Develop Reference

TCP model , implementing seq_number [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 3 years ago.
Improve this question
I use TCP for transmission layer.But may be my payload is bigger than my buffer, So I have to implement seq_number of TCP in my payloads. Do you know some class or module or some way to do it?
UPDATE:
My packet contains header+payload.

If you would like to implement the TCP seq_number logic by yourself theres this github repository called "TCP Emulator":
https://github.com/ohEmily/tcp-emulator-python
If you want only to create tcp packet header with seq_number i'de use the Python socket module
#!/usr/bin/python
import socket
import struct
class TCPPacket:
def __init__(self, dport = 80, sport = 65535, dst='127.0.0.1', src='192.168.1.101', data = 'Nothing'):
self.dport = dport
self.sport = sport
self.src_ip = src
self.dst_ip = dst
self.data = data
self.raw = None
self.create_tcp_feilds()
def assemble_tcp_feilds(self):
self.raw = struct.pack('!HHLLBBHHH', # Data Structure Representation
self.tcp_src, # Source IP
self.tcp_dst, # Destination IP
self.tcp_seq, # Sequence
self.tcp_ack_seq, # Acknownlegment Sequence
self.tcp_hdr_len, # Header Length
self.tcp_flags , # TCP Flags
self.tcp_wdw, # TCP Windows
self.tcp_chksum, # TCP cheksum
self.tcp_urg_ptr # TCP Urgent Pointer
)
self.calculate_chksum() # Call Calculate CheckSum
return
def reassemble_tcp_feilds(self):
self.raw = struct.pack('!HHLLBBH',
self.tcp_src,
self.tcp_dst,
self.tcp_seq,
self.tcp_ack_seq,
self.tcp_hdr_len,
self.tcp_flags ,
self.tcp_wdw
)+
struct.pack("H",
self.tcp_chksum
)+
struct.pack('!H',
self.tcp_urg_ptr
)
return
def calculate_chksum(self):
src_addr = socket.inet_aton( self.src_ip )
dest_addr = socket.inet_aton( self.dst_ip )
placeholder = 0
protocol = socket.IPPROTO_TCP
tcp_len = len(self.raw) + len(self.data)
psh = struct.pack('!4s4sBBH' ,
src_addr ,
dest_addr ,
placeholder ,
protocol ,
tcp_len
)
psh = psh + self.raw + self.data
self.tcp_chksum = self.chksum(psh)
self.reassemble_tcp_feilds()
return
def chksum(self, msg):
s = 0 # Binary Sum
# loop taking 2 characters at a time
for i in range(0, len(msg), 2):
a = ord(msg[i])
b = ord(msg[i+1])
s = s + (a+(b << 8))
# One's Complement
s = s + (s >> 16)
s = ~s & 0xffff
return s
def create_tcp_feilds(self):
# ---- [ Source Port ]
self.tcp_src = self.sport
# ---- [ Destination Port ]
self.tcp_dst = self.dport
# ---- [ TCP Sequence Number]
self.tcp_seq = 0
# ---- [ TCP Acknowledgement Number]
self.tcp_ack_seq = 0
# ---- [ Header Length ]
self.tcp_hdr_len = 80
# ---- [ TCP Flags ]
tcp_flags_rsv = (0 << 9)
tcp_flags_noc = (0 << 8)
tcp_flags_cwr = (0 << 7)
tcp_flags_ecn = (0 << 6)
tcp_flags_urg = (0 << 5)
tcp_flags_ack = (0 << 4)
tcp_flags_psh = (0 << 3)
tcp_flags_rst = (0 << 2)
tcp_flags_syn = (1 << 1)
tcp_flags_fin = (0)
self.tcp_flags = tcp_flags_rsv + tcp_flags_noc + tcp_flags_cwr + \
tcp_flags_ecn + tcp_flags_urg + tcp_flags_ack + \
tcp_flags_psh + tcp_flags_rst + tcp_flags_syn + tcp_flags_fin
# ---- [ TCP Window Size ]
self.tcp_wdw = socket.htons (5840)
# ---- [ TCP CheckSum ]
self.tcp_chksum = 0
# ---- [ TCP Urgent Pointer ]
self.tcp_urg_ptr = 0
return
In order to run it:
if __name__=='__main__':
# Create Raw Socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
tcp = TCPPacket()
tcp.assemble_tcp_feilds()
s.sendto(tcp.raw, ('127.0.0.1' , 0 ))
Source: http://www.bitforestinfo.com/2017/12/code-to-create-tcp-packet-header-with-python-socket-module.html

struct.pack raises "struct.error: required argument is not an integer"

I am trying to make a network proxy which will forward packets to another IP. I can sniff a packet, unpack it, and view, print, and manipulate its contents. But when I want to pack the bytes to forward it to some other IP, it gives this error:
struct.error: required argument is not an integer
The error is raised on this line of code:
ip_header = struct.pack('!BBHHHBBH4s4s' ,version_IHL, TOS, totalLength, ID,flags, TTL,protocolNR, checksum,sourceAddress,destinationAddress)
Here is the code. Bold stuff in code are comments in my code.
import socket
import sys
import struct
import re
import logging
import struct
from scapy.all import *
import Functions
logging.basicConfig(filename='example.log',level=logging.DEBUG)
hold = "192.168.0.125"
print ("\n\t\t\t**************************")
print ("\t\t\t*****SettingUp Server*****")
print ("\t\t\t**************************\n\n")
print("\t*****Implementing DHKE")
print ("\t*****Generating server public & private keypairs now . . .")
(e,n), private = Functions.generate_keypair(7, 11)
print ("*****Public Key: {} , {} ", e,n)
print ("*****Private key: {} ", private)
public = (e,n)
ip = '192.168.0.125'
port = 5001
# the public network interface
#HOST = socket.gethostbyname(socket.gethostname())
#..............................................................................................
# create a raw socket and bind it to the public interface
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
s.bind(('192.168.0.117',5001))
# Include IP headers
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
logging.basicConfig(format='%(asctime)s %(message)s')
logging.warning('format=%(asctime)s %(message)s')
# receive all packages
s.ioctl(socket.SIO_RCVALL, socket.RCVALL_ON)
#..............................................................................................
data = Functions.recievedata(s)
logging.info('**Packet Recieved')
print("Packet Recieved")
#function_data = tuple(struct.unpack(data))
unpacked_data = struct.unpack('!BBHHHBBH4s4s',data[:20])
listunpacked = list(unpacked_data)
logging.info('--> Unpacking packet')
version_IHL = unpacked_data[0]
version = version_IHL >>4
IHL = version_IHL & 0xF
TOS = unpacked_data[1]
totalLength = unpacked_data[2]
ID = unpacked_data[3]
flags = unpacked_data[4]
fragmentOffset = unpacked_data[4] & 0x1FFF
TTL = unpacked_data[5]
protocolNR = unpacked_data[6]
checksum = unpacked_data[7]
sourceAddress = socket.inet_ntoa(unpacked_data[8])
destinationAddress = socket.inet_ntoa(unpacked_data[9])
#..............................................................................................
print("An IP packet with the size %i is captured.", (totalLength))
print("Raw data: "+ str(data))
print("\nParsed data")
print("Version:\t\t"+ str(version))
print("Header length:\t\t"+ str(IHL*4)+'bytes')
print("Type of service:\t\t" + str(Functions.getTOS(TOS)))
print("Length:\t\t\t"+str(totalLength))
print("ID:\t\t\t"+str(hex(ID)) + ' {' + str(ID) + '}')
print("Flags:\t\t\t" + Functions.getFlags(flags))
print("Fragment offset:\t" + str(fragmentOffset))
print( "TTL:\t\t\t"+str(TTL))
print("Protocol:\t\t" + Functions.getProtocol(protocolNR))
print("Checksum:\t\t" + str(checksum))
print("Source:\t\t\t" + sourceAddress)
print("Destination:\t\t" + destinationAddress)
print("Payload:\n"+str(data[20:]))
# receive a package
#print(s.recvfrom(65565))
#IP = input("Enter IP address to send: ")
#port = int(input("Port: "))
#..............................................................................................
print("\tOld Destination: "+ destinationAddress)
listunpacked[9] = hold
unpacked_data = tuple(listunpacked)
print("\n\t\tNew Address is: "+ unpacked_data[9])
print()
#s.inet_aton(unpacked_data[9]) = hold
#unpacked_data = tuple(listunpacked)
#unpacked_data = bytes(unpacked_data)
#destinationAddress = socket.inet_ntoa(unpacked_data[9])
#..............................................................................................
# tcp header fields
tcp_source = 80 # source port
tcp_dest = 5001 # destination port
tcp_seq = 454
tcp_ack_seq = 0
tcp_doff = 5 # 4 bit field, size of tcp header, 5 * 4 = 20 bytes
# tcp flags
tcp_fin = 0
tcp_syn = 1
tcp_rst = 0
tcp_psh = 0
tcp_ack = 0
tcp_urg = 0
tcp_window = socket.htons(5840) # maximum allowed window size
tcp_check = 0
tcp_urg_ptr = 0
tcp_offset_res = (tcp_doff << 4) + 0
tcp_flags = tcp_fin + (tcp_syn << 1) + (tcp_rst << 2) + (tcp_psh << 3) + (tcp_ack << 4) + (tcp_urg << 5)
# the ! in the pack format string means network order
tcp_header = tuple(struct.pack('!HHLLBBHHH', tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window,tcp_check, tcp_urg_ptr))
#p =(data+tcp_header)
#hold = bytes(hold,"utf-8")
#hold = socket.inet_aton ( hold )
#checksum = bytes(checksum,"utf-8")
#destinationAddress = c_int(listunpacked[9])
checksum = bytes(str(checksum),"utf-8")
#ip_header = struct.pack('!BBHHHBBH4s4s' , version_IHL, TOS, totalLength, ID,flags, TTL,protocolNR, checksum,sourceAddress,destinationAddress)
#tcp_header = struct.pack('!HHLLBBH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window) + struct.pack('H' , tcp_check) + struct.pack('!H' , tcp_urg_ptr)
#packet = ip_header + tcp_header + str(data[20:])
message = "How are you"
#data = bytes(unpacked_data,"utf-8") + tcp_header + message
ip_header = struct.pack('!BBHHHBBH4s4s' ,version_IHL, TOS, totalLength, ID,flags, TTL,protocolNR, checksum,sourceAddress,destinationAddress)
data = bytes(unpacked_data) + data[20:]
s.sendto(data, ("192.168.0.125" , 5001))
print("Packet sent")
# disabled promiscuous mode
s.ioctl(socket.SIO_RCVALL, socket.RCVALL_OFF)

