Capturing, Processing and Resendig Packets

Aug 6, 2011 at 7:54 PM

Hi Boaz,

Hello to everyone and thank you for your great efforts. i have only 1 question wich is the best metod to recive process and resend packets in performance matters the ReceivePacket, RecivePackets or ReceiveSomePackets, i want to put the incoming packets in a queuqe then process them and finally send them back im using diferent synchronized threads to acces the qeuque but i dont know wich method would be the most efficient,

Thanks...

Coordinator
Aug 12, 2011 at 6:01 AM

Hi Adum_264,

 

ReceivePacket() is the easiest method to use and you should probably start there.

It seems to me that ReceivePackets() might be appropriate since you can simply call it and ask that every received packet would be handle by some method.

 

ReceivePacket() uses pcap_next_ex() 

ReceivePackets() uses pcap_loop()

ReceiveSomePackets() uses pcap_dispatch()

 

Short Googling gave me this http://comments.gmane.org/gmane.network.winpcap.user/228

"How does using pcap_next_ex() compare with pcap_loop() - performance-wise?"
"There is no performance penalty, we have used pcap_next_ex at multigigabit 
rates."

 

Also take a look here: http://www.winpcap.org/pipermail/winpcap-users/2009-April/003192.html

 

I hope this helps,

 

Boaz.

Aug 12, 2011 at 4:55 PM

Hi Boaz, thanks for clarifing me that, well now my man-in-the-middle app is almost done but something strange is going on, and i cant figure out what's wrong , see :

Capture

when the victim ping to the gateway (192.168.1.254 ) the packet comes to me because the victim(192.168.1.76) is arp poisoned ,  so i change the ehernet and ip layer of the packet and i send it again to the real gateway , then thee gateway send the reply to me, and i send it back to the victim , everithing works fine! , but when i send a ping to an external server (facebook.com) first the victim needs to resolve the ip , so it send a dns request, and as you can see my app do the same thing but i never get a reply and i dont know why ! , i hope you cant tell me what is wrong  = (

Coordinator
Aug 12, 2011 at 8:42 PM

Try and make the victim ping 8.8.8.8 and see what is going on.

Aug 13, 2011 at 3:19 AM

i did it :

= (

Coordinator
Aug 13, 2011 at 7:57 AM

So you do get replied for pings but don't get replies for DNS?

And without ARP poisoning you get replies for both?

Aug 13, 2011 at 3:51 PM
brickner wrote:

So you do get replied for pings but don't get replies for DNS?

yes

And without ARP poisoning you get replies for both?

exactly

and also i realized that when mi program is running mi system gets poisoned too so i have,  192.168.1.254 -> myownmac,  but i dont know because my program send packets to the victim , not to me

Coordinator
Aug 13, 2011 at 4:41 PM

If you use the same default gateway - 192.168.1.254, and you're also poisoned that's explains why the packets are not reaching their destination and why you own't get responses.

It doesn't explain why you get responses for pings and no responses for DNS.

 

If I understand correctly, Apple_b0:d8:cb is the victim. IntelCor_09:d5:d0 is the man in the middle. 2wire_0b:98:01 is the gateway. Right?

 

I would try to use different DNS servers and see if they might work, it is weird to get responses for pings and no responses for DNS requests.

Aug 13, 2011 at 8:02 PM
Edited Aug 13, 2011 at 10:51 PM

i cheked the isvalid() property of my packets before send them  to the gateway, with icmp packets all are valid , but with dns packets i got unvalid packets :

paa is the dns packet just before send it to the gateway , but i just changed the source , destination and (HeaderChecksum to null) properties in the ipv4layer just that... that transportchecksumcorrect what do i

need to change in order to get a valid packet.

 

look here :

p is the incoming packet and p2 is the modified packet and the watch mark p2 as invalid because of the transportchecksumcorrect of the ipv4 datagram property

Aug 17, 2011 at 8:41 PM

never mind i figured out, the udp packet checksum was wrong -_- so i set it to null ,

 

but  1 more question why when i call communicator.break(); never returns, or at least take like 10 seconds

Coordinator
Aug 19, 2011 at 5:27 AM

I'm not sure why doesn't it break.

Have you read the full documentation of Break() ?

Boaz.