Question

我在Windows上创建了一个ping实用程序。我使用带有ICMP协议的原始套接字。我是我电脑的本地管理员。

由于代码很多，我不想将其粘贴到此处，但我发现了一个与我winsock2advancedrawsocket11b http://www.winsocketdotnetworkprogramming.com/winsock2programming/winsock2advancedrawsocket11b.html非常相似的示例

我下载它，测试我得出结论，它与我的问题相同。我在TTL过期时（在IP标头中）没有收到响应。我虽然使用RAW套接字让我看了吗？

让我们说我想强制过期＆＃34; ttl过期＆＃34;在ping上，所以我发送ping到＆＃34; google.com＆＃34; ttl为2。

ping -i 2 -n 1 google.com

这给我以下结果

Reply from 204.80.6.137: TTL expired in transit.
Reply from 204.80.6.137: TTL expired in transit.

使用我的应用程序，我发送相同的ping请求，看看我在Wireshark收到了什么。我有一个ICMP数据包发送到谷歌和另一个数据包从我的路由器告诉我TTL已过期。那么，为什么Windows上的原始套接字也没有收到此消息呢？即使TTL过期，是否有强制读取ip标头的选项？

所以我假设Windows ping.exe实用程序比我们使用Winsock API更好/不同地过滤数据包？

作为参考，这是套接字的创建方式：

#include <winsock2.h> 
#include <ws2tcpip.h> 
#include <mstcpip.h>
#include <windows.h>
#include <stdint.h>
#include <vector>
#include <algorithm>

struct IPV4_HDR
{
    unsigned char ip_header_len : 4;
    unsigned char ip_version : 4;
    unsigned char ip_tos;
    unsigned short ip_total_length;
    unsigned short ip_id;

    unsigned char ip_frag_offset : 5;

    unsigned char ip_more_fragment : 1;
    unsigned char ip_dont_fragment : 1;
    unsigned char ip_reserved_zero : 1;

    unsigned char ip_frag_offset1;

    unsigned char ip_ttl;
    unsigned char ip_protocol;
    unsigned short ip_checksum;
    unsigned int ip_srcaddr;
    unsigned int ip_destaddr;
};

struct ICMP_HDR
{
    BYTE type;
    BYTE code;
    USHORT checksum;
    USHORT id;
    USHORT seq;
};

unsigned short compute_checksum(unsigned short* buffer, int size)
{
    unsigned long cksum = 0;
    while (size > 1)
    {
        cksum += *buffer++;
        size -= sizeof(unsigned short);
    }
    if (size)
    {
        cksum += *(char*)buffer;
    }

    cksum = (cksum >> 16) + (cksum & 0xffff);
    cksum += (cksum >> 16);
    return (unsigned short)(~cksum);
}

void send_receive_ping(SOCKET icmp_sock)
{
    std::vector<char> receive_buffer;
    receive_buffer.resize(65536);
    std::fill(receive_buffer.begin(), receive_buffer.end(), 0);
    char *Buffer = receive_buffer.data();

    int recv_bytes = 0;
    DWORD start_time = GetTickCount();
    bool first_time_in_loop = true;
    do
    {
        if ( (first_time_in_loop == true 
            || GetTickCount() - start_time > 5000))
        {
            OutputDebugString(L"Sending an ICMP packet....\n");
            send_icmp_packet(icmp_sock);

            first_time_in_loop = false;
            start_time = GetTickCount();
        }

        recv_bytes = recvfrom(icmp_sock, Buffer, 65536, 0, 0, 0);
        if (recv_bytes > 0)
        {
            // Handle received packet
        }
        else
        {
            break;
        }
    } while (recv_bytes > 0);
}

void send_icmp_packet(SOCKET icmp_sock)
{
    sockaddr_in sockaddr_in_dst = {};
    sockaddr_in_dst.sin_family = AF_INET;
    sockaddr_in_dst.sin_port = 0;
    sockaddr_in_dst.sin_addr.s_addr = inet_addr("184.150.168.247"); // google.com

    std::vector<char> send_buffer;
    send_buffer.resize(sizeof(IPV4_HDR) + sizeof(ICMP_HDR));
    std::fill(send_buffer.begin(), send_buffer.end(), 0);

