Question

Can't capture my Spoofed SYN packet by ethereal...

Asked by: gotdough

Several days ago I wrote a spoofing SYN c++ program, I execute it on one PC, sending the spoofed syn to my own computer. But I can't see any SYN packets by running ethereal on my own computer. I captured only one IP(but protocol I set in the spoofed syn is TCP) packet, the info is: IPv6 hop-by-hop option(0x00) , and this IP packet used the real source ip, not the spoofed source ip I set in the program... I want to know if there is anything wrong with my program? Can anyone help me? Thanks in advance. Both computers' system are XP, and the program is the following:

int _tmain(int argc, _TCHAR* argv[])
{
                class SpoofSocket spoof_socket;

      WSADATA WSAData;
      int ret=WSAStartup(MAKEWORD(2,2),&WSAData);

      //Create Raw_Socket
      bool ip_hdrincl=true;
      int SendTimeOver=1000;

      SOCKET raw_sock=WSASocket(AF_INET,SOCK_RAW,IPPROTO_IP,NULL,0,WSA_FLAG_OVERLAPPED);                  
      setsockopt(raw_sock,IPPROTO_IP,IP_HDRINCL,(char *)&ip_hdrincl,sizeof(ip_hdrincl));      
      setsockopt(raw_sock,SOL_SOCKET,SO_SNDTIMEO,(char *)&SendTimeOver,sizeof(SendTimeOver));
      
      unsigned int s_ipAddress=inet_addr("192.168.0.103");
      unsigned int d_ipAddress=inet_addr("192.168.0.104");
      unsigned short s_port=2006;
      unsigned short d_port=8000;
      unsigned int seq=0x00000000;
      unsigned int ack=0x00000001;

      //Spoof buffer for sending
      spoof_socket.SetIP_Head_Buffer(s_ipAddress,d_ipAddress);
      spoof_socket.SetTCP_Head_Buffer(s_port,d_port,2,seq,ack+1);
                              
      int len=spoof_socket.tcp_head_len+spoof_socket.ip_head_len;
                                    
      SOCKADDR_IN addr_client1_in;
      addr_client1_in.sin_family=AF_INET;
      addr_client1_in.sin_port=htons(d_port);
      addr_client1_in.sin_addr.S_un.S_addr=d_ipAddress;
                                    
      int send_bytes=sendto(raw_sock,spoof_socket.SendBuffer,len,0,(struct sockaddr*)&addr_client1_in,sizeof(addr_client1_in));
                              
      Console::WriteLine(S"Send one SYN+ACK success!!!");

      closesocket(raw_sock);
      WSACleanup();

      char i;
      cin>>i;
            
      return 0;
}

spoofsocket.cpp:
unsigned short SpoofSocket::checksum(unsigned short *buffer,int size){

      unsigned short cksum=0;
    while(size>1)
      {
            cksum+=*buffer++;
            size-=sizeof(unsigned short);
      }
      if(size)
      {
            cksum+=*(unsigned char*)buffer;
      }
      cksum=(cksum>>16) + (cksum&0xffff);
      cksum+=(cksum>>16);

      return cksum;

};

void SpoofSocket::SetIP_Head_Buffer(unsigned long SourceAddress,unsigned long DestAddress){

      //Set ip_header
      ip_header.h_lenver=(4<<4|sizeof(ip_header)/sizeof(unsigned int));
      ip_header.tos=0;
      ip_header.total_len=htons(sizeof(ip_header)+sizeof(tcp_header));
      ip_header.ident=1;
      ip_header.flags=0;
      ip_header.ttl=(unsigned char)GetTickCount()%87+123;
      ip_header.proto=IPPROTO_TCP;
      ip_header.checksum=0;
      ip_header.sourceIP=SourceAddress;
      ip_header.destIP=DestAddress;
};

void SpoofSocket::SetTCP_Head_Buffer(unsigned short SourcePort,unsigned short DestPort,unsigned char flag,unsigned long seqNumber,unsigned long ackNumber){

      //Set tcp_Header
      tcp_header.th_dport=htons(DestPort);
      tcp_header.th_sport=htons(SourcePort);
      tcp_header.th_seq=htonl(seqNumber);
      tcp_header.th_ack=htonl(ackNumber);
      tcp_header.th_lenres=(sizeof(tcp_header)/4<<4|0);
      tcp_header.th_flags=flag;//flag=2 is SYN; flag=16 is ACK; flag=12 is SYN_ACK
      tcp_header.th_win=htons(512);
      tcp_header.th_urp=0;
      tcp_header.th_sum=0;

