0

I have a small program that take packets from the nfqueue . change the ip.dst to my server dst (and ttl), recalc checksum and return the packet to the nfqueue.

The server and the client are linux and apache web server is run on the server and listen on port 80. i open telnet in the client to fake ip on port 80 . the packet is changed by my program and sent to the server, but the target server (the new dst ip) get the syn , but dosnt generate syn-ack (the server also belong to me , so i can see that it get the syn with checksum correct , but dosnt generate syn-ack).

if i do the same , but with the real server ip as the dest, the tcp handshake is done correct (in this case i just change the ttl and checksum. The change that i did to the ttl is just a test to see that my checksum calc is ok).

i compare the two syn , but didnt find and difference. Any idea?

Ps. i saw this topic : Server not sending a SYN/ACK packet in response to a SYN packet and i set all flags the same , but this didnt help.

Thank you

Improve this question
2
  • The problem was due to incorrect tcp checksum. i change only ip, so i thought that i need to change only ip check sum , but the tcp check su
    – Avihai Marchiano
    Jul 4, 2012 at 18:40
  • Please finish off the answer.
    – user9517
    Jul 4, 2012 at 19:22

1 Answer 1

Reset to default
0

As a guess as it currently lacks useful info, I reckon your de-queueing this packet from netfilter too late -- after a routing decision has been made and thrown the packet into the local route table.

Try putting your NFQUEUE rule in iptables in the mangle tables PREROUTING chain.

Improve this answer
1
  • Thank you, but i have to do this with my code, since i need to do more manipulations (i started with the basic one). In the target server i see two identical syn, so i don't understand what is the problem. I will upload a wireshark capture.
    – steve
    Jul 2, 2012 at 4:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .