comparison to SharpPCap?

Jul 16, 2010 at 11:58 AM


Is it ok if I ask what are the differences between this library and the SharpPCap library?  (hoping someone might have played with both)



Aug 12, 2011 at 6:20 AM

Hi callagga,


I haven't played much with SharpPcap, but I believe there are different in WinPcap wrapping architecture and with Packet interpretation design.

From what I remember, SharpPcap's WinPcap wrapper uses PInvoke to call WinPcap, while Pcap.Net uses C++/CLI. PInvoke is considered less efficient and is more limiting than C++/CLI.

SharpPcap uses inheritance of packets to build and interpret different packets, while Pcap.Net uses composition.

That means that in SharpPcap, a TCP packet inherits from an IP packet, which inherits from an Ethernet packet while in Pcap.Net a TCP packet is a packet which you simply interprets as a packet that contains Ethernet, the body of the Ethernet is interpreted as IP and the body of IP is interpreted as TCP.
I believe Pcap.Net's approach gives much more flexibility since everything can contain everything (in theory) and in Pcap.Net you just need to declare what can contain what instead of explicitly building a packet for each possible packet.

For example, consider this packet:

Ethernet IP IP IP TCP.

In SharpPcap you need to create a special class for that, while in Pcap.Net it is simply declared that Ethernet can contain IP and, IP can contain IP or TCP.

The different designs also affect the flexibility of building packets and performance issues, which I haven't compared but I know that Pcap.Net avoids copying data.


I hope this helps,