ICMP Ping Flood Icmp ping flood is a kind of DOS attack that can be performed on remote machines connected via a network. It involves sending a large number of ping echo requests (packets) to the target system such that it is not able to tackle so fast. So the result is that the host… Read More »
Raw UDP sockets Raw udp sockets are used to constructed udp packets with a application defined custom header. It is useful in security related network applications. The udp header can be found in RFC 768 and has a very simple structure as shown below. 0 7 8 15 16 23 24 31 +——–+——–+——–+——–+ | Source… Read More »
Wrapper class for socket functions The standard socket library in C comes with a lot of functions for every task like connecting, sending data and receiving data etc. However knowing the syntax of all the functions and calling them again and again and in the right sequence could be a bit intimidating. Using a class… Read More »
Socket function – recv() If you are writing a network application using sockets in C that communicates with a remote server and fetches data, then you must be aware of the recv function that is used to receive data. The recv function can only receive a specified number of bytes in the response. If the… Read More »
UDP sockets This article describes how to write a simple echo server and client using udp sockets in C on Linux/Unix platform. UDP sockets or Datagram sockets are different from the TCP sockets in a number of ways. The most important difference is that UDP sockets are not connection oriented. More technically speaking, a UDP… Read More »
In a previous example we learnt about the . In this example we shall build a basic ECHO client and server. The server/client shown here use TCP sockets or SOCK_STREAM. Tcp sockets are connection oriented, means that they have a concept of independent connection on a certain port which one application can use at a… Read More »
MAC Address The mac address (media access control address) or the hardware address or the ethernet address of an interface is a 48 bit number that looks like this : 00:1c:c0:f8:79:ee. Every machine connected to a network has a unique mac address that is used to deliver network packets to the correct machine. The mac… Read More »
Theory The whois information of an ip address provides various details like its network, range, isp etc. This information is maintained by various regional registry servers. Read the wikipedia article on regional internet registries for more information. There are a total of 5 regional registries spanning various geographical regions of the world. For example if… Read More »
Handle multiple socket connections When writing server programs using sockets , it becomes necessary to handle multiple connections at a time , since a server needs to serve multiple clients. There are many ways to do so. On linux this can be done in various ways like forking , threading , select method etc. In… Read More »
Learn socket programming in C on the linux platform. Write socket servers and client programs in C.
Whois A whois client is a program that will simply fetch the whois information for a domain/ip address from the whois servers. The code over here works according to the algorithm discussed here. A whois server runs a whois service on port 43 (whois port). We need to connect to this port with sockets and… Read More »
Local Ip address The local ip is the source ip in IP packets send out from a system. When the system is a part of a local area network then the local ip in most cases is something like 192.168.*.* . The network interface (eth0) is assigned an ip address of that range. However when… Read More »
Winpcap Winpcap is a packet capture library for Windows used for packet sniffing and sending raw packets. Wireshark is a popular sniffer tool that uses winpcap to sniff packets. Here is a sample code which shows how winpcap can be used to sniff incoming packets on a particular interface. Code /* Simple Sniffer with winpcap… Read More »
Socket applications often need to convert hostnames like google.com to their corresponding ip address. This is done through dns requests. The socket api in linux provides functions like gethostbyname and getaddrinfo that can be used to perform the dns requests and get the ip address. 1. gethostbyname The first method uses the traditional gethostbyname function… Read More »
In the previous part we made a simple sniffer which created a raw socket and started receiving on it. But it had few drawbacks : 1. Could sniff only incoming data. 2. Could sniff only TCP or UDP or ICMP or any one protocol packets at a time. 3. Ethernet headers were not available. In… Read More »
DNS Query Code in C A dns query lets you to lookup the various dns records for a given hostname or domain name on the internet. The simplest use case is to lookup the ip address of a domain name. When you open a url in your browser, it first performs a dns query to… Read More »
Raw tcp sockets in C Raw sockets can be used to construct a packet manually inside an application. In normal sockets when any data is send over the network, the kernel of the operating system adds some headers to it like IP header and TCP header. So an application only needs to take care of… Read More »
TCP/IP 3-way handshake is done to establish a connection between a client and a server. The process is : 1. Client –SYN Packet–> Server 2. Server –SYN/ACK Packet –> Client 3. Client –ACK Packet –> Server The above 3 steps are followed to establish a connection between source and destination. SYN Flood DOS attacks involves… Read More »
Port scanning A port scanner is a program that checks for open network ports on a local or remote machine. For example, if a machine is running an http webserver then it has port 80 open. So by scanning for open ports on a machine, we can find what server applications are running on it…. Read More »
Libpcap Libpcap is a packet capture library for linux which can be used to sniff packets or network traffic over a network interface. Pcap Documentation gives a description of the methods and data structures available in the libpcap library. To install libpcap on your linux distro you can either download the source from the website… Read More »