Build spoofed IP packets

[billie]

Hi all. I'd need to build spoofed IP packets. Do you know something about a
python implementation?
For low level packet building I already used Impacket module but if I
specify a spoofed src address during IP packet creation, module returns an
error.
Suggestions?

Regards.

[Sybren Stuvel]

Re: Build spoofed IP packets

billie enlightened us with:[color=blue]
> For low level packet building I already used Impacket module but if
> I specify a spoofed src address during IP packet creation, module
> returns an error. Suggestions?[/color]

Yes, give us the error. And know that you can't build raw IP packets
unless you're root.

Sybren
--
The problem with the world is stupidity. Not saying there should be a
capital punishment for stupidity, but why don't we just take the
safety labels off of everything and let the problem solve itself?
Frank Zappa

[billie]

Re: Build spoofed IP packets

[color=blue]
> Yes, give us the error. And know that you can't build raw IP packets
> unless you're root.
>
> Sybren[/color]

Sorry. I forgot to paste the error:

Traceback (most recent call last):
File "C:\test\client .py", line 156, in ?
send_pkt()
File "C:\test\client .py", line 96, in send_pkt
s.sendto(ip.get _packet(), (dst, 0)) # send packet to server
socket.error: (10004, 'Interrupted system call')

Note: this only happens on Windows XP prof SP2. On Linux I got no problems.
I run the program as Administrator.

[Eric Nieuwland]

Re: Build spoofed IP packets

billie wrote:[color=blue]
> Traceback (most recent call last):
> File "C:\test\client .py", line 156, in ?
> send_pkt()
> File "C:\test\client .py", line 96, in send_pkt
> s.sendto(ip.get _packet(), (dst, 0)) # send packet to server
> socket.error: (10004, 'Interrupted system call')
>
> Note: this only happens on Windows XP prof SP2. On Linux I got no
> problems.
> I run the program as Administrator.[/color]

It's SP2. Microsoft decided allowing raw socket access is a security
threat and disabled it in SP2.

--eric

[billie]

Re: Build spoofed IP packets

> It's SP2. Microsoft decided allowing raw socket access is a security[color=blue]
> threat and disabled it in SP2.[/color]
Uhm.. I heard about that. Damn it. :-\