Re: tcp checksum

Hi Jeez

  Yes  a packet coming out of the local machine will hit both the
NF_IP_LOCAL_OUT hook and the NF_IP_POST_ROUTING hook.

HTH
Amit




"Jee J.Z." <[email protected]> on 05/27/2004 10:49:10 PM

To:    Amit Kumar Singh/HSS@HSS, <[email protected]>
cc:    <[email protected]>

Subject:    Re: tcp checksum


Hi Amit and Fred,

Thank you for your reply. Yes, I didn't call enough functions before
libnet_write(). I used to use only libnet_build_tcp() and then
libnet_build_ipv4(), however, I missed libnet_build_tcp_options(), because
the packets I captured and wish to reinject include 8-byte tcp header
option. And I figured out the proper sequence of using these functions are:
libnet_build_tcp_options()->libnet_build_tcp()->libnet_build_ipv4()->libnet_

write(); otherwise things would happen weird.

On the other hand, are there any relatively complete tutorials on the
newest
version libnet? I never found one, and many instructions on web are still
for old versions and therefore are somewhat misleading. I never came across
libnet_build_tcp_options() until looked into the source codes at
libnet_build_tcp.c, and I never knew the sequence of using these "build"
functions until I tried it, which is clearly hard for a new user to grasp
libnet. Anybody has the same problem?

Amit, what do you think it happens when a packet with a dst address of
another machine is injected into the kernel? Will it hit the POST routing
hook? I am asking this because my SNAT on POSTROUTING seems invalid to my
injected packets. What do you think?

Many thanks,
Jee


----- Original Message -----
From: <[email protected]>
To: "Jee J.Z." <[email protected]>
Cc: <[email protected]>
Sent: Thursday, May 27, 2004 7:27 AM
Subject: Re: tcp checksum


> Hi Jee
>
>     thats wierd ... i havent tried filling checksum by setting the sum
> paramter to libnet_build_tcp to 0, but just saw libnet help, it says it
> autofills when sum parameter is set to 0, so what you are doing seems
fine
> and yes for checksum calculation purposes the pseudo header is also used,
> so incase you have the same checksum for both the packets then thats
really
> wierd. You can try filling the checksum field yourself, and then compare
> the two checksum fields ( one you calculate and one filled in by libnet).
> Maybe we are missing some simple libnet trick here ...
>
> Amit
>
>
>
>
> "Jee J.Z." <[email protected]> on 05/26/2004 10:36:24 PM
>
> To:    <[email protected]>
> cc:    Amit Kumar Singh/HSS@HSS
>
> Subject:    tcp checksum
>
>
> Hi all,
>
> I am struggling with the TCP checksum using libnet_build_tcp() and
> libnet_build_ip(). I set the checksum parameter to 0 in order for libnet
to
> calculate the checksum automatically. However, using ethereal to see what
I
> injected, the checksum are always incorrect while other information seems
> no
> problem.
>
> The whole story is that I capture packets using the libipq library
provided
> by netfilter, copy them into a buffer before drop them using libipq,
modify
> their src or dst (actually something like nat), and sometime later
> re-inject
> them using libnet. However, after I modify the dst or src address, the
TCP
> checksum seems still the same with the checksum in the previously dropped
> packet -- that is, the calculation of TCP checksum seems not including
the
> information of dst and src ip address, which is inconsistance with the
> standard method (counting in the pseudo header of TCP, which includes the
> src and dst IP address).
>
> Am I missing something obvious? Any ideas are welcome! Thank you in
> advance.
>
> Jee
>
>
>
>
>
>