libnids is an implementation of an E-component of Network                Intrusion Detection System. It emulates the IP stack of Linux                2.0.x. Libnids offers IP defragmentation, TCP stream assembly                and TCP port scan detection.
  http://www.datanerds.net/~mike/libnids.html
• LineAge Utils
  LineAge Utils is tool that allows editing of colored chat, and NPC/mob description in Lineage 2 game. It also has integrated sniffer which allows user to import game character inventory and warehouse into material calculator, which is also part of LineAge Utils.
  http://sourceforge.net/projects/lau/
• lwIP
  lwIP is a small independent implementation of the TCP/IP                protocol suite. The focus of the lwIP TCP/IP implementation is                to reduce the RAM usage while still having a full scale TCP.
  http://www.sics.se/~adam/lwip/index.html
• MSN Protocol Analyzer
  MSNProtocol Analyzer(MSNPAnalyzer) is a network utility that can monitor (or capture, monitor) the sessions of MSN Protocol.
  If you use this program in conbination with SwitchSniffer program, you can capture and see all the MSNP sessions including conversations and MSN commands
  http://www.nextsecurity.net/products/MSNPAnalyzer/MSNPAnalyzer.htm
• MSN Webcam Recorder
  MSN Webcam Recorder is a tool that allows you to record video streamed to and from your computer by MSN Messenger\’s Webcam Feature.
  http://ml20rc.msnfanatic.com/index.html
• myNetMon
  myNetMon is windows based network monitor and packet analyzing (sniffer).
  http://www.gold-software.com/myNetMon-review18946.htm
• Nemesis
  Nemesis is a command-line network packet injection utility for UNIX-like and Windows systems. You might think of it as an EZ-bake packet oven or a manually controlled IP stack. With Nemesis, it is possible to generate and transmit packets from the command line or from within a shell script.
  http://www.packetfactory.net/projects/nemesis/
• Net::Pcap for Win32
  A Perl interface to the libpcap library. Net::PcapUtils is available on the same site.
  http://www.bribes.org/perl/wnetpcap.html
• NETI@home
  NETI@home is an open-source software package that collects network performance statistics from end-systems. It has been written for and tested on the Windows, Linux, and Solaris operating systems, with testing for other operating systems to be completed soon. NETI@home is designed to run on end-user machines and will collect various statistics about Internet performance. These statistics will then be sent to a server at the Georgia Institute of Technology (Georgia Tech), where they will be collected and made publicly available.
  http://www.neti.gatech.edu/
• NetCalibrator
  NetCalibrator offers statistical analysis of captured data in               support of performance analysis. The approach being used provides               ability to quantify performance issues for small as well as large               (>500,000) number of packets.
  http://www.netpredict.com/
• NetPredictor
  NetPredictor offers monitoring and prediction of application performance. It enables you to build, or to interactively discover, the path between an application user and the server.
  http://www.netpredict.com/
• netwib, netwox and netwag
  Netwib provides sniff, spoof, client, server and most functions needed by network programs. Toolbox netwox helps to find and solve networks\’ problems. Netwag is a graphical network toolbox. Netwox and netwag contain over 150 tools.
  http://www.laurentconstantin.com/en/netw/netwib/
  http://www.laurentconstantin.com/en/netw/netwox/
  http://www.laurentconstantin.com/en/netw/netwag/
• NetWitness
  NetWitness gives an organization the ability to quickly understand and respond to network activity of interest, regardless of the device provisioning the data or the application producing the packets.
  http://www.netwitness.com/products/products.html
• NetworkMiner
  A passive network monitoring tool for Windows with an easy-to-use graphical interface. NetworkMiner can detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off line analysis. The source code is available as open source.
  http://sourceforge.net/projects/networkminer
• Network packet generator
  Network Packet Generator (npg) is a free GNU GPL Windows packet injector (generator) that utilizes WinPcap to send specific packets out a single or multiple network interfaces. These packets and other extended options can be defined on the command line, in a packet file, or combination of the two.
