Okay, firstly sorry to my poor english.



(1).TCP three-times handshakes:
    A( SYN, ISN_A ) -> B
    A <- B( SYN/ACK, ISN_B/ACK_AISN_A+1 )
    A( SYN/ACK, ACK_A/ACK_BISN_B+1 ) -> B

Socket API 'connect()' just does the 3times
handshakes. 'sleep(1)' is to sure that sniffer child is
running. In sniffer child, only captures the related
packets, it's object is to get the ISN_B of this
connection. After the handshakes is over, pack a packet to
B and inject it into the connection. And if you don't want
the connection closed, you must pack a correct packet to A
too.

(2).Blind handshakes
If the ISN of B is predicted. You can capture ISNs of each
connection and analyst the numbers. For example, the ISN of
B is not change anytime.

A - i
B - you, ISN will not change.
C - he

I:  A(src_ip:C, SYN, ISN_Cany) -> B
II: C <- B(dest_ip:C, SYN/ACK, ISN_B/ACK_CISN_C+1 )

if C is active:

III: C(dest_ip:B, RST) -> B

if C is not active:

IV: A(src_ip:C, SYN/ACK, ACK_C/ACK_BISN_B+1 ) -> B

If i can 'see' the packet II(for example, C and A are in
the same network), i can get the ISN_B correctly. And if
the C is not alive, i can generate the packet IV to
complete the 3times handshakes from C->B. And if i can
not 'see' the packet II(C is not in my networks and not in
my HUB/Switch device), i could guess the ISN_B as before
analyst. This is called ip spoof.

... It's an old tcp game.





--------------------------
I 4m jU$t A $cRipt /<iddi3


 
 


In reply to Re^2: Insert the 4th TCP packet after TCP three-times handshakes
by shanleiguang

in thread Insert the 4th TCP packet after TCP three-times handshakes
by shanleiguang





Title:




Use:  <p> text here (a paragraph) </p>

and:  <code> code here </code>

to format your post, it's "PerlMonks-approved HTML": 











 
 



  •  Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data! 
    • 

  •  Titles consisting of a single word are discouraged, and in most cases are disallowed outright. 
    • 


  • 
  Read Where should I post X? if you're not absolutely sure you're posting in the right place.

    • 


  • 
  Please read these before you post! —

    • 


  • 
  Posts may use any of the Perl Monks Approved HTML tags: 
  
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
    

    • 






  • 
  You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

  
    
  
    
           
     For: 
       
     Use: 
  
    
  
     &  &amp; 
    
  
     <   &lt;  
    
  
     >   &gt;  
    
  
     [  &#91; 
    
  
     ]  &#93; 
    
  
    


    • 

  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
    • 

  • 
  See Writeup Formatting Tips and other pages linked from there for more info.

    •