Re: Mimicking TCP connection

Have you looked in to starting libpcap packet capturing, then running an 
actual, real socket connection? This way, the kernel knows there's a 
socket, and you should (I think) be able to run a packet capture at the 
same time. Just a thought.

--Graeme Connell

Shai Rubin wrote:

>Hi there,
>
>I try to use libpcap and libnet to write a program that will mimic a TCP connection. In other words, my program performs TCP-handshake with a remote machine, sends out some data, analyzes the data it receives from the remote machine, and ends the TCP connection (i.e., FIN sequence). 
>
>While I can capture and send packets, it seems that the Linux kernel interfere with my program. For example, in the TCP-handshake procedure, this is what happens:
>1.	I send a syn
>2.	I get back a synack.
>3.	I send the next ack, but the kernel sends out a reset (RST) packet too (which ruin my handshake).
>
>
>It seems to me that the kernel “does not know” about the connection I’m trying to establish. This seems logical to me because I never use the “legal” interface (e.g., TCP-sockets) to establish this connection. 
>
>How can I prevent the kernel from interfering with my program?
>
>Thanks,
>
>Shai Rubin  
>
>  
>