Re: Mimicking TCP connection

All,
Thank you for the replies. I will try them and let you know.
Just few comments:

1. Using a socket to open the connection. I tried that before. It does 
not really solve the problem because after the handshake the kernel 
continues to send  responses (acks) when a packet arrive. This interfere 
with my "real" TCP connection.

2. Seems like the "solution" is to use a different IP address. But this 
requires messing with the arp, which will require more time.

3. I will try the iptables filter to drop outgoing packets that the 
kernel produces. I wonder however, why an iptables filter will filter 
those packets and not the packet I generate with libnet.

Thanks again,

Shai


Mustafa Abu Sedera wrote:
> Hello there,
> I had the same problem. I asked in the libpcap mailing list and got te 
> following suggestions...
> 
> 1- use iptables rules to set up rules which prevent the packets -which 
> you send the syns for-  from getting to the kernel
> 
> 2- send the packests from the interface using a different source ip than 
> that of the interface but on the same network (use an unused ip on your 
> lan). then sniff in promiscous mode, set up a libpcap filter to only 
> capture packets destined to this new source ip you used and wait for the 
> replies. like this you would have like 2 ips for the same 
> interface...one for the kernel, which is the real ip of the interface, 
> and the other, the  "virtual" one is for your own usage without the 
> kernel interfering.
> 
> I hope you understood what I mean..
> please ask me if you didn't.
> regards,
> Mustaffa Abu Sedira
> 
> 
>> From: Shai Rubin <[email protected]>
>> To: [email protected]
>> Subject: Mimicking TCP connection
>> Date: 6 Aug 2004 11:36:16 -0000
>>
>>
>>
>> Hi there,
>>
>> I try to use libpcap and libnet to write a program that will mimic a 
>> TCP connection. In other words, my program performs TCP-handshake with 
>> a remote machine, sends out some data, analyzes the data it receives 
>> from the remote machine, and ends the TCP connection (i.e., FIN 
>> sequence).
>>
>> While I can capture and send packets, it seems that the Linux kernel 
>> interfere with my program. For example, in the TCP-handshake 
>> procedure, this is what happens:
>> 1.    I send a syn
>> 2.    I get back a synack.
>> 3.    I send the next ack, but the kernel sends out a reset (RST) 
>> packet too (which ruin my handshake).
>>
>>
>> It seems to me that the kernel “does not know” about the connection 
>> I’m trying to establish. This seems logical to me because I never use 
>> the “legal” interface (e.g., TCP-sockets) to establish this connection.
>>
>> How can I prevent the kernel from interfering with my program?
>>
>> Thanks,
>>
>> Shai Rubin
> 
> 
> _________________________________________________________________
> Protect your PC - get McAfee.com VirusScan Online 
> http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
>