  http://www.wikistc.org/wiki/Network_packet_generator
• NeVO
  Determine vulnerabilities on your network through passive monitoring much like a sniffer. NeVO dynamically learns about your servers, services and vulnerabilities by performing signature and protocol analysis of the observed network sessions.
  http://www.tenablesecurity.com/nevo.html
• NeWT
  Easy-to-use windows vulnerability scanner based on Nessus technology. NeWT installs on any Windows 2000 or Windows XP computer and can quickly scan several thousand hosts for vulnerabilities and produce detailed vulnerability reports.
  http://www.tenablesecurity.com/newt.html
• ngrep
  Ngrep strives to provide most of GNU grep\’s common features,                applying them to the network layer
  http://ngrep.sourceforge.net/
• NmapNT
  Nmap is a utility for network exploration or security auditing.                It supports ping scanning (determine which hosts are up), many                port scanning techniques (determine what services the hosts are                offering), and TCP/IP fingerprinting (remote host operating                system identification). Nmap also offers flexible target and                port specification, decoy scanning, determination of TCP                sequence predictability characteristics, sunRPC scanning,                reverse-identd scanning, and more.
  http://www.nmap.org/
  http://www.eeye.com/html/Research/Tools/nmapNT.html
• ntop
  ntop is a tool that shows the network usage, similar to what the                popular top Unix command does.
  http://www.ntop.org/
• Nuzzler IDS
  The Securepoint Intrusion Detection System (Nuzzler) allows to                analyse the network for intrusion detection. Nuzzler can detect                possible attacks, viruses, trojans and other bad traffic.
  http://www.securepoint.cc/en/products-ids.html
• Oidview MIB Browser
  MIB browser and snmp toolset for network fault management. Free download for network professionals.
  www.oidview.com/mibbrowser.html
• P2P WatchDog
  P2P WatchDog is a network sniffer which can monitor and               block several Peer-to-Peer file transfer protocols, including               FastTrack, Gnutella,              DirectConnect, EarthStation5, eDonken, Filetopia, BitTorrent,               MP2P, and Overnet.
  http://www.p2pwatchdog.com/
• Pacanal
  Packet capture and analyzer program. The source contains a               C# reimplementation of the packet.dll WinPcap library.
  www.codeproject.com/csharp/pacanal.asp
• Packet Excalibur
  A multi-platform graphical and scriptable network packet                engine with extensible text based protocol descriptions.
  http://www.securitybugware.org/excalibur/
• PacketVB
  Its an ActiveX for use with Visual Basic that wraps the function exported by the WinPcap API (packet.dll).
  http://packetvb.sourceforge.net/
• PacketX
  PacketX is set of ActiveX classes that integrate winpcap                packet capture functionality with Visual Basic or any other                programming environment supporting Microsoft ActiveX technology.
  http://www.beesync.com/products.html
• Packetyzer
  Packetyzer is a Windows user interface for the Ethereal packet                capture and dissection library.
  http://www.packetyzer.com/
• Pcapy
  Pcapy is a Python extension module that interfaces with WinPcap/libpcap. Pcapy enables python scripts to capture packets on the network.
  http://oss.coresecurity.com/projects/pcapy.html
• Pcap.Net
  Pcap.Net is a .net wrapper for WinPcap written in C++/CLI and C#. It Features almost all WinPcap features and includes a packet interpretation framework. It has different advantages over previously existing WinPcap wrappers and is still in development for new features and bug fixes and is written with pretty high standards of coding.
  http://pcapdotnet.codeplex.com/
• PerformaSure
  Sitraka PerformaSure allows J2EE development teams to                identify sources of performance problems within an assembled                application. PerformaSure coordinates the collection of                performance metrics for any given transaction, following the                path of execution from the initial HTTP request through load                balancers, application servers, to the database and back again.
