Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

Karen,

It seems that there is a router between the machines that you are
testing with. In that case packets will travel like this:

Source ---> Router ----> Target

In case of LIBNET_RAW4, it correctly finds out the mac address of
router NOT the target. That's why it's working.

In case of LIBNET_LINK, you are hardcoding the mac address of the
target and packet never finds any such destination.

cheers,
-Manu

On Thu, 20 Jan 2005 02:32:13 -0600, Karen Pease
<[email protected]> wrote:
> On Wednesday 19 January 2005 2:10 pm, you wrote:
> > Read through the sample code that comes with libnet
> > (www.packetfactory.net/libnet). This sounds like a simple problem that
> > could be solved by seeing the relevant code.
> 
> Actually, I did run into these previously when searching the net; they were no
> help.  They don't work, and I can't see how they would work.  For example,
> lets look at the one that's closest to what I'm doing - udp2.c.  It sets the
> destination mac to the value of enet_dst.  This variable isn't modified at
> all in udp2.c - it is defined, initialized, and never changed in
> libnet_test.h, as:
> 
> u_char enet_dst[6] = {0x00, 0x10, 0x67, 0x00, 0xb1, 0x86};
> 
> A preset hwaddr?  How could that possibly work?
> 
> It doesn't, at least when I've tried it.  Lets call my machine Source, and the
> other machine Target.  First off, I shut off iptables on Source and Target,
> just in case.  Now, running tcpdump on the target machine as follows:
> 
> [root@ipl3 kpease]# /usr/sbin/tcpdump | grep <Source>
> tcpdump: listening on eth0
> 
> Now, lets test the tcpdump by pinging the computer:
> 
> 02:15:24.398157 <Source> > <Target>: icmp:echo request (DF)
> 02:15:26.044271 <Source> > <Target>: icmp:echo request (DF)
> 02:15:26.470916 <Source> > <Target>: icmp:echo request (DF)
> 
> Etc.  So, we know it's working.  So, I try:
> 
> while true; do ./udp2 -s <Source> -d <Target> -P 22; done
> 
> Not a thing shows up (port 22 is not only unblocked, but open and recieving
> connections, as evidenced from nmap from Source).  So, lets try tcp there:
> 
> while true; do ./tcp1 -s <Source>:30000 -d <Target>.22; done
> 
> Not a thing.  Once again, it's using that hard coded mac addr, so I can't see
> how it would make it.
> 
> So, enough with the samples - to my code.  Here's what gets sent when I use
> LIBNET_RAW4:
> 
> 00:31:45.778733 IP <Source>.30000 > <Target>.http: UDP, leng
>         0x0000:  0020 e035 5440 0050 046c e730 0800 4500  [email protected].
>         0x0010:  0026 8d68 0000 4011 1d41 c0a8 0003 81ff  .&[email protected]......
>         0x0020:  8d73 7530 0050 0008 ba3f 0102 0304 0506  .su0.P...?......
>         0x0030:  7465 7374                                test
> 
> And here is with LIBNET_LINK
> 
> 00:34:07.799767 IP <Source>.30000 > <Target>.http: UDP, leng
>         0x0000:  0004 758f 1153 0050 046c e730 0800 4500  ..u..S.P.l.0..E.
>         0x0010:  0026 0000 0000 4011 aaa9 c0a8 0003 81ff  .&....@.........
>         0x0020:  8d73 7530 0050 0008 ba3f 0102 0304 0506  .su0.P...?......
>         0x0030:  7465 7374                                test
> 
> Looking at the ethernet header, we find:
> 
> LIBNET_RAW4: Dest MAC: 00 20 e0 35 54 40
> LIBNET_LINK: Dest MAC: 00 04 75 8F 11 53
> 
> Source MAC: 00 50 04 6C E7 30
> 
> Ethertype: 08 00
> 
> What I don't get is why LIBNET_RAW uses 00 20 e0 35 54 40.  Because, in my
> test case, I hard-coded the target machine's mac addr - here's its output
> from ifconfig:
> 
> eth0      Link encap:Ethernet  HWaddr 00:04:75:8F:11:53
>           inet addr:<Target>  Bcast:<TargetBcast> Mask:255.255.255.0
>           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
>           RX packets:8662615 errors:0 dropped:0 overruns:1 frame:0
>           TX packets:1625176 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:1000
>           RX bytes:2317535814 (2210.1 Mb)  TX bytes:996608893 (950.4 Mb)
>           Interrupt:17 Base address:0xd400
> 
> So, in short, I'm confused.
> 
>  - Karen
> 


-- 
Manu Garg
http://manugarg.freezope.org
"Wake Up! Free Thyself."