      //Set TCP psudHeader
      psd_header.saddr=ip_header.sourceIP;
      psd_header.daddr=ip_header.destIP;
      psd_header.mbz=0;
      psd_header.ptcl=IPPROTO_TCP;
      psd_header.tcpl=htons(sizeof(tcp_header));

      //Get header length
      psd_head_len=sizeof(psd_header);
      tcp_head_len=sizeof(tcp_header);
      ip_head_len=sizeof(ip_header);

      send_buffer=new BYTE[psd_head_len+tcp_head_len];

      //Compute the Checksum value
      memset(send_buffer,0,psd_head_len+tcp_head_len);
      memcpy(send_buffer,&psd_header,psd_head_len);
      memcpy(send_buffer+psd_head_len,&tcp_header,tcp_head_len);
      tcp_header.th_sum=checksum((unsigned short *)send_buffer,psd_head_len+tcp_head_len);

      
      send_buffer=new BYTE[tcp_head_len+ip_head_len];

      //put spoofed IP and TCP header into the SendBuffer
      memset(send_buffer,0,tcp_head_len+ip_head_len);
      memcpy(send_buffer,&ip_header,ip_head_len);
      memcpy(send_buffer+ip_head_len,&tcp_header,tcp_head_len);
      ip_header.checksum=checksum((unsigned short *)send_buffer,ip_head_len+tcp_head_len);

      memset(send_buffer,0,tcp_head_len+ip_head_len);
      memcpy(send_buffer,&ip_header,ip_head_len);
      memcpy(send_buffer+ip_head_len,&tcp_header,tcp_head_len);
      char SendBuffer[60]={0};
      memcpy(SendBuffer,send_buffer,tcp_head_len+ip_head_len);
};

spoofsocket.h
typedef struct ip_head{

      unsigned char h_lenver; //four bits for header length;four bits for IP version
      unsigned char tos;     //eight bits for Type of Service
      unsigned short total_len;// 16bits for total length
      unsigned short ident;
      unsigned short flags; //3flags
      unsigned char ttl;
      unsigned char proto;
      unsigned short checksum;
      unsigned int sourceIP; //32bits source IP
      unsigned int destIP;//32bits destination IP

}IPHEADER;

typedef struct tcp_head{

      unsigned short th_sport;//16bits source port
      unsigned short th_dport;//16bits destination port
      unsigned int th_seq;//32bits sequence number
      unsigned int th_ack;//32bits confirmation number
      unsigned char th_lenres;//four bits for header length;four bits for restoring key words
      unsigned char th_flags;//6flags
      unsigned short th_win;//16bits windows size
      unsigned short th_sum;//16bits checksum
      unsigned short th_urp;//16bits urgent data offsets

}TCPHEADER;

//define TCP pseudHeader
typedef struct ts_head{

      unsigned long saddr;
      unsigned long daddr;
      char mbz;
      char ptcl;//protocol type
      unsigned short tcpl;//TCP length

}PSDHEADER;

class SpoofSocket {

public:
      SpoofSocket(){};
      ~SpoofSocket(){};
      unsigned short checksum(unsigned short *,int);
      void SetIP_Head_Buffer(unsigned long SourceAddress,unsigned long DestAddress);
      void SetTCP_Head_Buffer(unsigned short SourcePort,unsigned short DestPort,unsigned char flag,unsigned long seqNumber,unsigned long ackNumber);
      
      unsigned short psd_sport;
      bool result;
      char SendBuffer[60];
      BYTE * send_buffer;
      int psd_head_len;
      int tcp_head_len;
      int ip_head_len;

      TCPHEADER tcp_header;
      PSDHEADER psd_header;
      IPHEADER ip_header;      
};