  http://www.sitraka.com/performasure/
• PI IT Monitor
  PI IT Monitor collects real-time information regarding the performance of various elements that compose an IT infrastructure. But in addition to collecting real-time values, PI IT Monitor archives such data and makes them available for use in reporting, analysis, troubleshooting, and decision making.
  http://techsupport.osisoft.com/support_itmonitor.aspx?sub=overview
• PingPlotter
  PingPlotter is a network troubleshooting and diagnostic tool. It uses a combination of traceroute, ping, and whois to collect data quickly, and then allows you to continue to collect data over time to give you the information you really need to identify problems (both short-term and long-term trends).
  http://www.pingplotter.com/
• PromiScan
  Software for remotely monitoring computers on local networks to locate network interfaces operating in a promiscuous mode.
  http://www.securityfriday.com/products/promiscan.html
• PortScanner
  A TCP port scanner.
  http://www.codeproject.com/internet/NagTPortScanner.asp
• PSentry Internet Policy Guard & Surveillance
  PSentry sniffs network traffic at gateway point, captures and records user activites like web surf, emails, web submissions, instant messager sessions (AOL aim, MSN, ICQ, Yahoo, QQ, googletalk). It can log or block ftp, p2p file transfers. PSentry deloys different Internet policies by IP/MAC address or by user, to controls which resource or servce is permited or blocked on a LAN.
  http://www.pluscom.us/
• Pseud IP Masquerade
  Pseud IP Masquerade is a Windows application and NT/2000                Serivce, that has some basic functions of “IP                Masquerade”.
  http://www.ff.iij4u.or.jp/~ebata/soft/pipmasq/
• pypcap
  simplified object-oriented Python extension module for libpcap – the current tcpdump.org version, the legacy version shipping with some of the BSD operating systems, and the WinPcap port for Windows.
  http://monkey.org/~dugsong/pypcap/
• QtNetworkMonitor
  The project is a KISS network monitor that works under both Windows and Linux. It shows how much bandwidth you are taking on a daily basis.
  http://reachme.web.googlepages.com/qtnetworkmonitor
• rawstuff
  rawstuff is a toolkit for totally raw (MAC level and with no                TCP/IP installed) send and receive on Windows.
  http://www.csee.usf.edu/~christen/tools/toolpage.html#tcpip
• Satori
  Satori is a passive OS Fingerprinting tool for Windows. Unlike most other passive tools it parses and tries to use the following protocols for OS Identification: CDP, DHCP, EIGRP, HPSP , HSRP, ICMP, IGMP, HTTP, MDNS, OSPF, SAP, SCCP, SMB, SNMP, STP, TCP, and UPNP with new protocols being added from time to time.
  http://myweb.cableone.net/xnih
• Show Traffic
  Show Traffic monitors network traffic on the chosen network                interface and displays it continuously. It could be used for                locating suspicious network traffic or to evaluate current                utilization of the network interface.
  http://demosten.com/showtraf/
• SIMH
  SIMH is a highly portable, multi-system simulator.
  http://simh.trailing-edge.com/
• Sniphere
  Sniphere is an another network wiretapping program for Windows using winpcap. Nevertheless, Sniphere is a pretty handy program with a lot of possibilities which most of free sniffers do not have.
  http://www.securesphere.net/html/projects_sniphere.php
• SmartSniff
  SmartSniff allows you to capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers. You can view the TCP/IP conversations in Ascii mode (for text-based protocols, like HTTP, SMTP, POP3 and FTP.) or as hex dump.
  http://www.nirsoft.net/utils/smsniff.html
• snoop
  Snoop is component library encapsulating WinPcap used in Delphi.
  http://www.gilgil.co.kr/snoop
• SnoopAnalyzer
  SnoopAnalyzer Standard is a network protocol analyzer based on                network data capturing technology under Microsoft Windows                platforms(95/98/Me/2000/NT/XP).
