RE: Mimicking TCP connection

Hello there,
I had the same problem. I asked in the libpcap mailing list and got te 
following suggestions...

1- use iptables rules to set up rules which prevent the packets -which you 
send the syns for-  from getting to the kernel

2- send the packests from the interface using a different source ip than 
that of the interface but on the same network (use an unused ip on your 
lan). then sniff in promiscous mode, set up a libpcap filter to only capture 
packets destined to this new source ip you used and wait for the replies. 
like this you would have like 2 ips for the same interface...one for the 
kernel, which is the real ip of the interface, and the other, the  "virtual" 
one is for your own usage without the kernel interfering.

I hope you understood what I mean..
please ask me if you didn't.
regards,
Mustaffa Abu Sedira


>From: Shai Rubin <[email protected]>
>To: [email protected]
>Subject: Mimicking TCP connection
>Date: 6 Aug 2004 11:36:16 -0000
>
>
>
>Hi there,
>
>I try to use libpcap and libnet to write a program that will mimic a TCP 
>connection. In other words, my program performs TCP-handshake with a remote 
>machine, sends out some data, analyzes the data it receives from the remote 
>machine, and ends the TCP connection (i.e., FIN sequence).
>
>While I can capture and send packets, it seems that the Linux kernel 
>interfere with my program. For example, in the TCP-handshake procedure, 
>this is what happens:
>1.	I send a syn
>2.	I get back a synack.
>3.	I send the next ack, but the kernel sends out a reset (RST) packet too 
>(which ruin my handshake).
>
>
>It seems to me that the kernel “does not know” about the connection I’m 
>trying to establish. This seems logical to me because I never use the 
>“legal” interface (e.g., TCP-sockets) to establish this connection.
>
>How can I prevent the kernel from interfering with my program?
>
>Thanks,
>
>Shai Rubin

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963