Re: Any way to automatically change arbitrary headers of IP packets on-the-fly?

From: Manu Garg (manugarg_at_gmail.com)
Date: 04/20/05 

Date: Wed, 20 Apr 2005 02:26:32 -0400
To: Joćo Paulo Caldas Campello <protecao@gmail.com>

If you are willing to write some code, then you can write a small
kernel module which will collect all the packets from ethernet card.
You get the packet, manipulate it, recalculate the checksum and push
it back to the card. I have tried doing this to manipulate some other
fields. It works.

For reference see the following article from phrack:
http://www.phrack.org/phrack/55/P55-12

cheers,
~Manu

On 4/15/05, Joćo Paulo Caldas Campello <protecao@gmail.com> wrote:
> On 4/14/05, Valdis.Kletnieks@vt.edu <Valdis.Kletnieks@vt.edu> wrote:
>
> > Currently, iptables doesn't seem to support that, probably to keep you from
> > shooting yourself in the foot. Consider for example how fast the kernel will
> > fold up if you change that first nybble of the packet from an x'4' to an x'6'
> > without changing the rest of the packet to match. Suddenly, that sk_buff is
> > a lot too short.. ;)
>
> Yeah, maybe, who knows :P
>
> Well, I've did some searching last days and found a couple ways to
> achieve what I've described in my email.
>
> One is using "DIVERT sockets" and other is the use of the "-j QUEUE"
> target of iptables/netfilter. Both approaches are similar: you match a
> packet using iptables to flush them to userspace, where you can mangle
> the entire packet as you like and send it back to iptables, who will
> put it again onto the stack.
>
> The "-j QUEUE" approach is manipulated through the "libipq" API:
>
> - netfilter can feed userspace using IPQUEUE:
> * http://www.crhc.uiuc.edu/~grier/projects/libipq.html
>
> - Perl:
> * http://www.intercode.com.au/jmorris/perlipq/
>
> - Python:
> * http://woozle.org/~neale/src/ipqueue/
>
> As you can see, there's already libraries written in Perl and Python
> to query IPQUEUE, so the effort of writing userspace code to deal with
> IP packets wiil be much more easier.
>
> That's it =)
>
> Cheers,
>
> Joćo Paulo.
> 

-- 
Manu Garg
http://manugarg.freezope.org
"Truth will set you free!"

Relevant Pages

  • Re: Can I send out an ethernet packet with over 1500 bytes in linux ?
    ... >Or can I use a cisco router to generate this kind of packet? ... site-wide spam filters at catherders.com. ...
    (comp.os.linux.networking)
  • Re: Can a standard NIC be triggered to send an electrical signal?
    ... With a normal 10Base-T Ethernet card normally when nothing ... presenting the data of the data packet. ... When Ethernet card is transmitting data, you get bits on the line. ... Take a look at my electronics web links and documents at ...
    (comp.dcom.lans.ethernet)
  • Re: how to use dev_queue_xmit()
    ... Ramy Asselin wrote: ... > I'm trying to put some packets out on my ethernet card, ... > Starting packet transmissions ... The data pointer needs to point to a valid memory buffer, ...
    (comp.os.linux.development.system)
  • Re: Can a standard NIC be triggered to send an electrical signal?
    ... Say I write a program that creates a packet and inject it on the line. ... > With a normal 10Base-T Ethernet card normally when nothing ... > card sends a set of electrical signal pulses to the line... ... > When Ethernet card is transmitting data, you get bits on the line. ...
    (comp.dcom.lans.ethernet)
  • Re: Cant ping into or outof Redhat box
    ... > are lights on on the ethernet card and the link/activity light on the ... > the tx packet count goes up but that's it. ... > If I change the router to a hub I get the same results. ...
    (comp.os.linux.networking)