==========================================================================================
NETWORK
==========================================================================================
<NETWORK>
=TCP



=
http://www.ktword.co.kr/abbr_view.php?nav=&m_temp1=2437&id=1103
. CODE BITS
URG (1 bit) – URGENT POINTER 필드가 유효
ACK (1 bit) – ACKNOWLEDGMENT필드를 유효
PSH (1 bit) – 세그먼트 PUSH를 요청
RST (1 bit) – 즉시 연결을 끊음(비정상적인 종료)
SYN (1 bit) – sequence numbers 동기화
FIN (1 bit) – 정상적인 종료
=print_Ip()삭제
=SYN / ACK출력
=윈도우 <-> 리눅스 => 계속 패킷 생성
==> 채팅PORT만 보이도록 수정

=
<PACKET.C>
#include <stdio.h> #include <netinet/in.h> #include <pcap/pcap.h> #include <net/ethernet.h> #include <arpa/inet.h> #include <netinet/ip.h> #include <netinet/tcp.h>
#define PORT 7777
int main(void) { char* cpNICName; char caErrMSG[PCAP_ERRBUF_SIZE]; int iCnt; unsigned char const * ucpData; pcap_t* stpDS; struct pcap_pkthdr stInfo; struct tcphdr * stTcp; struct ip * stpIp;
cpNICName = pcap_lookupdev(caErrMSG);
if(0 == cpNICName) { printf("ERRMSG : [%s]\n",caErrMSG); return 100; }
stpDS = pcap_open_live(cpNICName, ETH_DATA_LEN, 1, 0, caErrMSG);
printf("Packet Monitoring Start....\n"); getchar();
while(1) { ucpData = pcap_next(stpDS, &stInfo);
if(ETH_P_IP != ntohs(*(unsigned short*)(ucpData+12))) // 2byte 주소 { continue; }
if(IPPROTO_TCP != *(ucpData+23)) { continue; }
stpIp = (struct ip *) (ucpData + sizeof(struct ether_header)); stTcp = (struct tcphdr *)(ucpData + sizeof(struct ether_header) + ((*(ucpData+ sizeof(struct ether_header)) & 0x0F) * 4));
if(PORT != ntohs(stTcp -> source)) { if(PORT != ntohs(stTcp -> dest)) { continue; } } printf("=============================================\n"); printf("[%s:%d] ---> ", inet_ntoa(stpIp -> ip_src) , ntohs(stTcp -> source) );
printf("[%s:%d]\n", inet_ntoa(stpIp -> ip_dst) , ntohs(stTcp -> dest) );
printf("SYN[%d] ACK[%d] Seq[%010u] Ack[%010u]\n" , stTcp -> syn , stTcp -> ack , ntohl(stTcp -> seq) , ntohl(stTcp -> ack_seq) ); }
pcap_close(stpDS);
return 0; }
|
=CLIENT




=CLIENT


=SERVER


=SERVER


=3HANDSHAKE
CONNECT <=> ACCEPT
=SERVER(클라이언트 : 접속 -> quit)


=DDOS - 3HANDSHAKE 이용 ( 구글 / 은행 )
-좀비PC - 텔레그램