ip_header = struct.pack('!BBHHHBBH4s4s' ,version_IHL, TOS, totalLength, ID,flags, TTL,protocolNR, checksum,sourceAddress,destinationAddress)
Both the B and H formats require integer arguments (or non-integer objects that implement the __index__ method) (see Format Characters).
The checksum argument is now of type bytes because you set it here before packing:
checksum = bytes(str(checksum),"utf-8")
And bytes objects do not implement the __index__ method.
You can check this using dir(checksum).
That's why you're getting the struct.error exception.
When packing a value x using one of the integer formats ('b', 'B',
'h', 'H', 'i', 'I', 'l', 'L', 'q', 'Q'), if x is outside the valid
range for that format then struct.error is raised.
Either:
Use a different variable for the bytes(str(checksum),"utf-8") output
Pass an int type object for the checksum value

Increase SYN packet sending rate in the python script

I am using raw sockets in python to send SYN packets repeatedly at high rate for a project. I am able to send SYN at a rate of 120 Mb/S using below python Script. Is there a way to optimize it to increase the rate of the packets?
I think CPU is the bottleneck, as my NIC supports upto 1 Gbps. I am even constructing the packet once and just resending it repeatedly.
# some imports
import thread
import socket, sys
from struct import *
import time
import datetime as dt
def sendFunc(s, packet, dest_ip, sizeOfPacket):
start_time = time.time()
i = 0
while(1):
time_diff = time.time() - start_time
i = i + 1
if time_diff > 1:
start_time = time.time()
print i*sizeOfPacket
i = 0
s.sendto(packet, (dest_ip , 0 )) # put this in a loop if you want to flood the target
# checksum functions needed for calculation checksum
def checksum(msg):
s = 0
# loop taking 2 characters at a time
for i in range(0, len(msg), 2):
w = (ord(msg[i]) << 8) + (ord(msg[i+1]) )
s = s + w
s = (s>>16) + (s & 0xffff);
#s = s + (s >> 16);
#complement and mask to 4 byte short
s = ~s & 0xffff
return s
#create a raw socket
try:
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
except socket.error , msg:
print 'Socket could not be created. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
sys.exit()
# tell kernel not to put in headers, since we are providing it
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
# now start constructing the packet
packet = '';
source_ip = 'x.x.x.x'
dest_ip = 'y.y.y.y' # or socket.gethostbyname('www.google.com')
# ip header fields
ihl = 5
version = 4
tos = 0
tot_len = 20 + 20 # python seems to correctly fill the total length, dont know how ??
id = 54321 #Id of this packet
frag_off = 0
ttl = 255
protocol = socket.IPPROTO_TCP
check = 10 # python seems to correctly fill the checksum
saddr = socket.inet_aton ( source_ip ) #Spoof the source ip address if you want to
daddr = socket.inet_aton ( dest_ip )
ihl_version = (version << 4) + ihl
# the ! in the pack format string means network order
ip_header = pack('!BBHHHBBH4s4s' , ihl_version, tos, tot_len, id, frag_off, ttl, protocol, check, saddr, daddr)
# tcp header fields
source = 1234 # source port
dest = 80 # destination port
seq = 0
ack_seq = 0
doff = 5 #4 bit field, size of tcp header, 5 * 4 = 20 bytes
#tcp flags
fin = 0
syn = 1
rst = 0
psh = 0
ack = 0
urg = 0
window = socket.htons (5840) # maximum allowed window size
check = 0
urg_ptr = 0
offset_res = (doff << 4) + 0
tcp_flags = fin + (syn << 1) + (rst << 2) + (psh <<3) + (ack << 4) + (urg << 5)
# the ! in the pack format string means network order
tcp_header = pack('!HHLLBBHHH' , source, dest, seq, ack_seq, offset_res, tcp_flags, window, check, urg_ptr)
# pseudo header fields
source_address = socket.inet_aton( source_ip )
dest_address = socket.inet_aton(dest_ip)
placeholder = 0
protocol = socket.IPPROTO_TCP
tcp_length = len(tcp_header)
psh = pack('!4s4sBBH' , source_address , dest_address , placeholder , protocol , tcp_length);
psh = psh + tcp_header;
tcp_checksum = checksum(psh)
# make the tcp header again and fill the correct checksum
tcp_header = pack('!HHLLBBHHH' , source, dest, seq, ack_seq, offset_res, tcp_flags, window, tcp_checksum , urg_ptr)
# final full packet - syn packets dont have any data
packet = ip_header + tcp_header
#Send the packet finally - the port specified has no effect
print "size of packet", len(packet)
sendFunc(s, packet, dest_ip, len(packet))

Why my TCP packet doesn't seems like a TCP packet for protocol analyzers?

I am trying to use raw sockets to send a GET request to a server. I am using raw sockets so I can edit the Packet window size. Here is my code.
import socket, sys
from struct import *
def checksum(msg):
s = 0
for i in range(0, len(msg), 2):
w = ord(msg[i]) + (ord(msg[i+1]) << 8 )
s = s + w
s = (s>>16) + (s & 0xffff);
s = s + (s >> 16);
s = ~s & 0xffff
return s
#create a raw socket
try:
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
except socket.error , msg:
print 'Socket could not be created. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
sys.exit()
# tell kernel not to put in headers, since we are providing it, when using IPPROTO_RAW this is not necessary
# s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
packet = '';
source_ip = '192.168.2.7'
dest_ip = '216.86.145.50' # or socket.gethostbyname('www.google.com')
# ip header fields
ip_ihl = 5
ip_ver = 4
ip_tos = 0
ip_tot_len = 0 # kernel will fill the correct total length
ip_id = 54321 #Id of this packet
ip_frag_off = 0
ip_ttl = 255
ip_proto = socket.IPPROTO_TCP
ip_check = 0 # kernel will fill the correct checksum
ip_saddr = socket.inet_aton ( source_ip ) #Spoof the source ip address if you want to
ip_daddr = socket.inet_aton ( dest_ip )
ip_ihl_ver = (ip_ver << 4) + ip_ihl
ip_header = pack('!BBHHHBBH4s4s' , ip_ihl_ver, ip_tos, ip_tot_len, ip_id, ip_frag_off, ip_ttl, ip_proto, ip_check, ip_saddr, ip_daddr)
# tcp header fields
tcp_source = 1234 # source port
tcp_dest = 80 # destination port
tcp_seq = 454
tcp_ack_seq = 0
tcp_doff = 5
#tcp flags
tcp_fin = 0
tcp_syn = 1
tcp_rst = 0
tcp_psh = 0
tcp_ack = 0
tcp_urg = 0
tcp_window = socket.htons (2048)
tcp_check = 0
tcp_urg_ptr = 0
tcp_offset_res = (tcp_doff << 4) + 0
tcp_flags = tcp_fin + (tcp_syn << 1) + (tcp_rst << 2) + (tcp_psh <<3) + (tcp_ack << 4) + (tcp_urg << 5)
tcp_header = pack('!HHLLBBHHH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window, tcp_check, tcp_urg_ptr)
user_data = "GET / HTTP/1.1\r\nHost:www.example.com\n\nUser-Agent:Mozilla 5.0\r\n\r\n"
source_address = socket.inet_aton( source_ip )
dest_address = socket.inet_aton(dest_ip)
placeholder = 0
protocol = socket.IPPROTO_TCP
tcp_length = len(tcp_header) + len(user_data)
psh = pack('!4s4sBBH' , source_address , dest_address , placeholder , protocol , tcp_length);
psh = psh + tcp_header + user_data;
tcp_check = checksum(psh)
tcp_header = pack('!HHLLBBH' , tcp_source, tcp_dest, tcp_seq, tcp_ack_seq, tcp_offset_res, tcp_flags, tcp_window) + pack('H' , tcp_check) + pack('!H' , tcp_urg_ptr)
packet = ip_header + tcp_header + user_data
s.sendto(packet, (dest_ip , 0 ))
I am using Wireshark to view the packet being sent. The problem is the output is not a TCP GET request packet. In wire shark the output is the white in colour, under protocol it says IPv4 and info says: 144 Unknown(255). How do I fix this?

Like #Sivir said you need to establish a three way handshake because you want to use the TCP protocol. In theory the handshake should look like this
YourProgram: sends a SYN packet
Server: sends SYNACK packet
YourProgram: sends a ACK packet
More information regarding this can be found here.

It's because you send one single packet, but in TCP you have to setup connection first (3 ways handshake), then send request and then close connection.
Although it is possible to implement it using raw socket, there is a few parameters that you need to control during connection. If you tell why do you need to control window size, may be there is way to do it without TCP protocol implementation.

reading DNS packets in Python

I'm playing around with Python sockets, and decided to see if I could implement a very basic name server (i.e. a lookup table for a domain name to an IP address). So I've set up my server so far to just dump the received data.
#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
host = ''
port = 53
size = 512
s.bind((host, port))
while True:
data, addr = s.recvfrom(size)
print repr(data)
When I run the above code and point my DNS to 127.0.0.1 I get something akin to the following:
'Y\x04\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03www\x06google\x03com\x00\x00\x01\x00\x01'
'J\xaa\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03www\x06google\x03com\x00\x00\x1c\x00\x01'
'Y\x04\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x03www\x06google\x03com\x00\x00\x01\x00\x01'
I'm assuming that it is something to do with the DNS question packet structure, but I'm not to sure.
A) Are the above escape characters? A specific text encoding? Or simply just bytes?
B) How can I interpret the data and work with it?
EDIT: Changing the socket to take raw instead of datagrams results in the following:
'E\x00$\x00\xe4\x96\x00\x00#\x01\x00\x00\x7f\x00\x00\x01\x7f\x00\x00\x01\x03\x03X\xb6\x00\x00\x00\x00E\x00V\x00m\x82\x00\x00\xff\x11\x00\x00\x7f\x00\x00\x01\x7f\x00\x00\x01\xf3\xe1\x005\x00B\x00\x00'

You could start with something like this:
#!/usr/bin/env python
import pprint
import socket
import struct
def decode_labels(message, offset):
labels = []
while True:
length, = struct.unpack_from("!B", message, offset)
if (length & 0xC0) == 0xC0:
pointer, = struct.unpack_from("!H", message, offset)
offset += 2
return labels + decode_labels(message, pointer & 0x3FFF), offset
if (length & 0xC0) != 0x00:
raise StandardError("unknown label encoding")
offset += 1
if length == 0:
return labels, offset
labels.append(*struct.unpack_from("!%ds" % length, message, offset))
offset += length
DNS_QUERY_SECTION_FORMAT = struct.Struct("!2H")
def decode_question_section(message, offset, qdcount):
questions = []
for _ in range(qdcount):
qname, offset = decode_labels(message, offset)
qtype, qclass = DNS_QUERY_SECTION_FORMAT.unpack_from(message, offset)
offset += DNS_QUERY_SECTION_FORMAT.size
question = {"domain_name": qname,
"query_type": qtype,
"query_class": qclass}
questions.append(question)
return questions, offset
DNS_QUERY_MESSAGE_HEADER = struct.Struct("!6H")
def decode_dns_message(message):
id, misc, qdcount, ancount, nscount, arcount = DNS_QUERY_MESSAGE_HEADER.unpack_from(message)
qr = (misc & 0x8000) != 0
opcode = (misc & 0x7800) >> 11
aa = (misc & 0x0400) != 0
tc = (misc & 0x200) != 0
rd = (misc & 0x100) != 0
ra = (misc & 0x80) != 0
z = (misc & 0x70) >> 4
rcode = misc & 0xF
offset = DNS_QUERY_MESSAGE_HEADER.size
questions, offset = decode_question_section(message, offset, qdcount)
result = {"id": id,
"is_response": qr,
"opcode": opcode,
"is_authoritative": aa,
"is_truncated": tc,
"recursion_desired": rd,
"recursion_available": ra,
"reserved": z,
"response_code": rcode,
"question_count": qdcount,
"answer_count": ancount,
"authority_count": nscount,
"additional_count": arcount,
"questions": questions}
return result
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
host = ''
port = 53
size = 512
s.bind((host, port))
while True:
data, addr = s.recvfrom(size)
pprint.pprint(decode_dns_message(data))
And then fill in the decoding functions for the remaining records.

Here's an example to send and receive dns packets using socket and dnslib:
import socket
from dnslib import DNSRecord
forward_addr = ("8.8.8.8", 53) # dns and port
client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
qname = "duckgo.com" # query
q = DNSRecord.question(qname)
client.sendto(bytes(q.pack()), forward_addr)
data, _ = client.recvfrom(1024)
d = DNSRecord.parse(data)
print("r", str(d.rr[0].rdata)) # prints the A record of duckgo.com