    IPV4_HDR *ipv4_header = (IPV4_HDR *)send_buffer.data();
    ipv4_header->ip_header_len = 5;
    ipv4_header->ip_version = 4;
    ipv4_header->ip_tos = 16;
    ipv4_header->ip_total_length = htons( send_buffer.size() );
    ipv4_header->ip_id = htons(0);
    ipv4_header->ip_ttl = 64;
    //ipv4_header->ip_ttl = 2;
    ipv4_header->ip_protocol = IPPROTO_ICMP;
    ipv4_header->ip_srcaddr = dest.sin_addr.s_addr;
    ipv4_header->ip_destaddr = sockaddr_in_dst.sin_addr.s_addr;
    ipv4_header->ip_checksum = compute_checksum((unsigned short *)ipv4_header, sizeof(IPV4_HDR));

    static unsigned short seq = 0;
    ICMP_HDR *icmp_header = (ICMP_HDR *)(send_buffer.data() + sizeof(IPV4_HDR));
    icmp_header->type = 8;
    icmp_header->seq = seq++;
    icmp_header->id = 888;
    icmp_header->checksum = compute_checksum((unsigned short *)icmp_header, sizeof(ICMP_HDR));

    ret = sendto(icmp_sock, (char *)send_buffer.data(), send_buffer.size(),
        0, (sockaddr *)&sockaddr_in_dst, sizeof(sockaddr_in_dst));
}


int main()
{
    WSADATA ws;
    WSAStartup(MAKEWORD(2, 2), &ws);

    SOCKET icmp_sock = socket(AF_INET, SOCK_RAW, IPPROTO_IP);

    char hostname[256];
    gethostname(hostname, sizeof(hostname));

    hostent *local = gethostbyname(hostname);

    sockaddr_in source;
    memset(&source, 0, sizeof(source));
    memcpy(&source.sin_addr.s_addr, local->h_addr_list[0], sizeof(source.sin_addr.s_addr));
    source.sin_family = AF_INET;
    source.sin_port = 0;

    bind(icmp_sock, (sockaddr *)&source, sizeof(source));

    int recv_all_opt = 1;
    int ioctl_read = 0;
    WSAIoctl(icmp_sock, SIO_RCVALL, &recv_all_opt, sizeof(recv_all_opt), 0, 0, (LPDWORD)&ioctl_read, 0, 0);

    int ip_header_include = 1;
    setsockopt(icmp_sock, IPPROTO_IP, IP_HDRINCL, (char *)&ip_header_include, sizeof(ip_header_include));

    send_receive_ping(icmp_sock);

    closesocket(icmp_sock);
    WSACleanup();

    return 0;
}

前面的代码似乎工作得很好，但我仍然无法从IP消息中获取过期的TLL。就像操作系统窃取了包裹一样。我打赌是因为我要求读取ICMP消息并且TLL在IP头中。因此，如果IP标头出错，则操作系统会丢弃该消息，而我的套接字无法读取它。所以我尝试使用套接字IPPROTO_IP：

sock = socket(AF_INET, SOCK_RAW, IPPROTO_IP);

我还没有收到TTL过期消息，最糟糕的是我有时会丢失数据包。我在Wireshark看到了它们，但我没有把它们放在我的插座上。有人知道为什么吗？

Answer 1

这似乎正是您所怀疑的，Windows正在转移TTL超出响应，并且它们未到达原始套接字。我遇到了同样的问题，到目前为止，我发现的最好的解释是this discussion of porting the MTR traceroute-style utility to Windows。

真正令人难过的是，当我最初在Windows环境中使用原始套接字时，早在2012-2013年它就已在Windows 7上使用。几年过去了，突然同一台机器上的相同代码不再收到TTL超过消息。

根据您的应用程序，您可能可以通过直接调用ICMP.DLL来解决，如上面的链接中所述。这段代码from the P2PScrapper project可能是一个很好的起点。

Answer 2

您应该只允许Windows防火墙中的ICMP。创建入站规则，在协议中选择ICMP并设置“允许”。

套接字（SOCK_RAW + IPPROTO_ICMP）无法读取TTL响应

2 个答案: