0

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ?

I was thinking about the tcp checksum, but is it reversible ?

The frame is just a TCP header encapsulated in a IP frame.

P.S:This is part of a "hack" challenge, this is why the situation is weird.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 21, 2020 at 18:15

2 Answers 2

2

You can't reconstruct missing packet elements from the checksum. It's for error detection, not correction.

If just one byte/word/longword is missing it could be reconstructed, e.g. by just trying all possible values and recalculating the checksum. However, educational purposes, hacking challenges and such are off-topic here.

1

The TCP checksum is 16 bits and a port number is also 16 bits. So if just one port number is missing you have a reasonable chance of finding the port number by brute force but you may end up with more than one possible answer.

If both port numbers are missing then this isn't going to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.