checksum in raw sockets and pcap

Posted by hero on Server Fault See other posts from Server Fault or by hero
Published on 2010-03-22T06:26:54Z Indexed on 2010/03/22 6:31 UTC
Read the original article Hit count: 561

Filed under:

pcap

|

tcp

|

raw-sockets

i am using pcap library to sniff some packets, change their tcp data , and then inject my packet on the network.
my question is: if i changed in the tcp data, should i recalculate the length field in the tcp header? should i also change the checksum? i read in a page on how to create raw sockets that if you set the tcp_checksum to 0, the kernel will automatically calculate it and fill it, is this true for windows machines also?

© Server Fault or respective owner

Related posts about pcap

Issue reading packets from a pcap file. dpkt

as seen on Stack Overflow - Search for 'Stack Overflow'
I am running the following test script to try to read packets from a sample .pcap file I have downloaded. import socket import dpkt import sys pcapReader = dpkt.pcap.Reader(file("test1.pcap", "rb")) for ts, data in pcapReader: ether = dpkt.ethernet.Ethernet(data) if ether.type != dpkt.ethernet… >>> More
pcap stream rotation and pruning

as seen on Server Fault - Search for 'Server Fault'
Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping only the N most recent Does not re-use output filenames Is self-contained (Ruling out, e.g., a rotation… >>> More
How to send pcap file packets on NIC?

as seen on Stack Overflow - Search for 'Stack Overflow'
I have some network traffic captured pcap file and want to send its packets on NIC; is it possible? Is there any application to do this? >>> More
help using pcap library to sniff packets

as seen on Stack Overflow - Search for 'Stack Overflow'
i am using pcap sample codes to create my own sniffer. i downloaded their sample sniffer and its working on windows but not on linux. i am using gcc compiler on both machines, and i have only pcap.h included. the error is : dereferencing pointer to incomplete type. the netmask is causing the error… >>> More
question about pcap

as seen on Stack Overflow - Search for 'Stack Overflow'
hi, i have to do a sniffer as an assignment for the security course. i am using c and the pcap library. i got everything working well (since i got a code from the internet and changed it). but i have some questions about the code. u_int ip_len = (ih->ver_ihl & 0xf) * 4; ih is of type… >>> More

Related posts about tcp

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

as seen on Server Fault - Search for 'Server Fault'
Hey, Recently I had a web developer come to me and ask why he was receiving connection errors in his app that was accessing a sql database. So, I went through my normal trouble shooting steps to isolate or reproduce the issue. I discovered that if I connected to the database using Query Analyzer… >>> More
iptables issue on plesk

as seen on Server Fault - Search for 'Server Fault'
i don't know how to open a specific port (rtmp=1935) on my CentOS server using Plesk or itables. I created new rules for port 1935 i/o using Plesk/Modules/Firewall but this doesn't work. Nmap scanning tells me this : 1935/tcp filtered rtmp . So i decided to have look at my iptable using SSH (iptables… >>> More
Httpd problem, suspect an attack but not sure

as seen on Server Fault - Search for 'Server Fault'
On one of my servers when I type netstat -n I get a huge output, something like 400 entries for httpd. The bandwidth on the server isn't high, so I'm confused as to what's causing it. I'm suspecting an attack, but not sure. Intermittently, the web server will stop responding. When this happens… >>> More
Why can blocked IPs get through my iptables? What's wrong with this configuration?

as seen on Server Fault - Search for 'Server Fault'
(Why can/How are) blocked IPs (get/getting) through my iptables? Hello and thanks for your consideration... I have configured iptables and included (below) output from the command "iptables --line-numbers -n -L" yet IP addresses (like 31.41.219.180) from IP blocks I have already blocked are getting… >>> More
iptables syn flood countermeasure

as seen on Server Fault - Search for 'Server Fault'
I'm trying to adjust my iptables firewall to increase the security of my server, and I found something a bit problematic here : I have to set INPUT policy to ACCEPT and, in addition, to have a rule saying iptables -I INPUT -i eth0 -j ACCEPT. Here comes my script (launched manually for tests) : #… >>> More