Re: Code working with LIBNET_RAW4, not with LIBNET_LINK

I'm not expecting bidirectional traffic; what made you think that?  I started 
tcpdump on the target machine, as I stated below.  All I want is for the 
packet to get there. 

Thanks for the recommended code - the it uses libnet_autobuild_ethernet, which 
appears to be new as of 1.1, apparently.  That the only thing in the doc 
directory about it is a reference to its existence in the MIGRATION file, but 
I was able to figure it out - it's a pretty simple function.  And it works - 
packets are making it to their destination now.  Thanks, everyone!

 - Karen

On Thursday 20 January 2005 12:14 pm, Mike Schiffman wrote:
> Dump the relevant code to the list.
>
> PS: Why would you expect to see bi-directional IP traffic from <Source>
> to <Target> using udp2.c or tcp1.c? As you noted, they're using
> non-legit MAC addresses. In fact, assuming your host OS allows you to
> spoof the source MAC address, you should only see the outgoing UDP and
> TCP packets, with no response from <Target>. If you want to try an
> experiment, go ahead and replace the hardcoded enet_src and enet_dst
> with the proper MAC addresses of the machines in question.
>
> PPS: If you want sample code of dynamic MAC address assignment, check
> out Firewalk 5.0 (http://www.packetfactory.net/projects/firewalk).
>
> On Jan 20, 2005, at 12:32 AM, Karen Pease wrote:
> > On Wednesday 19 January 2005 2:10 pm, you wrote:
> >> Read through the sample code that comes with libnet
> >> (www.packetfactory.net/libnet). This sounds like a simple problem that
> >> could be solved by seeing the relevant code.
> >
> > Actually, I did run into these previously when searching the net; they
> > were no
> > help.  They don't work, and I can't see how they would work.  For
> > example,
> > lets look at the one that's closest to what I'm doing - udp2.c.  It
> > sets the
> > destination mac to the value of enet_dst.  This variable isn't
> > modified at
> > all in udp2.c - it is defined, initialized, and never changed in
> > libnet_test.h, as:
> >
> > u_char enet_dst[6] = {0x00, 0x10, 0x67, 0x00, 0xb1, 0x86};
> >
> > A preset hwaddr?  How could that possibly work?
> >
> > It doesn't, at least when I've tried it.  Lets call my machine Source,
> > and the
> > other machine Target.  First off, I shut off iptables on Source and
> > Target,
> > just in case.  Now, running tcpdump on the target machine as follows:
> >
> > [root@ipl3 kpease]# /usr/sbin/tcpdump | grep <Source>
> > tcpdump: listening on eth0
> >
> > Now, lets test the tcpdump by pinging the computer:
> >
> > 02:15:24.398157 <Source> > <Target>: icmp:echo request (DF)
> > 02:15:26.044271 <Source> > <Target>: icmp:echo request (DF)
> > 02:15:26.470916 <Source> > <Target>: icmp:echo request (DF)
> >
> > Etc.  So, we know it's working.  So, I try:
> >
> > while true; do ./udp2 -s <Source> -d <Target> -P 22; done
> >
> > Not a thing shows up (port 22 is not only unblocked, but open and
> > recieving
> > connections, as evidenced from nmap from Source).  So, lets try tcp
> > there:
> >
> > while true; do ./tcp1 -s <Source>:30000 -d <Target>.22; done
> >
> > Not a thing.  Once again, it's using that hard coded mac addr, so I
> > can't see
> > how it would make it.
> >
> > So, enough with the samples - to my code.  Here's what gets sent when
> > I use
> > LIBNET_RAW4:
> >
> > 00:31:45.778733 IP <Source>.30000 > <Target>.http: UDP, leng
> >         0x0000:  0020 e035 5440 0050 046c e730 0800 4500
> > [email protected].
> >         0x0010:  0026 8d68 0000 4011 1d41 c0a8 0003 81ff
> > .&[email protected]......
> >         0x0020:  8d73 7530 0050 0008 ba3f 0102 0304 0506
> > .su0.P...?......
> >         0x0030:  7465 7374                                test
> >
> > And here is with LIBNET_LINK
> >
> > 00:34:07.799767 IP <Source>.30000 > <Target>.http: UDP, leng
> >         0x0000:  0004 758f 1153 0050 046c e730 0800 4500
> > ..u..S.P.l.0..E.
> >         0x0010:  0026 0000 0000 4011 aaa9 c0a8 0003 81ff
> > .&....@.........
> >         0x0020:  8d73 7530 0050 0008 ba3f 0102 0304 0506
> > .su0.P...?......
> >         0x0030:  7465 7374                                test
> >
> > Looking at the ethernet header, we find:
> >
> > LIBNET_RAW4: Dest MAC: 00 20 e0 35 54 40
> > LIBNET_LINK: Dest MAC: 00 04 75 8F 11 53
> >
> > Source MAC: 00 50 04 6C E7 30
> >
> > Ethertype: 08 00
> >
> > What I don't get is why LIBNET_RAW uses 00 20 e0 35 54 40.  Because,
> > in my
> > test case, I hard-coded the target machine's mac addr - here's its
> > output
> > from ifconfig:
> >
> > eth0      Link encap:Ethernet  HWaddr 00:04:75:8F:11:53
> >           inet addr:<Target>  Bcast:<TargetBcast> Mask:255.255.255.0
> >           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
> >           RX packets:8662615 errors:0 dropped:0 overruns:1 frame:0
> >           TX packets:1625176 errors:0 dropped:0 overruns:0 carrier:0
> >           collisions:0 txqueuelen:1000
> >           RX bytes:2317535814 (2210.1 Mb)  TX bytes:996608893 (950.4
> > Mb)
> >           Interrupt:17 Base address:0xd400
> >
> > So, in short, I'm confused.
> >
> >  - Karen
>
> --
> Mike Schiffman, CISSP
> http://www.packetfactory.net/schiffman
> Doveryay No Proveryay