在 C# 中使用原始套接字
我想用 C# 编写一个端口扫描器，但无法使用 SocketType.Raw，因为原始套接字是从 Windows 桌面版本中取出的。我无法使用 SharpPcap 或 Winpcap 的其他包装器，因为我使用 PPPoE 进行互联网连接，而 Winpcap 不支持 PPP 设备。
我需要使用一个实现原始套接字并且不依赖 winpcap 的库。
有什么想法吗？基本上我需要发送 SYN，接收 SYN/ACK 或 RST，但不发回 ACK。
编辑：
对于那些不相信 RAW 套接字已从 Windows 桌面版本中消失的人，请参阅此处：http://msdn.microsoft.com/en-us/library/windows/desktop/ms740548(v=vs.85).aspx
在 Windows 7、Windows Vista、Windows XP Service Pack 2 (SP2) 和 Windows XP Service Pack 3 (SP3) 上，通过原始套接字发送流量的能力受到多种方式的限制：
- TCP 数据无法通过原始套接字发送。
- 源地址无效的 UDP 数据报无法通过原始套接字发送。任何传出 UDP 数据报的 IP 源地址必须存在于网络接口上，否则数据报将被丢弃。进行此更改是为了限制恶意代码创建分布式拒绝服务攻击的能力，并限制发送欺骗数据包（具有伪造源 IP 地址的 TCP/IP 数据包）的能力。
- 不允许使用
IPPROTO_TCP协议的原始套接字调用bind函数。
注意 使用原始套接字的bind函数允许用于其他协议（IPPROTO_IP、IPPROTO_UDP或例如，IPPROTO_SCTP）。
I want to write a port scanner in C# and I can't use SocketType.Raw as raw sockets were taken out from desktop versions of windows. I can't use SharpPcap either or other wrapper for Winpcap as I use PPPoE for internet connection and Winpcap doesn't support PPP devices.
I need to use a library which implements raw sockets and doesn't rely on winpcap.
Any ideas? Basically I need to send SYN, receive SYN/ACK or RST but don't send ACK back.
edit:
For people who doesn't believe RAW sockets are gone from desktop versions of Windows, see here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms740548(v=vs.85).aspx
On Windows 7, Windows Vista, Windows XP with Service Pack 2 (SP2), and Windows XP with Service Pack 3 (SP3), the ability to send traffic over raw sockets has been restricted in several ways:
- TCP data cannot be sent over raw sockets.
- UDP datagrams with an invalid source address cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped. This change was made to limit the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets (TCP/IP packets with a forged source IP address).
- A call to the
bindfunction with a raw socket for theIPPROTO_TCPprotocol is not allowed.
Note Thebindfunction with a raw socket is allowed for other protocols (IPPROTO_IP,IPPROTO_UDP, orIPPROTO_SCTP, for example).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
请注意 nmap 是如何做到这一点的，现在我相信您的选择是进入以太网框架的较低级别。
“Nmap 仅支持以太网接口（包括大多数 802.11 无线卡和许多 VPN 客户端）进行原始数据包扫描。除非您使用 -sT -Pn 选项，否则不支持 RAS 连接（例如 PPP 拨号）和某些 VPN 客户端。此支持当 Microsoft 在 Windows XP SP2 中删除原始 TCP/IP 套接字支持时，Nmap 必须发送较低级别的以太网帧。”
因此 - 这将我们带到：
http://www.codeproject.com/KB/IP/发送数据包.aspx
Take note on how nmap did it and that for now I believe your option would be to go to a lower level at the ethernet frame.
"Nmap only supports ethernet interfaces (including most 802.11 wireless cards and many VPN clients) for raw packet scans. Unless you use the -sT -Pn options, RAS connections (such as PPP dialups) and certain VPN clients are not supported. This support was dropped when Microsoft removed raw TCP/IP socket support in Windows XP SP2. Now Nmap must send lower-level ethernet frames instead."
So - that brings us to:
http://www.codeproject.com/KB/IP/sendrawpacket.aspx
就像这样：
http://www.winsocketdotnetworkprogramming.com/clientserversocketnetworkcommunication8h.html
另外，在什么地方重点是它从 Windows 中删除了吗？上周我为一个朋友做了一个聊天客户端；另外，http://msdn.microsoft.com/ en-us/library/system.net.sockets.sockettype.aspx ，仍然将其列为活动状态。
Just like this:
http://www.winsocketdotnetworkprogramming.com/clientserversocketnetworkcommunication8h.html
Also, at what point was it removed from Windows? I did a chat client for a friend last week; as well, http://msdn.microsoft.com/en-us/library/system.net.sockets.sockettype.aspx , still lists it as being active.
尝试以管理员身份运行 Visual Studio
右键单击 --->以管理员身份运行
然后使用原始套接字执行程序..
Try running Visual Studio as Adminitrator
Right click ---> run as administrator
Then execute programs with raW sockets..