Question

So i am attempting to send an already constructed packet over a RAW socket interface (these are packets that have been previously captured and i want to resend them without changing the packet integrity) and am using TCPdump to check that the packets are going over correctly (surprise they are not).

The packets are physically being sent but are always 24 bytes short of what my "sent" returns.

In wireshark my eth headers seem to be erased as my source and dest MAC addresses are "00:00:00:00:00

sock setup is as follows

sock = socket(AF_PACKET,SOCK_RAW,IPPROTO_RAW);
if(sock==-1)
{
    qDebug() << "sock error";
}

int reuse = 1;

if(setsockopt(sock, IPPROTO_RAW, IP_HDRINCL, (char *)&reuse, sizeof(reuse)) < 0)
{
    qDebug() << "error setting reuse"
}
else
{
    "setting reuse"
}

struct sockaddr_ll sll;
struct ifreq ifr;

bzero(&sll, sizeof(sll));
bzero(&ifr, sizeof(ifr));

sll.sll_family = AF_PACKET;
sll.sll_ifindex = ifr.ifr_ifindex;
sll.sll_protocol = htons(IPPROTO_RAW);
sll.sll_halen = ETH_ALEN;

strncpy((char*)ifr.ifr_ifrn.ifrn_name,interface.toUtf8.constData(),IFNAMSIZ);
if(ioctl(sock,SIOCGIFINDEX,&ifr) == -1)
{
   qDebug() << "error getting interface name";
}
strncpy((char*)ifr.ifr_ifrn.ifrn_name,interface.toUtf8.constData(),IFNAMSIZ);
if(ioctl(sock,SIOCGIFHWADDR,&ifr) == -1)
{
   qDebug() << "error getting interface name";
}

if(bind(sock,(struct sockaddr *)&sll,sizeof(sll))==-1)
{
   qDebug() << "error binding sock";
}

after this im using

int size = write(sock,(const void*)&packet,hdr.caplen);

i've tried sendto in the past but it would always reconfigure things so this was my next solution which also isnt working as i would like.

I'm not the most savy with TCP/IP stuff so any help would be greatly appreciated!

Answer 1

好吧，所以在尝试了很多不同的东西之后，我找到了似乎是我的解决方案的

我创建了第二个指针，该指针将指向数据包的顶部并将其发送出去。

(char *)sendingPacket;
struct ethhdr *ethh = (struct ethhdr*)packet;
sendingPacket = (char*) ethh;

我真的不明白为什么这行得通，但是发送其他数据包却不行，所以如果有人有见识，请分享！

Does TCPdump strip any headers when receiving packets?

1 个答案: