Netresec is proud to announce the release of RawCap, which is a free raw sockets sniffer for Windows. Rawcap can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback).

Netresec is proud to announce the release of RawCap, which is a free raw sockets sniffer for Windows.

Features:

Can sniff any interface that has got an IP address, including 127.0.0.1 (localhost/loopback)
RawCap.exe is just 17+ KB
No external libraries or DLL's needed
No installation required, just download RawCap.exe and sniff
Can sniff most interface types, including WiFi and PPP interfaces
Minimal memory and CPU load
Reliable and simple to use

Usage

RawCap takes two arguments; the first argument is the IP address or interface number to sniff from, the second is the path/file to write the captured packets to.

Raw sockets limitations in Vista and Win7
Due to current limitations in the raw sockets implementations for Windows Vista and Windows 7 we suggest running RawCap on Windows XP. The main problem with raw socket sniffing in Vista and Win7 is that you might not receive either incoming packets (Win7) or outgoing packets (Vista).

  Download