LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices

Reply
 
Search this Thread
Old 09-22-2009, 08:47 PM   #1
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 149
Blog Entries: 1

Rep: Reputation: 22
Access TCP Header SEQ


Hello,

I have been playing around with sk_buff(skb), and reading/writing data to IP packets in the kernel. I have accessed the ip header, and tcp header, but the tcp header seems to be missing the seq field. When I try to access it in the strucutre tcph->seq it always returning random data. According the to structure in include/linux/tcp.h it should be there.

I thought that the seq might not be there in syn packets so I tried accessing it for all tcp packets, and it still is just random data.

Code:
/* Packet Handler Function */
// static int packetprocessor_func(struct sk_buff *skb, struct device *dv, struct packet_type *pt)
static int packetprocessor_func(struct sk_buff *skb){
        struct iphdr *iph;
        struct tcphdr *tcph;
        
        /*
         * Process the packet only if it
         * is not NULL,
         * was intended for this host,
         * and is an IP packet.
         *
         * This limits processing packets to in-bound IP traffic only!
         *
         */
         if ((skb != NULL) && (skb->pkt_type == PACKET_HOST) && (skb->protocol == htons(ETH_P_IP))) {
                iph = ip_hdr(skb); // access ip header.
                
                        if (iph->protocol == IPPROTO_TCP) {
                                tcph = (struct tcphdr *)(skb_network_header(skb) + ip_hdrlen(skb)); // access tcp header.
                
                                /*
                                 printk(KERN_ALERT "Source: %d.%d.%d.%d:%d. Destination: %d.%d.%d.%d:%d\n",
                                 NIPQUAD(iph->saddr), ntohs(tcph->source),
                                 NIPQUAD(iph->daddr), ntohs(tcph->dest));
                                 */



                                 /*
                                  * Here we identify new sessions
                                  */

                                         if ((tcph->syn == 1) && (tcph->ack == 0)) {
                                                printk(KERN_ALERT "Opening new session to: %d.%d.%d.%d:%d.\n",
                                                NIPQUAD(iph->daddr), ntohs(tcph->dest));
                        
                                                  printk(KERN_ALERT "MSS is: %llu.\n",
                                                __get_tcp_option(skb,2,4));
                                                
                                                 printk(KERN_ALERT "SEQ is: %u.\n",
                                                ntohl(tcph->seq));                                                                                
                                         }
                                                                  
                        }

         }

        kfree_skb(skb);
    return 0;
}
 
Old 09-22-2009, 09:27 PM   #2
chrism01
Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.5, Centos 5.10
Posts: 16,311

Rep: Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040Reputation: 2040
Quote:
Connection establishment

To establish a connection, TCP uses a three-way handshake. Before a client attempts to connect with a server, the server must first bind to a port to open it up for connections: this is called a passive open. Once the passive open is established, a client may initiate an active open. To establish a connection, the three-way (or 3-step) handshake occurs:

1. The active open is performed by the client sending a SYN to the server. It sets the segment's sequence number to a random value.
2. In response, the server replies with a SYN-ACK. The acknowledgement number is set to one more than the received sequence number, and the sequence number is random.
3. Finally, the client sends an ACK back to the server. The sequence number is set to the received acknowledgement value, and the acknowledgement number is set to one more than the received sequence number.

At this point, both the client and server have received an acknowledgement of the connection.
http://en.wikipedia.org/wiki/Transmi...ntrol_Protocol
http://en.wikipedia.org/wiki/TCP_Seq...diction_Attack
 
Old 09-22-2009, 11:00 PM   #3
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 149
Blog Entries: 1

Original Poster
Rep: Reputation: 22
Watching Wireshark you can see the TCP SYN packet leaving the host with SEQ = 0. I will have to look at the server to see what it receives, and why Wireshark would say the SEQ=0 if in fact its something else.
 
Old 09-23-2009, 12:05 PM   #4
yaplej
Member
 
Registered: Apr 2009
Distribution: CentOS, Ubuntu, openSuSE
Posts: 149
Blog Entries: 1

Original Poster
Rep: Reputation: 22
Well I found why I was getting such random numbers in my module. WireShark by default makes the SEQ/ACK numbers relative to the first SYN packet sent. My module was showing the actual SEQ correctly.

http://wiki.wireshark.org/TCP_Relative_Sequence_Numbers
 
Old 08-08-2011, 05:01 AM   #5
Maitrikkshah
LQ Newbie
 
Registered: Aug 2011
Posts: 9

Rep: Reputation: Disabled
send data in the options field of the tcp header

hello yaplej.

In my project i want to send data in the options field of the tcp header. Do you know how it will be possible??In what .c files i should make change?
I have downloaded kernel source code.But do not know what should i do further.
Please help me....
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
how to tcp seq from skb ycli Linux - Software 1 01-19-2009 05:22 PM
how to get tcp seq from skb ycli Linux - Software 0 01-19-2009 05:10 PM
[raw sockets, C] tcp header cut darell Programming 2 10-09-2008 12:04 PM
TCP header checksum live_dont_exist Programming 16 04-13-2005 01:45 PM


All times are GMT -5. The time now is 06:20 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration