Re: libnet_write

FYI, this function will appear in the next official release.

On Jun 5, 2004, at 4:33 PM, Mustafa Abu Sedera wrote:

>
> You can capture the packets and modify whatever bytes you want then 
> recompute checksums using libnet_do_checksum() and send the packet out 
> to the wire using libnet_adv_write_link().
>
> if you want to save the headache of ARPing send the buffer via raw 
> sock using this function i used in one of my programs:
>
> int
> libnet_adv_write_raw(libnet_t *l, u_int8_t *packet, u_int32_t len)
> {
>    u_int c;
>
>    if (l == NULL)
>    {
>        return (-1);
>    }
>
>    /* assume error */
>    c = -1;
>
>    switch (l->injection_type)
>    {
>        case LIBNET_RAW4_ADV:
>            if (len > LIBNET_MAX_PACKET)
>            {
>                snprintf(l->err_buf, LIBNET_ERRBUF_SIZE,
>                        "%s(): packet is too large %d\n", __func__, 
> len);
>                return (c);
>            }
>            c = libnet_write_raw_ipv4(l, packet, len);
>            break;
>
>        case LIBNET_RAW6_ADV:
>            c = libnet_write_raw_ipv6(l, packet, len);
>            break;
>
>        default:
>            snprintf(l->err_buf, LIBNET_ERRBUF_SIZE,
>                "%s(): advanced raw mode not enabled\n", __func__);
>            return (-1);
>    }
>
>    /* do statistics */
>    if (c == len)
>    {
>        l->stats.packets_sent++;
>        l->stats.bytes_written += c;
>    }
>    else
>    {
>        l->stats.packet_errors++;
>        /*
>         *  XXX - we probably should have a way to retrieve the number 
> of
>         *  bytes actually written (since we might have written 
> something).
>         */
>        if (c > 0)
>        {
>            l->stats.bytes_written += c;
>        }
>    }
>
>    return (c);
> }
>
> This function is actually the same like adv_write_link (), it just 
> sends a buffer "packet" with length "len" through handle "l"  but you 
> don't have to care about the ethernet header.The kernel will take care 
> of this. Note that you must initialize the libnet handle to 
> LIBNET_RAW4_ADV.
>
> I hope I could help you a little bit.
>
> Mustaffa Abu Sedira
>
>> From: "Jee J.Z." <[email protected]>
>> To: <[email protected]>
>> CC: <[email protected]>
>> Subject: Re: libnet_write
>> Date: Sat, 5 Jun 2004 14:08:54 +0100
>>
>> Hi Amit,
>>
>> I'm afraid, yes. At least this is what I'm doing, since I still don't 
>> need a large bandwidth at the moment. Maybe in the future I'll get in 
>> trouble. If you find a better way to do it, please let me know. 
>> Thanks.
>>
>> Jee
>>
>> >
>> >
>> > Hi
>> >
>> > 1. can libnet_write write packets that were not built in the libnet 
>> context
>> > ? i dont think so.
>> > 2. that means if i capture a TCP packet and inject it back using 
>> libnet
>> > functions, say even without any changes at all(to headeror 
>> payload), I need
>> > to reconstruct the tcp header using the call libnet_build_tcp() and 
>> then
>> > build the ip_header using libnet_build_ip() and only then i can 
>> write it
>> > using libnet_write() ?? !!, is there no way of passing a pointer to 
>> a raw
>> > packet(one which we created, or caught and now want to reinject) 
>> without
>> > going through these build functions, because as you can see calling 
>> all
>> > these build functions for packets which were caught and are now 
>> being
>> > reinjected after a delay involves a lot of overhead ??
>> >
>> > thanks
>> > Amit
>> >
>> >
>> > "DISCLAIMER: This message is proprietary to Hughes Software Systems 
>> Limited
>> > (HSS) and is intended solely for the use of the individual to whom 
>> it is
>> > addressed. It may contain  privileged or confidential information 
>> and
>> > should not be circulated or used for any purpose other than for 
>> what it is
>> > intended. If you have received this message in error, please notify 
>> the
>> > originator immediately. If you are not the intended recipient, you 
>> are
>> > notified that you are strictly prohibited from using, copying, 
>> altering, or
>> > disclosing the contents of this message. HSS accepts no 
>> responsibility for
>> > loss or damage arising from the use of the information transmitted 
>> by this
>> > email including damage from virus."
>> >
>> >
>
> _________________________________________________________________
> Tired of spam? Get advanced junk mail protection with MSN 8. 
> http://join.msn.com/?page=features/junkmail
>
>
> !DSPAM:40c37268128976619914366!
>
>
--
Mike Schiffman, CISSP
http://www.packetfactory.net/schiffman
Doveryay No Proveryay