« VNCAdmin rewrite in the works! | Main | ARP this! »

What's in your packet?

For the past few weeks I've been delving as deeply as I can into TCP/IP coding, especially dealing with raw sockets and raw packet data. It's terribly interesting. My first epiphany was that a packet coming off the network card is just a string of characters, (unsigned chars). To make working with this string easier, you can map it directly to C structures which allows you to fill in the specific fields of the packet and shoot it off to the wire. This also works in reverse for reading and getting data out of the packets. Excellent!

So now I'm reading and writing the raw packets I need to be able to send any kind of scan I want, (SYN, FIN, etc), but I need to be able to read the right ones! I can send a SYN packet to a machine, but I need to get the reply back, whether it be a SYN/ACK or a RST or any other possibilities. Using the libpcap library I can capture/filter packets easily, however it seems the library functions for capturing block program execution like a stop light, so I'm thinking that I need to look into spawning a packet filtering thread. Sounds reasonable to me.

TrackBack

TrackBack URL for this entry:
http://www.aviditysoftware.com/cgi-bin/mt/mt-tb.cgi/5

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)

About

This page contains a single entry from the blog posted on October 11, 2005 11:33 AM.

The previous post in this blog was VNCAdmin rewrite in the works!.

The next post in this blog is ARP this!.

Many more can be found on the main index page or by looking through the archives.