How to Modify the IP packet header

Hi all,

How can i modify a UDP/IP packet header in windows NT. I wanted to modify
the ‘Source IP Address’ of an IP packet.
Can i use a NDIS intermediate driver for that.??

Thanks in Advance

Shanavas


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You can use the raw IP socket option provided by WinSock 2. You can modify
the IP header.

-----Original Message-----
From: SHANAVAS K.S [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 2:19 PM
To: NT Developers Interest List
Subject: [ntdev] How to Modify the IP packet header

Hi all,

How can i modify a UDP/IP packet header in windows NT. I
wanted to modify
the ‘Source IP Address’ of an IP packet.
Can i use a NDIS intermediate driver for that.??

Thanks in Advance

Shanavas


You are currently subscribed to ntdev as: xxxxx@nestec.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hello!

AFAIK, you cannot do this unless you use an intermediate driver.
This is due to the fact that raw sockets are not supported in
Windows NT (I read somewhere that it was done for security reasons -
MS don’t want people to do nasty things like IP spoofing, SYN
floods etc.).

The only supported raw socket I know of is the ICMP one, which
is meant for traceroute (and ping). I tried more then once to
send just a TCP SYN packet - without any success.

If I remember correctly, Windows 2000 does support some variation
of raw socket - but I don’t know at which level. In addition, you
must be an administrator in order to open a raw socket on this platform.

Needless to say that if anybody has found a way of sending raw IP packets,
(without a driver…) I’d be more than happy to learn the trick.

best wishes,

  • Barak

Barak Mandelovich
Mercury Interactive ltd.

-----Original Message-----
From: JOJAN [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 10:57 AM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

You can use the raw IP socket option provided by WinSock 2. You can modify
the IP header.

-----Original Message-----
From: SHANAVAS K.S [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 2:19 PM
To: NT Developers Interest List
Subject: [ntdev] How to Modify the IP packet header

Hi all,

How can i modify a UDP/IP packet header in windows NT. I
wanted to modify
the ‘Source IP Address’ of an IP packet.
Can i use a NDIS intermediate driver for that.??

Thanks in Advance

Shanavas


You are currently subscribed to ntdev as: xxxxx@nestec.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@mercury.co.il
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Windows 2000 or Windows NT with WinSock 2.0 allows raw sockets. You can use
socket option IP_HDRINCL so that any protocol can be used and able to edit
the IP header.

-----Original Message-----
From: Barak Mandelovich [mailto:xxxxx@mercury.co.il]
Sent: Thursday, April 19, 2001 4:00 PM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

Hello!

AFAIK, you cannot do this unless you use an intermediate driver.
This is due to the fact that raw sockets are not supported in
Windows NT (I read somewhere that it was done for security reasons -
MS don’t want people to do nasty things like IP spoofing, SYN
floods etc.).

The only supported raw socket I know of is the ICMP one, which
is meant for traceroute (and ping). I tried more then once to
send just a TCP SYN packet - without any success.

If I remember correctly, Windows 2000 does support some variation
of raw socket - but I don’t know at which level. In addition, you
must be an administrator in order to open a raw socket on
this platform.

Needless to say that if anybody has found a way of sending
raw IP packets,
(without a driver…) I’d be more than happy to learn the trick.

best wishes,

  • Barak


Barak Mandelovich
Mercury Interactive ltd.


-----Original Message-----
From: JOJAN [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 10:57 AM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

You can use the raw IP socket option provided by WinSock 2.
You can modify
the IP header.

> -----Original Message-----
> From: SHANAVAS K.S [mailto:xxxxx@nestec.net]
> Sent: Thursday, April 19, 2001 2:19 PM
> To: NT Developers Interest List
> Subject: [ntdev] How to Modify the IP packet header
>
>
> Hi all,
>
> How can i modify a UDP/IP packet header in windows NT. I
> wanted to modify
> the ‘Source IP Address’ of an IP packet.
> Can i use a NDIS intermediate driver for that.??
>
> Thanks in Advance
>
> Shanavas
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@nestec.net
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>


You are currently subscribed to ntdev as: xxxxx@mercury.co.il
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: xxxxx@nestec.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hi!

I urge you to try this… It won’t work on NT !
IP_HDRINCL is NOT SUPPORTED by Winsock 2.0, although it
might look like it does when reading the documentation.

Even if you get a return status of OK when sending the frame -
start network monitor, and see for yourself that the packets being
sent are not what you think they might be…

best wishes,

  • Barak

Barak Mandelovich
Mercury Interactive ltd.

-----Original Message-----
From: JOJAN [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 11:48 AM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

Windows 2000 or Windows NT with WinSock 2.0 allows raw sockets. You can use
socket option IP_HDRINCL so that any protocol can be used and able to edit
the IP header.

-----Original Message-----
From: Barak Mandelovich [mailto:xxxxx@mercury.co.il]
Sent: Thursday, April 19, 2001 4:00 PM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

Hello!

AFAIK, you cannot do this unless you use an intermediate driver.
This is due to the fact that raw sockets are not supported in
Windows NT (I read somewhere that it was done for security reasons -
MS don’t want people to do nasty things like IP spoofing, SYN
floods etc.).

The only supported raw socket I know of is the ICMP one, which
is meant for traceroute (and ping). I tried more then once to
send just a TCP SYN packet - without any success.

If I remember correctly, Windows 2000 does support some variation
of raw socket - but I don’t know at which level. In addition, you
must be an administrator in order to open a raw socket on
this platform.

Needless to say that if anybody has found a way of sending
raw IP packets,
(without a driver…) I’d be more than happy to learn the trick.

best wishes,

  • Barak


Barak Mandelovich
Mercury Interactive ltd.


-----Original Message-----
From: JOJAN [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 10:57 AM
To: NT Developers Interest List
Subject: [ntdev] RE: How to Modify the IP packet header

You can use the raw IP socket option provided by WinSock 2.
You can modify
the IP header.

> -----Original Message-----
> From: SHANAVAS K.S [mailto:xxxxx@nestec.net]
> Sent: Thursday, April 19, 2001 2:19 PM
> To: NT Developers Interest List
> Subject: [ntdev] How to Modify the IP packet header
>
>
> Hi all,
>
> How can i modify a UDP/IP packet header in windows NT. I
> wanted to modify
> the ‘Source IP Address’ of an IP packet.
> Can i use a NDIS intermediate driver for that.??
>
> Thanks in Advance
>
> Shanavas
>


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Shanavas,
Even if row sockets on windows allow to modify address’s fields in IP
datagrams it is useless when you want to change addresses for all outgoing
IP flows. You have to use interm driver in order to have control over all
outbound IP traffic.

RG

-----Original Message-----
From: SHANAVAS K.S [mailto:xxxxx@nestec.net]
Sent: Thursday, April 19, 2001 10:49 AM
To: NT Developers Interest List
Subject: [ntdev] How to Modify the IP packet header

Hi all,

How can i modify a UDP/IP packet header in windows NT. I wanted to modify
the ‘Source IP Address’ of an IP packet.
Can i use a NDIS intermediate driver for that.??

Thanks in Advance

Shanavas


You are currently subscribed to ntdev as: xxxxx@envara.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> AFAIK, you cannot do this unless you use an intermediate driver.

This is due to the fact that raw sockets are not supported in
Windows NT (I read somewhere that it was done for security reasons -

According to MSDN Library, they are supported since WinSock2 (NT4).

By default, NT4 restricts using raw sockets to Administrators.
Search MSDN Library for “AllowUserRawAccess” to know how to switch this
restriction off.

Max


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com