Re: Problem w/IP raw sockets and Solaris

Sam Tannous <[email protected]> Tue, 18 May 2004 15:37:07 -0400
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>
On Wed, May 19, 2004 at 12:51:19AM -0000, [email protected] wrote:
> 
> 
> I found this problem while trying to compile a simple packet generator in Solaris OS. In Libnet 1.1.2, when you call libnet_write(l) on a raw packet write for any IP packet, the IP_ID field is overwritten w/random data. Testing w/the sample code shows that for tcp1.c (non-raw packet write), the IP_ID field stays set to 242 or 0x00f2. When running tcp2.c (raw packet write) the IP_ID field is still set manually to 242 in the src code, but when inspecting the packet off the wire through ethereal, the IP_ID field is changed to a random value and that it increments by one w/every packet that is sent out. I have tested this on Solaris 7 and 8, w/the same results. Are there any fixes for this? 

that's raw sockets on Solaris for you....I remember reading this in a FAQ somewhere
(search on google with "solaris raw socket id-field" and it should jump out
at you).  To set the ID field yourself, you need to drop down one layer
and do a few extra things (at the link layer) (in python, it's only 5 extra lines ;-)

Regards,
Sam Tannous