Re: Problem w/Latest version of Libnet on Solaris sparc...

Mike Schiffman <[email protected]> Fri, 18 Jun 2004 11:03:24 -0700
Newsgroups gmane.comp.security.libnet
Message-ID <[email protected]>
This is not a bug, this is how the Solaris kernel handles raw IP 
packets. Check out doc/RAWSOCKET_NON_SEQUITUR for more information. If 
this behavior is a problem, use libnet's link layer interface 
(LIBNET_LINK*) instead of the raw socket interface (LIBNET_RAW*).

On Jun 3, 2004, at 5:11 AM, <[email protected]> wrote:

>
>
> I've noticed that the IP_ID field in packets generated by libnet on a 
> solaris system is mangled on an libnet_write function call. This seems 
> to happen only in raw write mode and as far as I can tell, and only on 
> Solaris sparc systems (although, I haven't yet tried it on a solaris 
> intel, but it doesn't seem to be a problem on either SUSE or RedHat). 
> The problem can be seen by running the sample code: tcp2.c. In the 
> code, the IP_ID field is set to be 242 (dec), but when the packet is 
> captured off the line, it is a random number. I've tried debugging it 
> through GDB, but still can't find where it is being mangled.
>
> !DSPAM:40bf4ba316941044011380!
>
>
--
Mike Schiffman, CISSP
http://www.packetfactory.net/schiffman
Doveryay No Proveryay