  http://www.snoopanalyzer.com/snoopanalyzer/standard_01.asp
• SnoopMSNBlock
  SnoopMSNBlock is a software to block MSN messenger service used in your company.
  http://www.snoopanalyzer.com/Dev_BBS/BBSView.asp?bid=DataPDS&sid=-1&idx=389&dpMode=1&SelList=1&no=42&page=1
• SnoopNetCoop
  SnoopNetCop Standard is a program that can detect possible                packet sniffing attack on your network.
  http://www.snoopanalyzer.com/snoopnetcop/standard_01.asp
• snort
  Snort is a lightweight network intrusion detection system,                capable of performing real-time traffic analysis and packet                logging on IP networks.
  http://www.snort.org/
• snot
  Snot is an arbitrary packet generator, that uses snort rules                files as its source of packet information. It can be used as an                IDS evasion tool, by using specific decoy hosts, or just                something to keep your friendly IDS monitoring staff busy.
  http://www.sec33.com/sniph/
• SOAPscope
  SOAPscope is a Web services diagnostic system that collects and analyzes information about SOAP and WSDL by monitoring communications among SOAP endpoints.
  http://www.mindreef.com/
• ssldump
  ssldump is an SSLv3/TLS network protocol analyzer. It identifies                TCP connections on the chosen network interface and attempts to                interpret them as SSLv3/TLS traffic. When it identifies                SSLv3/TLS traffic, it decodes the records and displays them in a                textual form to stdout. If provided with the appropriate keying                material, it will also decrypt the connections and display the                application data traffic.
  http://www.rtfm.com/ssldump/
• STINGA NGN Monitor:
  Protocol analyser focusing on SS7oIP from Utel Systems. Protocols like ISUP (ITU, ANSI, UK), SCCP, TCAP, MAP, INAP, CAP/CAMEL, SMS, IS-41, Megaco/H.248, MGCP, SIP, SDP, RTP, SIP-T (ITU, ANSI, UK, DPNSS/DASS2), SCTP, M2PA, M2UA, M3UA, SUA, IAU, DUA, V5UA, TCP, UDP, IP and others are decoded in detaild by this product.
  http://www.utelsystems.com/
• STINGA SIP Simulator
  Protocol simulator for SIP and SDP protocol testing.
  http://www.utelsystems.com/
• SuperAgent
  This product from NetQoS analyzes application response times                without the need to deploy client-side agents.
  http://www.netqos.com/solutions/superagent/
• TCPKillNT
  TCPKillNT is a TCP connection “Reset” utility for                Microsoft Windows NT platforms. It has the ability to send RST                packets to already established TCP connections. Quite deadly on                a LAN. It is very useful for IDS kind of products which need to                terminate a TCP session.
  http://members.fortunecity.com/sektorsecurity/projects/tcpkillnt.html
• ting
  ting is an OSI layer 4 connectivity assurance tool. It supports                UDP multicast, unicast and TCP/IP. It makes use of the packet                capture library to perform passive multicast monitoring.
  www.ts-associates.com/products/ting.html
• TJesNetMonitor
  Borland C++ Builder wrapper for WinPcap. Comes with a sample application.
  http://delcomyn2.life.uiuc.edu/~reichler/TJesComponents/
• TraceDet
  TraceDet is a Traceroute Detector for Windows NT. Basically, it detects and logs if somebody trace routes to your host. The idea is that when somebody traces to your host, you receive IP packets with TTL value equal to 1. So, TraceDet looks out for such packets.
  http://members.fortunecity.com/sektorsecurity/projects/tracedet.html
• tracetcp
  tracetcp is a command line traceroute utility for WIN32 that uses TCP SYN packets rather than ICMP/UDP packets that the usual implementations use, thus bypassing gateways that block traditional traceroute packets.
  http://tracetcp.sourceforge.net/
• TrafficStatistic
  MZL & Novatech TrafficStatistic shows the consumed traffic volume comfortably in system tray.
