IpSpy Version 1.40                                        31.May.98

Short description:
           IpSpy is a DLL which allows to monitor all the packets,
           IP and ARP ones, incoming, outgoing and forwarding.
           It also provides the ability to write raw packets to your net.
            
Requirements:
           INET and IFNDIS.
           Only tested with OS/2 Warp V3.0 and tcpip 3.0.

Start:
           IpSpy_Init(ULONG *ulHandle, UCHAR *pchIF);
             Opens a specific interface for monitoring.
             ulHandle    -   address of the handle for the interface
             pchIF       -   address of the interface name which is
                             one of the following: lo, lan0, ppp0, sl0 ...
Stop:
           IpSpy_Exit(ULONG ulHandle);
             Close the interface.
             ulHandle    -   monitor handle obtained from IpSpy_Init

Read:
           IpSpy_ReadRaw(ULONG ulHandle, VOID *data, USHORT *usLength, USHORT *usType, ULONG *ulTimeStamp, USHORT *usUnknown);
             Reads raw packets from the interface.
             ulHandle    -   monitor handle obtained from IpSpy_Init
             data        -   address of the buffer to receive the bytes read
             usLength    -   address of the length, in bytes, of the data area
                             AFTER CALL: contains the length of the packet
             ulTimeStamp -   address of the timestamp from the packet
             usUnknown   -   unknown

Write:
           IpSpy_WriteRaw(ULONG ulHandle, VOID *data, USHORT usLength, USHORT usType, ULONG ulTimeStamp, USHORT usUnknown);
             Writes raw packets to the interface.
             ulHandle    -   monitor handle obtained from IpSpy_Init
             data        -   address of the buffer that contains the data to write
             usLength    -   address of the number of bytes to write
             ulTimeStamp -   address of the timestamp from the packet
             usUnknown   -   unknown

Adapter's Receive Mode:
           IpSpy_SetReceiveMode(USHORT usMode, UCHAR *pchIF, PVOID pvReserved);
             Provides the ability to bring the adapter in promiscous mode.
             usMode      -   bitmask of desired receive mode
             pchIF       -   address of the interface name which is
                             one of the following: lo, lan0, ppp0, sl0 ...
             pvReserved  -   reserved

             Promiscuous mode is when the Network card accepts all
             packets, not only the packets which match our
             Address. It is useful for writing a network monitor,
             but it is also a security problem. You have to remember
             that all information on the net is not encrypted.

             Note:
              Most Token Ring adapters do not support promiscuous mode.

             Before use this function for the first time, you must modify
             your \IBMCOM\PROTOCOL.INI
             You  must  add  the  following 3 lines at the end of the file:
              [IPSPY_NIF]
              drivername = IPSPY$
              bindings = MYMAC
             where MYMAC is the section name of the MAC adapter driver
             you want to use.(only one adapter is supported)

             Also add following line at the end of your CONFIG.SYS:
              DEVICE=[PATH]\IPSPY.OS2

             After you have made these changes, you must reboot your PC.

Filters:
           iptest.c is an example of an icmp packet filter.

           iptracx.c writes packets to the file iptrace.dmp,
           which can later be analysed by ipformat.exe.

           If you write your own filter, i am interested in it.

Docu:
           No Docu's. This software packet is only for
           programmers with a lot of tcp/ip experience, and
           the examples should be enough explanation.


Warning:
           IpSpy slows the tcp/ip stack significantly
           and SHOULD NOT be run for a stressful applications which
           tend to fan through a lot of data.

Usage and distribution:
           PROVIDED FILES CAN NOT BE USED FOR ANY COMMERCIAL
           PURPOSES WITHOUT AUTHORIZATION.
           PROVIDED FILES CAN BE FREELY DISTRIBUTED ON THE CONDITION
           THAT NO FEE IS CHARGED AND THAT THE ORIGINAL 
           CONTENTS IS PRESERVED (NO ADDITIONS OR OMISSIONS). 
           SINCE THIS FILES ARE PROVIDED FREE OF CHARGE THERE
           IS ABSOLUTELY NO WARRANTY OR CLAIM AS TO THEIR
           QUALITY OR FITNESS FOR ANY PARTICULAR PURPOSE.

 Copyright (c) 1997 Edgar Buerkle, 100566.557@compuserve.com

History:
 1.00   first release.
 1.10   IpSpy_WriteRaw() implemented.
 1.20   Bugfix: timestamp allways 0 and internal transmit buffer too small.
        Thanks to Olaf Ernst for the bug report.
 1.30   IpSpy_(Set/Query)ReceiveMode() implemented.
 1.31   IpSpy_GetLastSocketError implemented.
        PPP frames are softwareLoopback frames (in iptest.c) ?
        Suppress Netbind.exe message: PRO0021.
        The <Requirements:> statement was wrong in this readme file.
          I tested IpSpy only with tcpip version 3.0.
          IpSpy don't works with tcpip 2.00 without fixpacks.
        Thanks to Romney White for the bug report.
 1.32   Added SLIP and PPP support to iptest filter.
        Added IpTracx
 1.40   Added support for 32 bit stack 5.300(tcpip 4.1)
