Raw sockets

hi
i have 2 questions;
first:
i want to design a network monitoring and packet capturing tool for my school project
i read the related topics but i have still doubts,
if i should use whether java or c . i dont know which one is better for such a tool.
and second:
do c and/or java raw sockets work under xp home edition
thanks...

you can in either, id suggest you just pick which language you are more comfortable in.
In java you can use the JPCAP libraries to mornitor traffic

Similar Messages

Raw Socket Access

I need to negotiate password hashes for Authentication: NTLM (opposed to BASIC) but this requires sending a message back to the client and receiving the hashes without closing the socket. There's a nice diagram of this handshake here:
http://www.innovation.ch/java/ntlm.html
Is there any way to basically bypass all HTTP connection control and get access to the raw socket so I can do this handshake?
I have all the code worked into the new jcifs.http package but it doesn't work because sending back 401 Unauthorized implicitly closes the connection.
Any ideas would be greatly appreciated,
Mike

I need to negotiate password hashes for Authentication: NTLM (opposed to BASIC) but this requires sending a message back to the client and receiving the hashes without closing the socket.
This problem was indeed solved. The jCIFS jcifs.http package now has an NtlmHttpFilter, NtlmSsp class for creating custom MSIE HTTP Authentication modules, and a NetworkExplorer Servlet for browsing the WAN with your transparently negotiated credentials.
http://jcifs.samba.org/

Why does not java support raw sockets?

Java does not have support for raw sockets, that means it cannot receive the packet header, just the payload data.
But the header data of an ICMP packet consists of 20 bytes, and you can still write single bytes in Java, so why isn´t is possible to write a header for an ICMP packet in Java?
Can someone explain how it all works?
Thanks!

You can do raw sockets with third party libraries. They won't be pure java - but you didn't really expect to do raw sockets on your cell phone or TV set top box, or spy and spoof someone's network using an applet.
The FAQ for one such library hints what kind of a mess raw sockets are due to differences in common operating systems; see http://www.savarese.com/software/rocksaw/

Panic with Raw Socket-Page fault in module "ip" due to a NULL pointer deref

I see a panic when using raw sockets with Solaris 10 10/09 (u8). I included a sample program that can cause this issue (panic happens when a udp datagram is received on port 60000). This sample code works as expected with the previous version I was using - 5/08. If I bind with a port number of 0 I don't see the panic but I don't receive anything either.
I believe I have all the latest patches installed. I'd appreciate any assistance in resolving this. Thanks...
^Mpanic[cpu11]/thread=fffffe8000916c60:
BAD TRAP: type=e (#pf Page fault) rp=fffffe80009166c0 addr=83 occurred in module "ip" due to a NULL pointer dereference
sched:
#pf Page fault
Bad kernel fault at addr=0x83
pid=0, pc=0xffffffffedf86a10, sp=0xfffffe80009167b0, eflags=0x10246
cr0: 8005003b<pg,wp,ne,et,ts,mp,pe> cr4: 6f8<xmme,fxsr,pge,mce,pae,pse,de>
cr2: 83 cr3: 1a345000 cr8: c
rdi: ffffffffa7092808 rsi: ffffffffb0094e00 rdx: ffffffffa73c9d40
rcx: 0 r8: fffffe8000916878 r9: fffffe8000916880
rax: 0 rbx: ffffffffb0094e00 rbp: fffffe8000916800
r10: ffffffffa7c18840 r11: ffffffffa73c9d40 r12: fffffe8000916880
r13: ffffffff9b314000 r14: ffffffff9a70b000 r15: 0
fsb: ffffffff80000000 gsb: ffffffff9c52d800 ds: 43
es: 43 fs: 0 gs: 1c3
trp: e err: 0 rip: ffffffffedf86a10
cs: 28 rfl: 10246 rsp: fffffe80009167b0
ss: 30
fffffe80009165d0 unix:die+da ()
fffffe80009166b0 unix:trap+5e6 ()
fffffe80009166c0 unix:_cmntrap+140 ()
fffffe8000916800 ip:ip_udp_check+b0 ()
fffffe80009168b0 ip:ip_udp_input+15a ()
fffffe80009169d0 ip:ip_input+c7c ()
fffffe8000916aa0 dls:i_dls_link_rx+32e ()
fffffe8000916af0 mac:mac_rx+71 ()
fffffe8000916b90 bnx:bnx_recv_ring_recv+113 ()
fffffe8000916ba0 bnx:bnx_rxpkts_intr+17 ()
fffffe8000916bc0 bnx:bnx_intr_recv+58 ()
fffffe8000916bf0 bnx:bnx_intr_1lvl+120 ()
fffffe8000916c40 unix:av_dispatch_autovect+78 ()
fffffe8000916c50 unix:intr_thread+5f ()
EXAMPLE USED TO CAUSE ABOVE PANIC
#include        <unistd.h>
#include        <stdio.h>
#include        <stdlib.h>
#include        <sys/socket.h>
#include        <arpa/inet.h>
#define BUFFER_SIZE 2048
int main(int argc, char *argv[])
        int                     i, j, sd, iosize;
        char                    *ipbuffer;
        struct sockaddr_in      saddr, daddr;
        ipbuffer = calloc( 1, BUFFER_SIZE );
        //if ( ( sd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) ) < 0 ) {        // Works
        if ( ( sd = socket(PF_INET, SOCK_RAW, IPPROTO_UDP) ) < 0 ) {            // Fails
                perror("socket() error");
                exit(-1);
        saddr.sin_family = AF_INET;
        saddr.sin_addr.s_addr = inet_addr( "0.0.0.0" );
        saddr.sin_port = htons( 60000 );
        if ( bind( sd, (struct sockaddr *) &saddr, sizeof( saddr ) ) < 0 ) {
                perror("bind() error");
                exit(-1);
        printf( "Awaiting inbound datagrams...\n" );
        for ( i = 1; i <= 10; i++ ) {
                j = sizeof( daddr );
                iosize = recvfrom( sd, ipbuffer, BUFFER_SIZE, 0, (struct sockaddr *) &daddr, &j );
                printf( "Received %d bytes from %s\n", iosize, inet_ntoa( daddr.sin_addr ) );
        close( sd );
        return( 0 );
}------------------------------------------------------------------

