Julia used ARP spoofing to pretend a different IP address, and someone commented about using tap/tun interfaces instead. My kernel: lol wtf I never asked for this! RST! I will just quote Julia's explaining here: my Python/Ruby program: SYN Julia described this in her article, instead of what we think of how it would work, it didn't.Īs the picture shown, after receiving SYNACK packet from, a RST packet was sent (obviously not by us). Step 2: Kernel sends a RST after receiving the SYNACK packet In this step, I'm gonna ignore the part of how SEQ and ACK number work, you could check this article to learn more. So for SYNACK packets, tcp flags would be: 010010, the value would be 16 + 2 = 18.īpf is super powerful, and if you would like to know more examples, check tcpdump manpage. We could see that the last six bits of fourteenth byte stand for tcp flags, and the previous two bits are both 0. What does tcp=18 mean? Here is the TCP Header Format: Let's say we just want the SYNACK packets. Tcpdump also uses bpf filter to filter packets you want. tcp and src 216.58.221.142 means we would like to filter tcp packets from ip 216.58.221.142, which are exactly what we want to parse. The filter parameter for PacketFu::Capture is very interesting, it's a bpf filter and you could find the syntax documentation here. each do | pkt | # parse pkt and decide what to do next puts pkt end new ( iface: config, start: true, filter: "tcp and src 216.58.221.142" ) cap. require 'packetfu' cap = PacketFu :: Capture. to_wįor ack packet, just set pkt.tcp_flags.ack = 1.Īs to read response, we need to filter packets from the interface. new ( config: config, flavor: "Linux" ) synpkt. With PacketFu, sending a packet is pretty simple: require 'packetfu' config = PacketFu :: Utils. Pseduo codes could be something like this: send_syn_packet I don't think I could write the stack in such a short time without it, it's really awesome. I use a gem called PacketFu to read and write packets. open a raw network socket that lets me send TCP packets. What we would like to do here is, I quote from Julia's blog: My codes are here: larrylv/teeceepee, the name teeceepee is borrowed from Julia's repo: jvns/teeceepee. In this post, I'm going to follow Julia's steps and blog some implementation details. This week, I decided to give it a try and it turns out to be really fun. I saved Julia's article in my Pocket, then moved it to my browser bookmark folder, but never touched it again. I read Julia's article What happens if you write a TCP stack in Python? last year, and since then I really wanted to implement a TCP stack in Ruby language.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |