Introduction to RAW-Sockets Jens Heuschkel, Tobias Hofmann, Thorsten Hollstein, Joel Kuepper
Total Page：16
File Type：pdf, Size：1020Kb
Introduction to RAW-sockets Jens Heuschkel, Tobias Hofmann, Thorsten Hollstein, Joel Kuepper 16.05.2017 Technical Report No. TUD-CS-2017-0111 Technische Universität Darmstadt Telecooperation Report No. TR-19, The Technical Reports Series of the TK Research Division, TU Darmstadt ISSN 1864-0516 http://www.tk.informatik.tu-darmstadt.de/de/publications/ Introduction to RAW-sockets by Heuschkel, Jens Hofmann, Tobias Hollstein, Thorsten Kuepper, Joel May 17, 2017 Abstract This document is intended to give an introduction into the programming with RAW-sockets and the related PACKET-sockets. RAW-sockets are an additional type of Internet socket available in addition to the well known DATAGRAM- and STREAM-sockets. They do allow the user to see and manipulate the information used for transmitting the data instead of hiding these details, like it is the case with the usually used STREAM- or DATAGRAM sockets. To give the reader an introduction into the subject we will first give an overview about the different APIs provided by Windows, Linux and Unix (FreeBSD, Mac OS X) and additional libraries that can be used OS-independent. In the next section we show general problems that have to be addressed by the programmer when working with RAW-sockets. We will then provide an introduction into the steps necessary to use the APIs or libraries, which functionality the different concepts provide to the programmer and what they provide to simplify using RAW and PACKET-sockets. This section includes examples of how to use the different functions provided by the APIs. Finally in the additional material we will give some complete examples that show the concepts and can be used as a basis to write own programs. The examples are programmed in C++ and we assume that the reader has basic programming skills and networking knowledge to be able to understand the listings and content of this document. 1 Contents 1 Introduction 8 1.1 RAW-sockets..................................................8 1.2 PACKET-sockets and Data Link Layer APIs................................9 2 Implementations for different Operating Systems 10 2.1 Windows.................................................... 10 2.1.1 Winsock-API.............................................. 10 2.1.2 winpcap................................................. 10 2.2 Linux...................................................... 10 2.2.1 RAW-sockets.............................................. 10 2.2.2 PACKET-sockets............................................ 11 2.3 Unix (FreeBSD, Mac OS X).......................................... 11 2.3.1 RAW-sockets.............................................. 11 2.3.2 Berkeley Packet Filter (BPF)..................................... 12 2.4 OS independent................................................. 12 2.4.1 pcap................................................... 12 2.4.2 libnet.................................................. 12 3 Programming with the APIs 13 3.1 General..................................................... 13 3.1.1 Byte Order............................................... 13 3.1.2 Checksum................................................ 13 3.1.3 Type-Casting.............................................. 14 Linux.................................................. 14 3.1.4 Header-Positions............................................ 14 3.2 RAW-sockets.................................................. 15 3.2.1 socket() ............................................... 15 Unix................................................... 16 3.2.2 setsockopt() ............................................ 16 Unix................................................... 17 3.2.3 getsockopt() ............................................ 17 Unix................................................... 18 3.2.4 bind() ................................................. 18 Unix................................................... 18 3.2.5 getsockname() ........................................... 19 Unix................................................... 19 3.2.6 connect() ............................................... 19 Unix................................................... 19 3.2.7 Read................................................... 19 read() ................................................. 20 recv() ................................................. 20 recvfrom() .............................................. 20 flags and errors for the recv()- and recvfrom()-functions................... 21 Unix................................................... 22 3.2.8 Write.................................................. 22 write() ................................................ 22 send() ................................................. 22 sendto() ............................................... 23 Flags and errnos for the send() and sendto() functions.................... 23 Unix................................................... 24 3.2.9 close() ................................................ 24 Unix................................................... 25 3.2.10 inet_ntop() ............................................. 25 Unix................................................... 25 3.2.11 inet_pton() ............................................. 25 Unix................................................... 26 3.2.12 Data Types .............................................. 26 3.2.13 Layer 4................................................. 28 2 Unix................................................... 28 Read................................................... 28 Write.................................................. 30 3.2.14 Layer 3................................................. 30 Read................................................... 32 Write.................................................. 32 3.2.15 Layer 2 - PACKET-sockets...................................... 36 Promiscuous Mode........................................... 36 MAC-Address.............................................. 36 Read................................................... 36 Write.................................................. 38 3.3 Berkeley Packet Filter (BPF)......................................... 40 3.3.1 BPF Header.............................................. 41 3.3.2 Buffer Modes.............................................. 41 3.3.3 IOCTLS................................................. 41 3.3.4 SYSCTL Variables........................................... 42 3.3.5 Filter Maschine............................................. 42 3.3.6 Read................................................... 42 3.3.7 Write.................................................. 44 3.4 Winsock-API.................................................. 44 3.4.1 Preparations and Usage........................................ 46 4 Programming with the libraries 47 4.1 Libnet...................................................... 47 4.1.1 Preparations.............................................. 47 4.1.2 Process of packet creation....................................... 47 Library initialization.......................................... 47 Packet building............................................. 49 Packet write.............................................. 49 Packet destruction........................................... 49 4.1.3 Functions................................................ 51 Library initialization.......................................... 51 Build Functions............................................. 51 Write.................................................. 54 Destruction............................................... 54 Other functions............................................. 55 4.2 libpcap...................................................... 58 4.2.1 Preparation............................................... 58 4.2.2 Process of packet capturing...................................... 58 Interface Selection........................................... 58 Initialize libpcap session........................................ 58 Define Filters.............................................. 58 Initiate Sniffing process........................................ 59 Identification of the header size................................ 59 Casting............................................. 60 Byte order............................................ 60 Close libpcap session.......................................... 60 4.2.3 Functions................................................ 60 Interface Selection........................................... 60 Initialize libpcap session........................................ 62 Define Filters.............................................. 62 Initiate Sniffing process........................................ 63 Close Session.............................................. 65 Other functions............................................. 65 4.3 libpcap in Windows.............................................. 65 4.3.1 Installation and Preparation...................................... 66 4.3.2 Process of packet capturing...................................... 66 4.3.3 Functions................................................ 66 5 Literature 67 3 A Appendix: Listings 69 A.1 rfc1071 checksum cpp............................................. 69 A.2 win socket cpp................................................. 70 A.3 libnet tcp c................................................... 72 A.4 sendpack c.................................................... 75 A.5 dump c..................................................... 76 B Appendix: