Re: tcp checksum

Frédéric Raynal <[email protected]> Thu, 27 May 2004 08:18:00 +0200
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>
On Wed, May 26, 2004 at 06:06:24PM +0100, Jee J.Z. wrote:
> Hi all,
> 
> I am struggling with the TCP checksum using libnet_build_tcp() and
> libnet_build_ip(). I set the checksum parameter to 0 in order for libnet to
> calculate the checksum automatically. However, using ethereal to see what I
> injected, the checksum are always incorrect while other information seems no
> problem.
> 
> The whole story is that I capture packets using the libipq library provided
> by netfilter, copy them into a buffer before drop them using libipq, modify
> their src or dst (actually something like nat), and sometime later re-inject
> them using libnet. However, after I modify the dst or src address, the TCP
> checksum seems still the same with the checksum in the previously dropped
> packet -- that is, the calculation of TCP checksum seems not including the
> information of dst and src ip address, which is inconsistance with the
> standard method (counting in the pseudo header of TCP, which includes the
> src and dst IP address).
> 
> Am I missing something obvious? Any ideas are welcome! Thank you in advance.

I guess it depends on how you rebuild and re-inject your packets.

Do you call any builder (libnet_build_[ip|tcp]) before calling
libnet_write() or do you use a direct call to libnet_adv_link_write()
with your hand-made buffer, in which case it is normal that the
checksums are not re-computed.

	Fred Raynal