  http://www.trafficstatistic.com/
• TrafficWatcher
  A tool to measure network traffic by service (FTP, mail, news, web, UDP etc)
  http://www.codeproject.com/internet/trafficwatcher.asp
• TrafMeter
  TrafMeter is an utility for accounting and realtime monitoring of Internet traffic to and from a local network. It includes flexible filter engine, extensive logging facility and friendly user interface.
  http://www.lastbit.com/trafmeter/
• uIP
  uIP is an implementation of the TCP/IP protocol stack intended for small 8-bit and 16-bit microcontrollers. It provides the necessary protocols for Internet communication, with a very small code footprint and RAM requirements – the uIP code size is on the order of a few kilobytes and RAM usage is on the order of a few hundred bytes.
  http://higepon.monaos.org/moin.cgi/uipForWindows
• Unsniff Network Analyzer
  Unsniff features brand new visualization of packet data, advanced reassembly capabilities, full stream monitoring and several other enhancements over the current crop of network analyzers. What really sets Unsniff apart is its Scripting capabilities. Unsniff allows you to write your own network analysis scripts using the Ruby scripting language.You can also write powerful protocol handlers and other types of plugins using XML and/or C++. Unsniff is even available in Japanese.
  http://www.unleashnetworks.com/
• Url Snooper
  Url Snooper is a a program written to help users locate the urls of audio and video files so that they can be recorded.
  http://www.donationcoder.com/Software/Mouser/urlsnooper/index.html
• VB.PCAP
  VB.PCAP is an “Open Source and completely free” packet capture                 library for Visual Basic (tested on VB5 and VB6, not tested on                 VB.NET) based on Winpcap. The library exposes a set of APIs,                 that wrap aroud Winpcap using the _stdcall convention. The                 library is the foundstone for a network analyzer in VB.
  http://www.lorenzocerulli.tk/
• Viper Chat
  ViperChat is a FREE LAN chat client compatible with Vypress Chat™ protocol version 1.93. It uses UDP communication over WinPcap.
  http://viperchat.hostingprovider.ro/
• VLADescu
  VLADescu is a network content sniffer, it is currently able to recognize gif, jpeg and audio mpeg files. VLADescu listens to network traffic and picks out images and mp3s from sniffed TCP streams. It can be used on local LAN or on wireless network (if your driver supports promiscuous mode, or even better, monitor mode).
  http://www.rostudent.com/robert/VLADescu.html
• WallCooler
  WallCooler is a powerful and flexible VPN solution to access Home or Office computers & networks from anywhere. All Windows based applications are supported, no need to use special applications or synchronize files. Users can remote access organization\’s databases, e-mails, remote desktops, product catalogue… from anywhere. WallCooler sits on the local company network, uses an existing Internet connection and automatically manages incoming connections via relay servers.
  http://help.vedivi.com/gettingstarted/installwallcooler.html
• Warp Pipe
  Warp Pipe is free software that runs on your PC or Mac and is available for Windows, Mac OSX, Linux, and BSD operating systems. While running on your PC or Mac, Warp Pipe allows you to play LAN-enabled Nintendo GameCube games over the Internet with other GameCube gamers.
  http://cubeonline.warppipe.com/
• Watt-32
  Watt-32 is a library for making networked TCP/IP programs in the language of C and C++ under DOS and Windows-NT.
  http://www.bgnett.no/~giva/
• WebSnurf
  Websnurf is a small application that follows a user web-surfing; that is to say, as you run WebSnurf on your PC, you can pursue web-surfing movements made on another PC. Obviously, you have to be connected over the same LAN.
  http://webteca.altervista.org/WebSnurf.htm
• Win32::NetPacket
  Win32::NetPacket is an Object-Oriented interface to the WinPcap packet.dll library.
