TCP handshake with SOCK_RAW socket

Question

Ok, I realize this situation is somewhat unusual, but I need to establish a TCP connection (the 3-way handshake) using only raw sockets (in C, in linux) -- i.e. I need to co

Answer 1

I can't help you out on any tutorials.

But I can give you some advice on the tools that you could use to assist in debugging.

First off, as bmdhacks has suggested, get yourself a copy of wireshark (or tcpdump - but wireshark is easier to use). Capture a good handshake. Make sure that you save this.

Capture one of your handshakes that fails. Wireshark has quite good packet parsing and error checking, so if there's a straightforward error it will probably tell you.

Next, get yourself a copy of tcpreplay. This should also include a tool called "tcprewrite". tcprewrite will allow you to split your previously saved capture files into two - one for each side of the handshake. You can then use tcpreplay to play back one side of the handshake so you have a consistent set of packets to play with.

Then you use wireshark (again) to check your responses.

Answer 2

if you are using raw sockets, if you send using different source mac address to the actual one, linux will ignore the response packet and not send an rst.

Answer 3

I realise that this is an old thread, but here's a tutorial that goes beyond the normal SYN flooders: http://www.enderunix.org/docs/en/rawipspoof/

Hope it might be of help to someone.

Answer 4

I don't have a tutorial, but I recently used Wireshark to good effect to debug some raw sockets programming I was doing. If you capture the packets you're sending, wireshark will do a good job of showing you if they're malformed or not. It's useful for comparing to a normal connection too.

Answer 5

Depending on what you're trying to do it may be easier to get existing software to handle the TCP handshaking for you.

One open source IP stack is lwIP (http://savannah.nongnu.org/projects/lwip/) which provides a full tcp/ip stack. It is very possible to get it running in user mode using either SOCK_RAW or pcap.

Answer 6

You want to implement part of a TCP stack in userspace... this is ok, some other apps do this.

One problem you will come across is that the kernel will be sending out (generally negative, unhelpful) replies to incoming packets. This is going to screw up any communication you attempt to initiate.

One way to avoid this is to use an IP address and interface that the kernel does not have its own IP stack using- which is fine but you will need to deal with link-layer stuff (specifically, arp) yourself. That would require a socket lower than IPPROTO_IP, SOCK_RAW - you need a packet socket (I think).

It may also be possible to block the kernel's responses using an iptables rule- but I rather suspect that the rules will apply to your own packets as well somehow, unless you can manage to get them treated differently (perhaps applying a netfilter "mark" to your own packets?)

Read the man pages

socket(7) ip(7) packet(7)

Which explain about various options and ioctls which apply to types of sockets.

Of course you'll need a tool like Wireshark to inspect what's going on. You will need several machines to test this, I recommend using vmware (or similar) to reduce the amount of hardware required.

Sorry I can't recommend a specific tutorial.

Good luck.