Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Do all versions of linux permit traffic over raw sockets ?

It seems that in Windows, the releases after Windows XP with SP2 have the ability to send traffic over raw sockets but has been restricted in two ways:

  1. TCP data cannot be sent over raw sockets.
  2. UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

Are there any similar security measures in Linux ? Any ideas ?

Thx in advans, Karthik Balaguru

share|improve this question
add comment

2 Answers

Those are security measures that are annoyances for most. Linux (and NetBSD) is open source, you can just make the kernel do what you want anyway.

The real security is root or not root. This is sane, and the way it should be.

share|improve this answer
    
Compared to the restrictions incorporated by windows, doesn't this look less secure in linux ? –  Karthik Balaguru Jan 7 '10 at 15:58
    
Less secure for whom? You must be superuser to send these packets. The reason Windows can put these restrictions in place is because you cannot just hack the kernel to get around them. Also, malware which wants to spoof packets has a target in windows. That is, Windows is so insecure already, this was an easy target to aim for. Is it less secure that linux allows any header? If you look at it right, I suppose, but in reality no. –  Michael Graff Jan 7 '10 at 16:28
add comment

There's no real security benefit to the restrictions Windows imposes. To actually use raw sockets, you need to be superuser under both Windows and *nix; since you're the superuser, you could simply install your own stub protocol driver on Windows and send whatever packets you feel like. Alternatively, you could patch tcpip.sys (or whatever the appropriate file is) to remove the restrictions, as has been done for the half-open connection limitation. It's more work than simply sending on a SOCK_RAW socket, but it only has to be done once.

All the Windows restrictions do is prevent buggy, and not actively malicious software from causing a problem, break some malware that was current at the time the restrictions were introduced (anything more recent can simply work around the restrictions), and annoy any network administrator or software developer who needs to inject some packets for test purposes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.