Network Security Tools

Creating the SYN Packet

Because SYNplescan works at the TCP layer, we can open the libnet context for raw sockets mode as follows:

l = libnet_init (LIBNET_RAW4, device, libnet_errbuf);

To create the outgoing SYN packet, we are going to start with the libnet_build_tcp() function, as this is the highest-level protocol in this example. This is shown in Example 11-7.

Example 11-7. Creating the TCP header

libnet_ptag_t tcp = 0;    /* libnet protocol block */

tcp = libnet_build_tcp (libnet_get_prand (LIBNET_PRu16),    /* src port */
                  ports[i],    /* destination port */
                  libnet_get_prand (LIBNET_PRu16),    /* sequence number */
                  0,    /* acknowledgement */
                  TH_SYN,    /* control flags */
                  7,    /* window */
                  0,    /* checksum - 0 = autofill */
                  0,    /* urgent */
                  LIBNET_TCP_H,    /* header length */
                  NULL,    /* payload */
                  0,    /* payload length */
                  l,    /* libnet context */
                  tcp);    /* protocol tag */

if (tcp == -1)
 {
   fprintf (stderr,
       "Unable to build TCP header: %s\n", libnet_geterror (l));
   exit (1);
 }

libnet_build_tcp( ) specifies the field values for the TCP header. In this case we are specifying that the TCP packet has the SYN flag set (using the TH_SYN value; this is a constant supplied in the tcp.h include file), that the TCP packet is empty (there is no pointer to a payload), and that the payload length is 0.

Also note that the value 0 has been provided as the checksum for the TCP header. By default, if 0 is provided as a value for a packet header’s checksum, libnet calculates the correct value and inserts it into the header for ...