This issue could be related. Recommend you open a call with support.
http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6882984

Raw sockets with IP headers in mac osx

I am trying to send IP packets through a raw socket (SOCK_RAW) on my mac (osx 10.6), and always get an "Invalid Argument" error. I have tried with IPPROTO_RAW, IPPROTO_UDP, and IPPROTO_DIVERT (which should also send raw packets). When using _RAW or _UDP, I also set the socket option for including ip headers with setsockopt(.., IP_HDRINCL, ..). Has anyone successfully sent IP packets with a raw socket on a mac that includes IP headers? Any example code I can use as a reference? Thanks!

Well, in case anyone ever has the same issue, the only way I was able to inject packets back with my own IP headers was by writing to a bpf socket, which is not the prettiest way, but works. I am still interested in seeing IP_HDRINCL work on a raw socket, so if anyone has an example that works, please post!

Raw socket programming is avilable in java

hello,
I want to reset my target device using device
MAC address (not IP address).
Is java support raw socket programming.
can i send packets using MAC address in Java like C.
I search in google. but, it shows there is no raw socket pgm support in java.
any one help me this issue.

JPCap

Raw Sockets and Root Administration

I've been reading the DOS articles on grc.com. Quite a cool website with lots of interesting information.
I was wondering if there is a way to remove raw socket support from the kernel. I assume that that must be where that support is implemented, and I'm wondering if a way to prevent ip spoofing and other abusive techniques has been developed. The articles on grc.com are unclear as to whether the raw sockets support is required for ICMP, but it seems as though it is required. Basically, is there a way to prevent ip spoofing in the linux kernel?
Also, it is mentioned that *nix tries to minimize abuse of the raw sockets system by only allowing the root user to make use of it. How would one go about setting up another user to administrate the system? The default way would seem to be setting up sudo access, but then you're basically giving that user root privileges for everything, which really doesn't seem to solve this problem to me.
My understanding of this is somewhat limited, but I like to think that I comprehended the information about all this. If I have something wrong, tell me, I'm not one of those idiots that refuses to be told he is wrong.

Could you please clarify me whether you could finally execute your program or not?
I am also facing the same kind of problem.
I have some RAW socket user level SCTP implementation which I am trying to run on SOlaris 10.But when I run user level SCTP program, its giving always "Cann't assign Address" i.e ERRNO : 126.
Any clue from everybody...

