WinDump is the porting to the Windows platform of TCPDump. WinDump is fully compatible with TCPDump but introduces some extensions to work better in the Windows environment. The WinDump.exe executable file is linked with libpcap for Win32, therefore can run both under Windows 95/98 and under Windows NT. To run WinDump the correct version of the NDIS packet capture driver and of the packet.dll library must be installed in the system.
Since the differences from WinDump and TcpDump are very few, we provide the HTML version of the manpage of TcpDump, modified to include our additions.
Our WinDump project tries to make a clean and complete porting of TcpDump, therefore the use of the two programs is nearly identical. All the functions offered by TcpDump are implemented in WinDump, so every operation that TcpDump can do in UNIX can be done in Windows with WinDump. In addition, WinDump offers some characteristics that are not present in TcpDump:
The problems encountered during the porting of WinDump are more or less the same that we had during the porting of the pcap library (see the section on libpcap). We had to import some include files from Linux, and we put them in the Win32-Include directory. Moreover, we wrote some Windows specific code to handle things like Winsock and the Windows NT UNICODE format. This code is in the file Win32-Src\w32_fzs.c. Finally we had to modify Tcpdump.c, the file containing the main() function, to add the new switches of the command line.
However, the porting of TCPDump was easier than the porting of the pcap library. In fact TCPDump, using the functions exported by libpcap, does not interact directly with the system. This makes it quite easy to port.
We isolated all our changes to the original sources through the use of #ifdef and #ifndef like in the following example
#ifdef WIN32 /* source code for Windows */ #endif |
Therefore, the code of WinDump is compatible with the code of TcpDump, and can be compiled under UNIX, generating the normal TcpDump executable.