Re: pcap processing

["Luis MartinGarcia." <luis.mgarc () gmail com>]

::I wrote this hours ago when I was in a train and had no internet
connection. Now there are many replies to your message but I'll still
send it just in case you find it useful ::

Hi Robert,

This behavior is normal in most systems. I'll try to explain why:

The thing here is that you are generating TCP SYN packets, but your
local TCP/IP stack has no idea about it, so when it receives the TCP
SYN|ACK it thinks "Hey! I did not try to establish any TCP connection
with this host; i'll just tell him that I don't want his garbage traffic
(sending a RST)".

You obviously don't want your system's kernel to send TCP RST packets to
your target host, because that way you'll never get to establish a TCP
connection. To avoid it, you'll have to block outgoing TCP RST packets.
If you are on linux, you can do that with the following iptables command:

iptables -A OUTPUT -p tcp --tcp-flags rst rst -j DROP

Probably there is a way to disable this at the kernel level, but you'd
have to check kernel's code and recompile. This is the easiest solution
I've been able to come up with. I hope this helps.

Luis MartinGarcia.



On 09/23/2010 01:43 PM, Robert Kat wrote:
> Morning!
>   I am trying to generate a HTTP GET request to an apache web server by
> using the pcap interface of nmap.  I am able to send the server the SYN
> packet and it replys with the SYN/ACK (verified via Wireshark).  But when I
> get the SYN/ACK from the server, someone sends out an RST which messes with
> my ACK and subsequent sends.  Is nmap sending this out for me?  If so why
> and how can I prevent it.  I have looked at the path-mtu, ipidseq scripts as
> examples they just are not doing what I am trying to do.
>
>   Yes I know that I can use the connect and send methods and not worry about
> the low-level packet stuff but that defeats me having some fun and learning.
>
> TIA,
> Tim
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/
>
>   

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/