Raw Sockets in Java

Hi
Is it possible to create raw socket like in C. In C, I am able to create a structure like below
struct ipheader {
unsigned char ip_hl:4, ip_v:4;
unsigned char ip_tos;
unsigned short int ip_len;
unsigned short int ip_id;
unsigned short int ip_off;
unsigned char ip_ttl;
unsigned char ip_p;
unsigned short int ip_sum;
unsigned int ip_src;
unsigned int ip_dst;
An then declaring a pointer to this structure enables me to create my own IP header. Adding up Ethernet, TCP and IP headers creates a data packet.
I wonder weather is it possible to create a packet like this in Java or not?
Thanks...

Well, it is possible to create a structure like that. Sending it to the net will require OS-dependent JNI, though. And possibly special security permissions, depending on your OS.
What are you really trying to do?

Raw Socket: Protocol Not Supported

OS Solaris 10, using Zones
I have one zone set up which houses HP Openview NNM 7.5
Inside of the application you should be able to right click on a node and do a traceroute or telnet to the node.
Neither works. Get error:
raw socket: Protocol not supported
Can anyone tell me if this is an OS issue or HP Openview issue?
Any assistance will be greatly appreciated!!!

This is known issue in zone. Please see http://developers.sun.com/solaris/articles/application_in_zone.html about socket function.
But if you really need traceroute in nnm, you can use /usr/sbin/traceroute.
Here's how:
manager@ov:~$ diff /root/old-NNM-IP.tbl $OV_REGISTRATION/C/ovip/NNM-IP.tbl
473c473
< -cmd ovtraceroute ";
-cmd traceroute "; You can always add something like "xterm -e telnet" instead of "not working" menu item in registration file. Please see "Creating and Using Registration Files" guide on http://docs.hp.com.
nice nnm-ing :)
Message was edited by:
Porky@Pig

Opening a RAW socket - how to become superuser to do so ?

Hi, I'm writing my first test application, so I thought I'd convert an easy known quantity like ping. My problem here seems to be that to open a RAW socket I need to have a UID of 0, and I haven't got that or can I set it. So how is it done ? My various printf's to the console show me -
[Session started at 2008-09-20 00:17:47 +0100.]
Running pingmain
Running as UID 501
Running as EUID 501
Have set UID to 0, result code: -1
Have set EUID to 0, result code: -1
PING (null) (192.168.1.100): 56 data bytes
socket error: Operation not permitted
Failed to launch simulated application: Unknown error.
501 also happens to be the UID I'm assigned on my iMac, is it simply the case of su;ing to root and then starting xcode.. doesn't seem to be the right thing to do somehow.
Can anyone give me any hints onto what I should be doing here ?

Doing this the right way is a very messy process:
http://developer.apple.com/documentation/Security/Reference/authorizationref/Reference/reference.html#//appleref/c/func/AuthorizationExecuteWithPrivileges
or
http://developer.apple.com/samplecode/BetterAuthorizationSample/listing6.html

Raw Socket in Java

Hello everybody. Since 2 years ago, I was looking for the Java RAWSOCKET class, and I read that it was possible....Up to now I did not read nothing about this...So, when could I find the Java RawSocket? Many thanx...
Ivano

I talking to Java developers....but they didn't answer
me! I need a response... I wanna know why there is not
a Java Raw Socket Class....or a Java ICMP Socket (NOT
NATIVE, NOT IN C, NOT JNI, OK?). First of all the socket classes that already exist in java already DO use JNI. You just don't see it.
I know that icmp
socket require root privilege, but, for example, in
PDA or cellular phone (J2ME) it doesn't need about
root privilege to "make ping" (Icmp echo).
Will they answer me ? Hoping.....If you give Sun a lot of money then they will be happy to add almost anything you want to java.
But if not then Sun is going to add what they feel is important.

Future raw socket capability in Java?

Is there raw socket capability with Java now? As I recall, Java only supports TCP and UDP sockets, right? I hope Java will include support for raw sockets, especially since Windows XP will support it as a standard.

I agree; I wouldn't mind some restrictions (to prevent IP spoofing) but developers should definitely have access to the don't fragment bit, the protocol field and the entire payload. Sometimes neither TCP nor UDP will get the job done...