  http://www.bribes.org/perl/netpacket.html
• Windows ARP Spoofer
  Windows ARP Spoofer (WinArpSpoof) is a program that can scan the computers including network devices and can spoof their ARP tables on local area network and can act as a router while pulling all packets on LAN.
  http://www.nextsecurity.net/
• Windows Toolbox
  The Windows Toolbox is a comprehensive collection of software and information for Windows – a toolbox of high quality applications and utilities for a wide array of functions, all freely re-distributable and under Free, Open Source, Freeware, Shareware or similar licences; documents on installing, configuring and maintaining Windows and various software applications, for stability, performance, usability and security.
  http://thegoldenear.org/toolbox/windows/
• Windump
  WinDump is the Windows version of the famous tcpdump Unix tool. It\’s developed and maintained by the WinPcap team.
  http://www.winpcap.org/windump
• Winfingerprint
  Winfingerprint is a Win32 Host/Network Enumeration Scanner. Winfingerprint is capable of performing SMB, TCP, UDP, ICMP, RPC, and SNMP scans.
  http://winfingerprint.sourceforge.net/
• WinPcapArp
  WinPcapArp is ARP client library that works on Windows OS(NT                and 2000). The main purpose of this library is to get a MAC                address of the target ethernet NIC with the IP address.
  http://www.ff.iij4u.or.jp/~ebata/soft/winpcaparp/
• WinPcapDhcpCD
  WinPcapDhcpCD is a DHCP client demon library that works on                Windows OS (NT and 2000). The purpose of this library is to get                more than one IP addresses in your application program.
  http://www.ff.iij4u.or.jp/~ebata/soft/winpcapdhcpcd/
• winpcapy
  Python port of Winpcap functions using ctypes. Work with Python 2.x and 3 under Linux / Windows. This is a low level implementation, no object or pythonic way, so you need ctypes knowledge to use it.
  http://code.google.com/p/winpcapy/
• WinSniff
  WinSniff is an application for capturing packets on the network. It displays all the packets that are transmitted on the local network and gives detailed information about each header in the packet.
  http://www.codeproject.com/internet/WinSniff.asp
• WinWhif
  WinWhif allows any PC running Windows (95, 98, NT or 2000) to                record the DICOM traffic between two machines on the same                network.  It can be useful in diagnosing DICOM                communications problems.
  http://www.medicalconnections.co.uk/html/winwhif.html
• Wireshark/Ethereal
  Wireshark (formerly known as Ethereal) is the world\’s most popular network analyzer. It allows you to examine data from a live network or                from a capture file on disk. You can interactively browse the                capture data, viewing summary and detail information for each                packet. Wireshark has several powerful features, including a rich                display filter language and the ability to view the                reconstructed stream of a TCP session.
  http://www.wireshark.org/
• wpa_supplicant
  wpa_supplicant is a WPA Supplicant for Linux, BSD and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.
  http://hostap.epitest.fi/wpa_supplicant/
• WIRE1x
  WIRE1x is an open source implementation of IEEE 802.1x client (supplicant). It supports various EAP authentication methods.
  http://wire.cs.nthu.edu.tw/wire1x/
• YATT
  YATT is a project to replace the current proliferation of trace tools ( tcpTrace, proxyTrace, pcapTrace ), with a single extensible tracing tool. YATT features a new GUI built with WTL, complete with a Hex View mode, and currently ships with 2 Trace providers, one based on WinPCAP and one based on the W2K Raw sockets support.
  http://www.pocketsoap.com/
• York
  York logs ip/fqdn addresses if all traffic. It can save sniffed http and ftp files. Also you can sniff for HTTP, FTP, POP3, SMTP, SMB, VNC and AIM password/hash. Further you can see the web browsing from other users, so your browser will show the same pages as the selected user. A screensaver is included, it shows the pictures which are sniffed in a slide show manner.
  http://www.geocities.com/SiliconValley/Platform/1297/misc/york.htm