注入数据包以终止 TCP 连接
我必须编写一个嗅探网络数据包的程序（第 1 部分 - 简单部分）。
我必须更新程序（第 2 部分），以便它能够终止连接。
具体要求是：
通过指定数据链路层和网络层信息（包括适当的源和目标 MAC 和 IP 地址）构建原始数据包。这些数据包旨在终止连接。为此，您应该使用 SOCK_RAW 作为套接字类型，以便能够自己设置标头信息。
有人能给我一些关于第二部分的想法吗？
我是否应该劫持会话，对其中一名用户实施 DoS 攻击？
我所需要的只是一些有关如何终止连接的提示。 我正在使用 C 编程语言，这是安全课程的课程作业。
I have to write a program that sniffs network packets (part1-the simple part).
And I have to update the program (part2) so that it will be able to terminate connections.
The specific requirements are:
Construct raw packets by specifying data link layer and network layer information including appropriate source and destination MAC and IP addresses. These packets are intended to terminate the connection. To do so, you should used SOCK_RAW as the socket type to be able to set the header information by yourself.
Can anybody give me some ideas on the second part?
Should I hijack the session, apply a DoS attack on one of the users?
All I need is some tips of how to terminate the connection.
I am using the C programming language, and this is a course assignment for the security course.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
取决于您所说的终止连接是什么意思。您可能意味着为 TCP 电路或 UDP 流提供端点。
或者您可能意味着在 TCP 流中间发送可接受的 RST 以指示流的结束。为了实现这一点，您必须知道对方期望的序列号以及其他信息。
不管怎样，很明显你在课堂上没有集中注意力。看起来，作业的全部目的是让您了解 IP 数据包以及可能的 TCP/UDP 的原始布局。我建议您购买有关该主题的教科书（无疑是您的讲师推荐的）和/或阅读维基百科。
Depends on what you mean by terminate connections. You might mean providing an end-point for a TCP circuit or UDP stream.
Or you could mean sending an acceptable RST in the middle of a TCP stream to indicate the end of the stream. To achieve this you have to know the sequence number expected by the other side amongst other things.
Either way it is obvious you haven't been paying attention in class. The entire point of the assignment, it seems, is to show you understand the raw layout of IP packets and possibly TCP/UDP. I suggest you purchase a textbook on the subject (no doubt recommended by your lecturer) and/or take a read of Wikipedia.
对于此作业，我将使用 pypacp，它是一个 Python 数据包捕获和注入库。 Pypcap 使用原始套接字来伪造数据包。如果由于某种奇怪的原因你被迫使用 C 那么这个项目将会更加困难。在这种情况下，您应该使用 libpcap 来嗅探线路，原始套接字库将取决于您开发的平台。
您可以嗅探该线路以查找 TCP 序列 ID。基于此 ID，您可以伪造 RST 或 FIN 来中断连接的一侧。困难的部分是尝试使用原始套接字维护 TCP 连接。维护应用层连接几乎是不可能的，HTTP 将是一个更容易维护的协议，但如果是 http，那么劫持 cookie 就会更容易。
For this assignment I would use pypacp, which is a python packet capture and injection library. Pypcap uses raw sockets to forge packets. If for some strange reason you are forced to use C then this project will be more difficult. In this case you should use libpcap to sniff the line and the raw socket library will depend on the platform you develop on.
You can sniff the line looking for TCP sequence ID's. Based on this id you can forge a RST or FIN to break one side of the connection. The hard part will be trying to maintain the TCP connection using raw sockets. It will be nearly impossible to maintain the application layer connection, HTTP would be an easier protocol to maintain but if it was http it would be easier to just hijack the cookie.
我无法帮助你使用 C 库——这不是我的强项，但似乎应该有一些东西。
但看起来您在第 2 部分中试图做的是防止 DOS，而不是引起 DOS！
检查此处：
http://en.wikipedia.org/wiki/Denial-of-service_attack
有关 DoS 攻击的内容。正如 PP 所说，有许多攻击与连接滥用有关，因此您想弄清楚您的任务是关于哪一种攻击 - 您需要与您的教授一起检查该攻击。例如，上面的 Wiki 页面提到了 SYN Floods - 但几乎所有面向连接的协议都将面临攻击的风险，这种攻击会用太多连接请求填充连接池，然后永远不会关闭它们。
我认为，阅读作业后，您的工作是找出如何通过关闭攻击者打开的连接来解决此问题。这意味着你们都必须弄清楚攻击是如何进行的，然后弄清楚如何从中恢复。
提示：用大量的关闭连接请求攻击服务器并不是攻击。它也没有那么有用，因为您不一定要关闭打开的连接。但损坏是由打开连接请求引起的。请参阅此处：
http://en.wikipedia.org/wiki/SYN_flood
例如。
I can't help you with C libraries - not my forte, but it seems like there should be something out there.
But it seems like what you are trying to do in part 2 is to prevent a DOS, not cause one!
Check here:
http://en.wikipedia.org/wiki/Denial-of-service_attack
for stuff on DoS attacks. As PP says, there are a number of attacks relating to connection misuse, so you want to figure out which one your assigment is about - that one you need to check out with your prof. For example, the Wiki page above mentions SYN Floods - but almost any connection oriented protocol will be at risk for an attack that fills up the connection pool with too many connection requests and then doesn't ever close them.
I assume, reading the assignment, that your job is to figure out how to fix this by closing the connections that the attacker opened. Which means you both have to figure out how the attack works, and then figure out how to recover from it.
HINT: Hitting the server with a flood of close-connection requests is not an attack. It's not that useful, either, since you aren't necessarily closing the connections that are open. But the damage is caused by open-connection requests. See here:
http://en.wikipedia.org/wiki/SYN_flood
For one example.
您可以使用 libpcap 来帮助嗅探数据包。 libpcap 由 tcpdump 团队开发。
you can use libpcap to help with the packet sniffing. libpcap was developed by the tcpdump team.