Difference between socket programming and WonPcap programming

Difference between socket programming and WinPcap programming

Hi friends,
I'm currently using WinPcap for sending and capturing packets on lan.
Could you please tell me the difference between using WinPcap and socket ?
thanks in advance.

Winpcap is generally used to 'listen' to the network. Generally if you're the producer or consumer of particular traffic in the network then you'd use sockets. It would be rare to use winpcap for this, because with winpcap I imagine you're manually assembling a TCP/IP frame. Sockets provides you with a set of functions and a framework for being able to set up comms sessions and receive data into your application based on port numbers, i.e. it understands UDP and TCP layers. (Sockets also keep a memory of the current session states, i.e. it knows the handshake procedures for TCP, because it has a state machine). When you're using a network, you don't want to manually assemble the Ethernet, IP, TCP headers (and checksums...) each time you send a packet or receive a response, and you don't want to manually try to figure out if you've done the correct handshake or if there was a delay, error and so on. The socket functions will just tell you that. Besides, sockets are available on all (most) OSs, unlike winpcap.

you mean WinPcap is mostly used for listening and capturing packets,not for sending packets?Am I right?
So Sockets is a stronger tool...

I'm not sure if it can be used for sending packets, I'm not familiar with it. But it would be a very narrow use-case to want to do that with winpcap type of functionality.
No-one uses winpcap for conventional applications that need access to the network; socket are used, for the reasons mentioned.

In fact WinPcap is also able to send packets as Sockets.Both of them have a certain of capabilities such as capturing, sending and etc.
I wanna know what the basic differences are?
For example I googled this topic and I read that WinPcap works at layer2 while Sockets works at application layer.

Exactly, those are my points. winpcap has no concept of the higher layers, you're manually assembling packets.

With winpcap you get no functions that you can use to establish "connections" to a peer - that entails a framework with knowledge of TCP and session state.
Socket framework provide you with that (and will also provide you with UDP capability).