GenericServlet on raw socket

Hi,
          is ist possible to deploy GenericServlets that would listen on raw socket messages (without the Http GET line)?
          As in the API doc for GenericServlet:
          Defines a generic, protocol-independent servlet.
          Thanks,
          Juergen

That's a pity. No chance of it getting implemented in WLS? I found this paper discussing the problem:
          An Approach Paper for Listener Architecture using Web Server
          http://dev2dev.bea.com/pub/a/2004/06/Approachppr.html

4727550 Advanced & Raw Socket Support (ICMP, ICMPv6, ping, traceroute, ...)

Hi All,
4727550 was a long standing RFE. Before we take any action, I'd like to ask you guys what the requirements are. E.g., do you plan to use raw socket in what kind of application? What features do you want the most? Which platform do you plan to use? etc.
Feel free to add your comments here.
Thanks,
Edward

sjasja wrote:
Its sad to realize at different occasions, that Java
is just not usable for this type of application, e.g.
writing a firewall...Sure it is! You just need some glue between operating system specific APIs and Java.
This is not really a language issue. It's an issue of what language APIs a given OS supports out of the box. Want to write a firewall using C and deploy it on a LISP machine? Be prepared to write some C/LISP glue, just like you'd write Java/C glue to access APIs written in a C-based OS.
C is so widespread, and so many OSes offer C APIs that C seems "universal". But that's just an illusion. The OSes that happen to be most popular at this time in history happen to provide C APIs to most of their functionality (even then you may occasionally need C/assembly glue for some things).
More and more APIs, such as low level TCP access, will eventually migrate to Java. But ther is no "universal" language, magically able to access any API written in any other language.I think you are missing the point. In order to write a firewall in Java, you have to have raw socket support - IE: be able to specify the data going over the transport. Java currently supports TCP and UDP, but does not support any others (IPX, ICMP, etc).
The reason these things are not available at the Java layer is because the underlying C code in the JVM is specifying the constants to pass to the socket library at the C level rather than letting the Java layer pass those parameters down. You can currently do it yourself by doing a bootstrap replacement for the JVM classes, or using a 3rd party library -- but you shouldn't need to. The underlying library should be rewritten as raw socket, and allow the existing libraries to be built as pure-java implementations on top of it.
The reason that raw sockets were not around to begin with was that everyone was afraid it was a security risk. It is unfortunate that in order to protect us, they keep us from writing security software.
As a side note, I think these two comments on the bug ( http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4727550 ) are interesting:
4093850 "ICMP protocol support a.k.a. PING applets" was a long
standing RFE seeking ICMP/raw sockets support. It attracted approximately
250 votes on the JDC. It became clear from the feedback to the RFE
that there were broadly two requirements :-
In about one month (from 2006-08-23 to 2006-09-20), we don't see enough input in the SDN forum thread for this RFE. Seems there's no enough interest for it.
If it "became clear" that people wanted this functionality, why post a brand new link somewhere and monitor it for one month to determine if anyone wanted the functionality. I didn't even know about this link until a friend mentioned that the bug had been updated.
So, enough of a rant. I think that if we could write a full-fledged software firewall in Java without using a 3rd party library or JNI, then we'd be on the right track for requirements.

Raw Socket always drop packets and return Destination Unreachable

Ho folks,
I have an application program that opens a raw socket to expect for UDP message incoming from the network.
However everytime I receive a package the Solaris 10 OS return a ICMP - Destination (port) unreachable, and no message
is send to my application.
I did test the same application in linux and it worked well, all that I have to do was disable ICMP responses using iptables.
Just to make things clear:
In linux the OS was sending the ICMP - Destionation (port) unreachable, however my program was
receiving the packets anyway. So just to stop those messages I did use the iptables. However, in
Solaris 10 the ICMP response is sending back and no message is forward to my application.
Would your guys help me to solve that?
Thanks in advance

Folks, here I go again...:-)
I have been spent some time, trying to figure out why it is not work. I read in books and internet, that BSD raw sockets DO NOT allow us to receive TCP/UDP packages. However the linux implementation DOES allow. That is because it work in linux but not in solaris.
Given that, such information is 100% true (book: Unix NetworkProgramming, 3rd edition), I would like to ask your guys what I can do to solve my problem.
Basically what I need is create an application that:
1) Allows to bind thousand of sockets at the same time (it is a media server that handles thousand of RTP connections)
This I believe I can do using socket multiplexing (e.g. select() )
2) Read not only the packet data, I need to retrieve the whole packet address (including IP, UDP, Upper Layers...)
When using SOCK_DGRAM with IPPROTO_UDP, I can get the messages but I can't get the IP header
3) Uses something like raw socket to send messages, here I believe I can use raw socket with no problem, is just sending messages
Thanks and Regards

Raw sockets

Similar Messages

Maybe you are looking for