Vulnerability Development mailing list archives

Re: help: raw_ip socket and system implication


From: Brian O'Berry <brian () oberry org>
Date: Tue, 20 Nov 2001 12:22:01 -0500

W. Richard Stevens, "Unix Network Programming," 2nd Ed., bottom of page 708:

... any reply to the TCP segments that we generate [via a raw socket] will normally cause our TCP to respond with an RST...

One way around this is to send the TCP segments with a source IP address that belongs to the attached subnet but is not currently assigned to some other node. Add an ARP entry to the sending host for this new IP address so that the sending host will answer ARP requests for this new address. But do not configure the new IP address as an alias. This will cause the IP stack on the sending host to discard packets received for this new IP address, assuming that the sending host is not acting as a router.


qgiorgi () respublica fr wrote:

hello, I am trying to figure out a problem i have seen with a tcp/ip stack of an equipement, but i need some help in order to finish my C code :) I read this mailing-list for quite a long time and i am sure there are some gurus here :)) I successfully emulate a tcp client for the three handshake with raw-ip socket (with all the tcp options, seq num etc.. i wanted ), but when i received the second packet the system send also a RST back to the host i am trying to connect to, which is for my system point of view an unsollicited SYN/ACK packet. so i have -> SYN <- SYN/ACK -> RST ( system part ) :( -> ACK ( my prog ) ...

Does anybody have a mean to prevent the system to send this RST ? Any help will be appreciated :) Quentin.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Découvrez sur Respublica et sur les sites du Groupe Tiscali France
une barre de navigation pour accéder en 1 clic aux meilleurs contenus et services du Web.

http://www.libertysurf.fr/minisite/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~





Current thread: