Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a small program that take packets from the nfqueue . change the ip.dst to my server dst (and ttl), recalc checksum and return the packet to the nfqueue.

The server and the client are linux and apache web server is run on the server and listen on port 80. i open telnet in the client to fake ip on port 80 . the packet is changed by my program and sent to the server, but the target server (the new dst ip) get the syn , but dosnt generate syn-ack (the server also belong to me , so i can see that it get the syn with checksum correct , but dosnt generate syn-ack).

if i do the same , but with the real server ip as the dest, the tcp handshake is done correct (in this case i just change the ttl and checksum. The change that i did to the ttl is just a test to see that my checksum calc is ok).

i compare the two syn , but didnt find and difference. Any idea?

Ps. i saw this topic : Server not sending a SYN/ACK packet in response to a SYN packet and i set all flags the same , but this didnt help.

Thank you

share|improve this question
    
The problem was due to incorrect tcp checksum. i change only ip, so i thought that i need to change only ip check sum , but the tcp check su –  user1495181 Jul 4 '12 at 18:40
    
Please finish off the answer. –  Iain Jul 4 '12 at 19:22
add comment

1 Answer

As a guess as it currently lacks useful info, I reckon your de-queueing this packet from netfilter too late -- after a routing decision has been made and thrown the packet into the local route table.

Try putting your NFQUEUE rule in iptables in the mangle tables PREROUTING chain.

share|improve this answer
    
Thank you, but i have to do this with my code, since i need to do more manipulations (i started with the basic one). In the target server i see two identical syn, so i don't understand what is the problem. I will upload a wireshark capture. –  steve Jul 2 '12 at 4:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.