[pavankvnaidu]

I can’t say what exactly may be wrong with your code, proofreading someones code is beyond support obligations, however here is the simple sample code which is confirmed to work:

Your sample code is working infact, I did the same test before I try to send UDP packet it works fine but when I try to send UDP/TCP its not going out.
I suspect I am doing something wrong in following line of code.

iph.ip_len = htons (sizeof(iphdr) + sizeof(udphdr) + datalen); 

Is it the correct way of calculating the IP Length?

Is there any chance of other sniffers can sniff the packet and WinPkFilter can’t sniff?
If so, I would like to know in what instance it may happen?

Thank you.

Pavan.

[pavankvnaidu]

No, I don’t see the packet that I am sending in local system.

[pavankvnaidu]

I am just running the examples, PassThru and PacketSniffer only.

but its not sniffing in the XP-bridge mode.

[pavankvnaidu]

We are your customer and have baught Individual User License only.

by the way, we have one more problem in XP Bridge,
When we are trying to sniff using WinpkFilter, on the XP Bridge, we don’t see any packets. I mean we can’t sniff.

When I use the WinPCap on the same bridge, I can sniff the packets.

what could be wrong??

[pavankvnaidu]

Thank you for your quick reply.

---

If you require filtering over raw LAN adapters even if XP bridge is used then it is also possible (in general it is just a simple driver modification and we had a customer who requested this feature before).

---

Yes, we require that feature. Can you please tell me how I can get that that?

Pavan

[pavankvnaidu]

hi SerpentFly,
Will it work if change SYN/ACK only for the packet that I am modifying? If I change how the system will recognise?

I have tried this too, Its not reaching the recipient.
I have also tried to change all the SYN/ACK but still doesn’t work.

I will email you my code. Can you tell me where I am doing wrong?

THank you.

[pavankvnaidu]

Hi SerpentFly,
I found that the repetition starts after the final ack has been sent. I don’t know why its happening. for your reference, I am posting the log file here.
In the log, System-1 is the system where I am modifying the packet. and as I mentioned earlier, I am modifying only the packets with payload.

System-1 –>System-2
ip_len=40
Seq:19027, ack:28986
Type = FIN ACK
Identification:14987

System-2 –>System-1
ip_len=40
Seq:28986, ack:19027
Type = ACK
Identification:61538

System-2 –>System-1
ip_len=40
Seq:28986, ack:19027
Type = FIN ACK
Identification:61539

System-1 –>System-2
ip_len=40
Seq:19027, ack:28986
Type = ACK
Identification:14988

Repetition Starts here….

System-1 –>System-2
ip_len=40
Seq:19027, ack:28986
Type = ACK
Identification:14989

System-2 –>System-1
ip_len=40
Seq:28986, ack:19027
Type = ACK
Identification:61540

System-1 –>System-2
ip_len=40
Seq:19027, ack:28986
Type = ACK
Identification:14990

System-2 –>System-1
ip_len=40
Seq:28986, ack:19027
Type = ACK
Identification:61541
….
….

[pavankvnaidu]

I am not touching the ACK/SYN at all, I am modifying the ip_len and the payload only. that too, if the packet has payload then only i am modifying the packet.

Is there any way I can drop the old packet? How can I remove it from the local stack?

thank you.

[pavankvnaidu]

hi SerpentFly,
Can you help me??
I am trying to create the new packet based on the original (old) packet.
I am sending the new packet instead of old packet. The packet is now modified and received other side also. Now the problem is the system is sending old packets continuesly. I mean its in the loop. Can you please suggest me some thing?

The following is the part of the code.

bool bModified = false;

INTERMEDIATE_BUFFER pNewPacket;

ZeroMemory(&pNewPacket,sizeof(INTERMEDIATE_BUFFER));

pNewPacket.m_IBuffer[0] = 0;

if (PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_SEND)

{

// Create a new packet

CreateNewPacket(&PacketBuffer, &pNewPacket, bModified);

}

if(bModified)//if its modified

{

RecalculateIPChecksum(&pNewPacket);

RecalculateTCPChecksum(&pNewPacket);

PrintPacket(&pNewPacket);

ETH_REQUEST			newRequest;

ZeroMemory ( &newRequest, sizeof(ETH_REQUEST) );

newRequest.hAdapterHandle = (HANDLE)AdList.m_nAdapterHandle[iIndex];

newRequest.EthPacket.Buffer = &pNewPacket;

if (PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_SEND)

{

api.SendPacketToAdapter(&newRequest);

}

else

{

api.SendPacketToMstcp(&newRequest);

}

}

else

{

PrintPacket(&PacketBuffer);

if (PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_SEND)

{

api.SendPacketToAdapter(&Request);

}

else

{

api.SendPacketToMstcp(&Request);

}

}

[pavankvnaidu]

Thank you.

[pavankvnaidu]

if we change the SYN of one packet, what happens to the otherpackets that are in queue?

can you please explain it in more detail?

[Author]

Posts