0

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ?

I was thinking about the tcp checksum, but is it reversible ?

The frame is just a TCP header encapsulated in a IP frame.

P.S:This is part of a "hack" challenge, this is why the situation is weird.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 21, 2020 at 18:15

2 Answers 2

Reset to default
2

You can't reconstruct missing packet elements from the checksum. It's for error detection, not correction.

If just one byte/word/longword is missing it could be reconstructed, e.g. by just trying all possible values and recalculating the checksum. However, educational purposes, hacking challenges and such are off-topic here.

Improve this answer
1

The TCP checksum is 16 bits and a port number is also 16 bits. So if just one port number is missing you have a reasonable chance of finding the port number by brute force but you may end up with more than one possible answer.

If both port numbers are missing then this isn't going to work.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.