MAC Address The mac address (media access control address) or the hardware address or the ethernet address of an interface is a 48 bit number that looks like this : 00:1c:c0:f8:79:ee. Every machine connected to a network has a unique mac address that is used to deliver network packets to the correct machine. The mac… Read More »
On a Linux system, all network interfaces have a unique name that is shows up when you run the ifconfig command for example. The main network adapter often has the name eth0 or enp1s0 on linux systems. The ip address is configured using desktop gui tools, or through commands like ifconfig. If you are writing… Read More »
The function gettimeofday can be used to retrieve the total number of seconds and balance microseconds elapsed since EPOCH. Structure timeval looks like this : struct timeval { time_t tv_sec; /* seconds */ suseconds_t tv_usec; /* microseconds */ }; On Linux it can be done like this : /** * Get time difference in microseconds… Read More »
On Linux the header file sys/types.h provides the fixed sized integer data types like these : u_int8_t; u_int16_t; u_int32_t; On windows the header file stdint.h provides similar ones but with slightly different names , uint8_t etc. So if you are writing cross platform code you can get the same ones on windows as in a… Read More »
Theory The whois information of an ip address provides various details like its network, range, isp etc. This information is maintained by various regional registry servers. Read the wikipedia article on regional internet registries for more information. There are a total of 5 regional registries spanning various geographical regions of the world. For example if… Read More »
Handle multiple socket connections When writing server programs using sockets , it becomes necessary to handle multiple connections at a time , since a server needs to serve multiple clients. There are many ways to do so. On linux this can be done in various ways like forking , threading , select method etc. In… Read More »
Whois A whois client is a program that will simply fetch the whois information for a domain/ip address from the whois servers. The code over here works according to the algorithm discussed here. A whois server runs a whois service on port 43 (whois port). We need to connect to this port with sockets and… Read More »
Php has a useful function called str_replace which can search and replace a certain string in another big string. However there is no such function in C. So I wrote up one for myself. Here is the code. /* * Search and replace a string with another string , in a string * */ char… Read More »
Local Ip address The local ip is the source ip in IP packets send out from a system. When the system is a part of a local area network then the local ip in most cases is something like 192.168.*.* . The network interface (eth0) is assigned an ip address of that range. However when… Read More »
Winpcap Winpcap is a packet capture library for Windows used for packet sniffing and sending raw packets. Wireshark is a popular sniffer tool that uses winpcap to sniff packets. Here is a sample code which shows how winpcap can be used to sniff incoming packets on a particular interface. Code /* Simple Sniffer with winpcap… Read More »
MAC Address Mac address (Media Access Control Address) or hardware address is a 48 bit (6 character) wide address assigned to a network interface. It is important for the packet delivery between 2 devices like your computer and the router. Ethernet protocol uses the mac address to deliver it to the right network node. It… Read More »
In the previous part we made a simple sniffer which created a raw socket and started receiving on it. But it had few drawbacks : 1. Could sniff only incoming data. 2. Could sniff only TCP or UDP or ICMP or any one protocol packets at a time. 3. Ethernet headers were not available. In… Read More »
DNS Query Code in C A dns query lets you to lookup the various dns records for a given hostname or domain name on the internet. The simplest use case is to lookup the ip address of a domain name. When you open a url in your browser, it first performs a dns query to… Read More »
Raw tcp sockets in C Raw sockets can be used to construct a packet manually inside an application. In normal sockets when any data is send over the network, the kernel of the operating system adds some headers to it like IP header and TCP header. So an application only needs to take care of… Read More »
TCP/IP 3-way handshake is done to establish a connection between a client and a server. The process is : 1. Client –SYN Packet–> Server 2. Server –SYN/ACK Packet –> Client 3. Client –ACK Packet –> Server The above 3 steps are followed to establish a connection between source and destination. SYN Flood DOS attacks involves… Read More »
Tcp connect port scanning TCP connect() scanning is the most basic form of TCP scanning. The program performs a connect() command on those ports of the target machine which are to be checked. If the port is open then the connect() command will succeed and a connection will be established. If the port is closed… Read More »
Port scanning A port scanner is a program that checks for open network ports on a local or remote machine. For example, if a machine is running an http webserver then it has port 80 open. So by scanning for open ports on a machine, we can find what server applications are running on it…. Read More »
Raw sockets with winpcap A previous post explains how to send on windows xp. However the winsock api has limited raw socket support in windows versions greater than windows xp+sp1. Therefore winpcap has to be used to send raw packets on higher windows versions. Winpcap is a packet driver useful for packet capturing and sending… Read More »
DNS Query When we type a web url or domain in our browser a dns request is immediately send by our browser to a DNS server to get the IP address of that web address. In winsock applications we achieve this by gethostbyname() and things are pretty simple. In this article we shall do this… Read More »
Winsock packet sniffer A packet sniffer is a program that can sniff the packets moving on the network. All applications communicate over the network with data packets where each packet contains part of the whole data being exchanged. A sniffer is able to pickup these individual packets and read them. In this post we are… Read More »