title: Windows Raw sockets capturing packets in wrong order
body: <p>I am developing a packet sniffer based on windows raw socket on windows 7. The program captures packet from IP layer. The issue i am facing here is, Program captures all packets but some of them are captured in wrong order, for eg. for a tcp connection establishment phase, instead of getting packets in SYN , SYN-ACK, ACK order i get it as SYN, ACK, SYN-ACK. Instead of capturing ACK after SYN-ACK(from remote), pgm gets ACK before SYN-ACK packet. Same thing is happening  some times during data transfer phase also. Program captures the ACK packet of a data packet before the actual data packet.  If i run a wireshark in parallel, it displays properly. I am using Visual Studio 2005 as the IDE.</p>
  
  <pre><code>#include "stdio.h"
  #include "winsock2.h"
  #include "ws2tcpip.h"
  #include "pcap.h"
  #include "MSTcpIP.h"
  
  int main(int argc, char **argv)
  {
      struct in_addr addr;
      int in, optval=1;
      struct hostent *local;
      WSADATA wsa;
      char *Buffer;
  
      //Initialise Winsock
      if (WSAStartup(MAKEWORD(2,2), &amp;wsa) != 0)
      {
          printf("WSAStartup() failed.\n");
          return 1;
      }
  
      //Create a RAW Socket
      sniffer = socket(AF_INET, SOCK_RAW, IPPROTO_IP);
      if (sniffer == INVALID_SOCKET)
      {
          printf("Failed to create raw socket.\n");
          return 1;
      }
  
      memset(&amp;dest, 0, sizeof(dest));
      memcpy(&amp;dest.sin_addr.s_addr,argv[1], sizeof(argv[1]));
      dest.sin_family = AF_INET;
      dest.sin_port = 0;
  
      printf("\nBinding socket to local system and port 0 ...");
      if (bind(sniffer,(struct sockaddr *)&amp;dest,sizeof(dest)) == SOCKET_ERROR)
      {
          printf("bind(%s) failed.\n", inet_ntoa(addr));
          return 1;
      }
      printf("Binding successful");
  
      //Enable this socket with the power to sniff : SIO_RCVALL is the key Receive ALL ;)
      j=1;
      printf("\nSetting socket to sniff...");
      if (WSAIoctl(sniffer, SIO_RCVALL, &amp;j, sizeof(j), 0, 0, (LPDWORD) &amp;in , 0 , 0) == SOCKET_ERROR)
      {
          printf("WSAIoctl() failed.\n");
          wprintf(L"IOCTL failed with error %d\n", WSAGetLastError());
      if (WSAIoctl(sniffer, SIO_RCVALL, &amp;j, sizeof(j), 0, 0, (LPDWORD) &amp;in , 0 , 0) == SOCKET_ERROR) {
              printf("Failed again\n");
              wprintf(L"IOCTL failed again with error %d\n", WSAGetLastError());
          return 1;
      }
      }
      printf("Socket set.");
      if(setsockopt(sniffer, IPPROTO_IP, IP_HDRINCL, (char *)&amp;optval, sizeof(optval))==SOCKET_ERROR)
      {
          printf("failed to set socket in raw mode.");
          return 0;
      }
      char *Buffer = (char *)malloc(65536); //Its Big!65536
      do
      {
          mangobyte = recvfrom(sniffer , Buffer , 2000 , 0 , 0 , 0); //Eat as much as u can
  
          if(mangobyte &gt; 0)
          {
              writeCaptofile(Buffer, mangobyte);  //write the captured packet to file in pcap format
          }
          else
          {
              printf( "recvfrom() failed.\n");
          }
      }
      while ((mangobyte &gt; 0) &amp;&amp; (!StopSniffing));
      free(Buffer);
  
      closesocket(sniffer);
      WSACleanup();
      return 0;
  }
  </code></pre>