在没有管理员帐户的情况下捕获原始套接字(SOCK_RAW)

Question

我有以下代码,它捕获一些TCP数据包.但它要求程序以管理员身份运行.如何修改此代码,以便即使使用非管理员帐户,该程序也能正常工作？

    public void startSniffer()
    {
        bContinueCapturing = true;

        mainSocket = new Socket(AddressFamily.InterNetwork, SocketType.Raw, ProtocolType.IP);

        mainSocket.Bind(new IPEndPoint(IPAddress.Parse(Properties.Settings.Default.IPaddr), 0));
        mainSocket.SetSocketOption(SocketOptionLevel.IP, SocketOptionName.HeaderIncluded, true);

        byte[] byTrue = new byte[4] { 1, 0, 0, 0 };
        byte[] byOut = new byte[4] { 1, 0, 0, 0 }; 


        mainSocket.IOControl(IOControlCode.ReceiveAll, byTrue, byOut);

        mainSocket.BeginReceive(byteData, 0, byteData.Length, SocketFlags.None, new AsyncCallback(OnReceive), null);

    }

    public void OnReceive(IAsyncResult ar)
    {
        int nReceived = mainSocket.EndReceive(ar);

        ParseData(byteData, nReceived);

        if (bContinueCapturing)
        {
            byteData = new byte[4096];

            mainSocket.BeginReceive(byteData, 0, byteData.Length, SocketFlags.None, new AsyncCallback(OnReceive), null);
        }

    }

Answer 1

根据MSDN的文章SIO_RCVALL,这是非托管等效的IOControlCode.ReceiveAll:

设置此IOCTL需要本地计算机上的管理员权限.

要回答您的问题,没有管理员权限就无法完成.