Re: question when using options in headers..

Hey Mustafa,

You might want to check out tcpreplay 2.0 which does this already.  
You can either use it or rip out the code you need (it's BSD 
licensed).  If you want to use the code, look at the 
fix_checksums() function in edit_packet.c and do_packets() in
do_packets.c.

[Note, I don't use ptags or any of the other "advanced" features
in libnet to do this.  I just read the raw frame from the pcap 
file or live network, and use overlays for the frame.  The
only problem with this is on architectures that are strictly aligned
(like SPARC) and don't like jumping 14bytes in for the ethernet
header (requires some memcpy'ing to work around that).]

http://tcpreplay.sf.net/

Regards,
Aaron

-- 
Aaron Turner <aturner at pobox.com|synfin.net>  http://synfin.net/
They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety. -- Benjamin Franklin
All emails are PGP signed; a lack of a signature indicates a forgery.

On Sat, Feb 07, 2004 at 02:36:03AM +0000, Mustafa Abu Sedera wrote:
> 
> First of all, thank you very much, Mike Shiffman, for your reply.
> 
> I tried out these things (and other) the last week and still have problems 
> and kindly ask for your help.
> 
> I am writing a program which captures packets using libpcap from 
> eth0(subnet) then resends them from eth1(main LAN) with a different source 
> IP (kind of NATing). After I capture the packet I rebuild it depending on 
> it's protocol so that libnet computes the checksums for me as they change 
> after this packet alternation.
> 
> I use tcpdump to sniff the packets going out from eth1 and get a false 
> checksum for my tcp packets and i noticed only those, which contain options. 
> for icmp packets I don't get errors and they work fine because i get 
> replies. udp i didn't test yet.
> 
> If you please could take a look at the attached file which contains the 
> function i use, don't worry it isn't too long and easy to understand. i 
> spent about the whole day debugging and couldn't find out what's wrong.
> And i still don't know wether to use ptags or libnet_clear_packet() so if 
> you have any suggestions please tell me.
> Sorry for the long massage.
> Best regards.
> 
> >From: Mike Schiffman <[email protected]>
> >To: "Mustafa Abu Sedera" <[email protected]>
> >CC: [email protected]
> >Subject: Re: question when using options in headers..
> >Date: Wed, 28 Jan 2004 09:01:51 -0800
> >
> >q1: Yes that is correct ordering. See sample/tcp1.c for a sample 
> >application using TCP options. To answer the second part: Not using the 
> >options builder function. Since the options string will actually have its 
> >own pblock, if you save existing ptags, then call builder functions inside 
> >of a loop using those ptags, the next call to a builder function WITHOUT a 
> >saved ptag will generate a new pblock at the end of the list. Two things 
> >you can try: 1) place your TCP or IP options inside the payload and adjust 
> >the appropriate header values. 2) try calling an options builder with a 0 
> >sized payload and save its ptag. I kinda doubt this second one will work 
> >though; there is a ton of pointer math and indirection going on inside the 
> >options builders.
> >
> >q2: It all depends on your needs. If you're only sending packets one at a 
> >time with a fire and forget mentality, use only one context. If you need to 
> >send multiple packets over and over again, use the cq interface.
> >
> >q3: I just tested the advanced mode and it worked fine as of 1.1.2-rc-05. 
> >Can you be more specific with your error? Are you sure you initialized the 
> >library properly?
> 
> _________________________________________________________________
> Protect your PC - get McAfee.com VirusScan Online 
> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963



-- 
Aaron Turner <aturner at pobox.com|synfin.net>  http://synfin.net/
They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety. -- Benjamin Franklin
All emails are PGP signed; a lack of a signature indicates a forgery.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFAJUjlhweYF/hu2uYRAv+EAJ94JRRwPx9rYdUXMImapk1jsXcmKwCeIaGu
W4SYu2f9wWnD86BgX8+SobQ=
=6hDL
-----END PGP SIGNATURE-----