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2006-02-13 at 06:20:58ID21734440
Tags

raw_sock

,

capture

,

syn

Topic

C++ Programming Language

Participating Experts
2
Points
250
Comments
11

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. typedef struct
    Hi, I've written a program that receives some data over a socket connection. I receive the data as a character array.... char *pData=(char*)calloc(1,USSP_RESSIZE); while(nError == WSAEWOULDBLOCK) { nBytes = socket.Receive(pData, USSP_RESSIZE, MSG_PEEK); switch(nB...
  2. global typedef
    I try to make a linked list class for my school project and got some problem with typedef thing. MY HEADER FILE LOOKS LIKE (list.h): struct node; struct dataTypeList; typedef dataTypeList itemListType; class list { public: list(); ~list(); void getItem(item...
  3. Typedef problem
    I have a problem with a typedef. This typedef works fine when the funtion Test is global but not when its within the class. #H file typedef void (*MYVOIDPOINTER)(int,int,int); struct CrapyStruct { MYVOIDPOINTER voidPointer; }; class MyClass { void Test(int,int,int); };...
  4. Dependent typedef problem (not yet declared struct in a st…
    Hi, I have a problem typedefing a struct that uses another struct that uses the first struct! still there? Is there a way to do that (I'd like to avoid void pointers if possible) Thanks typedef struct _one { char* s1; char* s2; Second* data; } First; typedef s...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: itsmeandnobodyelsePosted on 2006-02-13 at 08:46:11ID: 15942718

Did you check WSAGetLastError() after sendto has failed?

send_bytes has a value of -1 if sendto failed.

Regards, Alex

 

by: grg99Posted on 2006-02-13 at 09:19:38ID: 15942990

This usually means the packet has a bad checksum so everybody ignores it.

Can you set etherreal to accept "bad" packets too?

another possibility--  if your PC's are hooked together by something other than a really dumb hub, that little box may be tossing out packets that are obviously faked.  have you been able to make a good unspoofed packet and receive it on the other PC?  I'd try that first.



 

by: gotdoughPosted on 2006-02-13 at 09:52:28ID: 15943308

1, the send_bytes returns correct, 40 bytes.
2, I have made the test with the unspoofed packets between the two computers, they all are captured correctly.
This problem have confused me serveral days. . .

 

by: grg99Posted on 2006-02-13 at 10:17:44ID: 15943532

So what is connecting your PC's?

Any firewall software anywhere?

 

by: gotdoughPosted on 2006-02-13 at 10:45:35ID: 15943768

no firewall , just a router , and the router connects to ISP, maybe there is a firewall at the ISP end.

 

by: itsmeandnobodyelsePosted on 2006-02-13 at 10:50:27ID: 15943815

>>>> Any firewall software anywhere?

With XP SP 2 you got a firewall that would prevent packages from passing. You would need to switch off the firewall (you can do that if your internet connection does *not* use the same LAN and C-Net 192.168.0) or configure the firewall to open ports 2006 and 8000.

Regards, Alex

 

by: itsmeandnobodyelsePosted on 2006-02-13 at 10:53:06ID: 15943839

>>>>  no firewall , just a router

There is no modern router without a firewall ...

Try to configure the router.

Did you use XP SP2 ?

Regards, Alex
 

 

by: itsmeandnobodyelsePosted on 2006-02-13 at 10:57:54ID: 15943885

>>>> and the router connects to ISP, maybe there is a firewall at the ISP end.

No, if you connect to local IP addresses like 192.168.0.104 your ISP isn't involved. The router acts like a local hub/switch. But the default configuration wouldn't open port 2006 or port 8000.

Regards, Alex

 

by: gotdoughPosted on 2006-02-13 at 11:04:57ID: 15943957

then, you mean it didn't send out the spoofed packet at all, but why I captured a packet from the sending-spoofed-packet machine?

 

by: itsmeandnobodyelsePosted on 2006-02-13 at 11:21:33ID: 15944118

>>>> but why I captured a packet from the sending-spoofed-packet machine?

Maybe you should explain your configuration a little more in detail. Actually, I don't know what a sending-spoofed-packet machine is and what might be different to the machine where it doesn't work. What's about your XP firewalls? Are they on or off?

 

by: grg99Posted on 2006-02-13 at 12:18:24ID: 15944632

Your router or XP's routers and firewalls may be blocking spoofed packets.

Routers and firewalls are smart enough to notice that a particular hardware address that has been saying it's   192.168.8.2 for the last 343,432 packets, is now claiming to be 33.55.66.77.   Of course that is impossible.  So the packet gets dropped.

You need a dumb HUB, one that doesnt inspect each packet.  They're available on eBay for $0.99 to $4.99 usually.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...