CODEWITHSUNDEEP
pythonsocketstcp
J.Doe
J.Doe

Reputation: 97

Why my TCP packet doesn't seems like a TCP packet for protocol analyzers?

I am trying to use raw sockets to send a GET request to a server. I am using raw sockets so I can edit the Packet window size. Here is my code. 

import socket, sys
from struct import *

def checksum(msg):
    s = 0

    for i in range(0, len(msg), 2):
        w = ord(msg[i]) + (ord(msg[i+1]) << 8 )
        s = s + w

    s = (s>>16) + (s & 0xffff);
    s = s + (s >> 16);

    s = ~s & 0xffff

    return s

#create a raw socket
try:
    s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
except socket.error , msg:
    print 'Socket could not be created. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
    sys.exit()

# tell kernel not to put in headers, since we are providing it, when using IPPROTO_RAW this is not necessary
# s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)


packet = '';

source_ip = '192.168.2.7'
dest_ip = '216.86.145.50' # or socket.gethostbyname('www.google.com')

# ip header fields
ip_ihl = 5
ip_ver = 4
ip_tos = 0
ip_tot_len = 0  # kernel will fill the correct total length
ip_id = 54321   #Id of this packet
ip_frag_off = 0
ip_ttl = 255
ip_proto = socket.IPPROTO_TCP
ip_check = 0    # kernel will fill the correct checksum
ip_saddr = socket.inet_aton ( source_ip )   #Spoof the source ip address if you want to
ip_daddr = socket.inet_aton ( dest_ip )

ip_ihl_ver = (ip_ver << 4) + ip_ihl

ip_header = pack('!BBHHHBBH4s4s' , ip_ihl_ver, ip_tos, ip_tot_len, ip_id, ip_frag_off, ip_ttl, ip_proto, ip_check, ip_saddr, ip_daddr)

# tcp header fields
tcp_source = 1234   # source port
tcp_dest = 80   # destination port
tcp_seq = 454
tcp_ack_seq = 0
tcp_doff = 5    
#tcp flags
tcp_fin = 0
tcp_syn = 1
tcp_rst = 0
tcp_psh = 0
tcp_ack = 0
tcp_urg = 0
tcp_window = socket.htons (2048)   
tcp_check = 0
tcp_urg_ptr = 0

tcp_offset_res = (tcp_doff << 4) + 0
tcp_flags = tcp_fin + (tcp_syn << 1) + (tcp_rst << 2) + (tcp_psh <<3) + (tcp_ack << 4) + (tcp_urg << 5)


tcp_header = pack('!HHLLBBHHH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags,  tcp_window, tcp_check, tcp_urg_ptr)

user_data = "GET / HTTP/1.1\r\nHost:www.example.com\n\nUser-Agent:Mozilla 5.0\r\n\r\n"


source_address = socket.inet_aton( source_ip )
dest_address = socket.inet_aton(dest_ip)
placeholder = 0
protocol = socket.IPPROTO_TCP
tcp_length = len(tcp_header) + len(user_data)

psh = pack('!4s4sBBH' , source_address , dest_address , placeholder , protocol , tcp_length);
psh = psh + tcp_header + user_data;

tcp_check = checksum(psh)



tcp_header = pack('!HHLLBBH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags,  tcp_window) + pack('H' , tcp_check) + pack('!H' , tcp_urg_ptr)


packet = ip_header + tcp_header + user_data


s.sendto(packet, (dest_ip , 0 ))

I am using Wireshark to view the packet being sent. The problem is the output is not a TCP GET request packet. In wire shark the output is the white in colour, under protocol it says IPv4 and info says: 144 Unknown(255). How do I fix this?

Upvotes: 3

Views: 239

Answers (2)

SyntaxErr0r
SyntaxErr0r

Reputation: 76

Like @Sivir said you need to establish a three way handshake because you want to use the TCP protocol. In theory the handshake should look like this

  • YourProgram: sends a SYN packet
  • Server: sends SYNACK packet
  • YourProgram: sends a ACK packet

More information regarding this can be found here.

Upvotes: 2

Sivir
Sivir

Reputation: 86

It's because you send one single packet, but in TCP you have to setup connection first (3 ways handshake), then send request and then close connection.

Although it is possible to implement it using raw socket, there is a few parameters that you need to control during connection. If you tell why do you need to control window size, may be there is way to do it without TCP protocol implementation.

Upvotes: 1

Related Questions