#include "stdafx.h"
#include <windows.h>

#define TCPDUMP_PATH "c:\\Downloads\\tcpdump_trial_license\\tcpdump.exe"
#define TCPDUMP_ARG "-t -p -n -i 3 -c100 -w-"

int _tmain(int argc, _TCHAR* argv[])
{
SECURITY_ATTRIBUTES sat;
HANDLE hRead,hWrite;
STARTUPINFO startupinfo;
PROCESS_INFORMATION pinfo;


DWORD cnt=1;
unsigned char buf[1024];


sat.lpSecurityDescriptor=NULL;
sat.nLength=sizeof(SECURITY_ATTRIBUTES);
sat.bInheritHandle=TRUE;

if(CreatePipe(&hRead,&hWrite,&sat,NULL)==NULL){perror("not CreatePipe");}
else {
	startupinfo.cb=sizeof(STARTUPINFO);
	GetStartupInfo(&startupinfo);
	startupinfo.hStdOutput=hWrite;
	//startupinfo.hStdError=hWrite;
	startupinfo.dwFlags=STARTF_USESHOWWINDOW+STARTF_USESTDHANDLES;
	startupinfo.wShowWindow=SW_HIDE;

	if(CreateProcess(TCPDUMP_PATH,TCPDUMP_ARG,
	NULL,NULL,TRUE,NULL,NULL,NULL,&startupinfo,&pinfo)==NULL){perror("not CreateProcess");}
	else {
		CloseHandle(hWrite);
		while(1)
			{
			RtlZeroMemory(&buf,sizeof(buf));
			if(ReadFile(hRead,&buf,sizeof(buf)-1,&cnt,NULL)==NULL){break;}
			
			/*--------------------
			обработка потока buf 
			======================*/


			}
		}
	CloseHandle(hRead); }

return 0;
}