3

I have the IP and port details of an already established connection between the TCP server and the client. As I am simulating packet injection attack using the packETH tool, I disguise my self as the client(using client's IP and port, but not same seq and ack numbers) and send FIN segment, then I expect connection close or some abnormal behavior, but it isn't happening. My question is, what might exactly be happening? and what happens if I send a repeated SYN segment.

  • 1
    Can I suggest you post some packet traces? – jonathanjo Apr 7 '18 at 11:35
  • 3
    The server will not accept the FIN segment (or any other) if it does not hold a sequence number inside the server current window. – JeanPierre Apr 7 '18 at 16:23
  • "between the TCP server and the client." TCP does not have servers or clients. The client/server concept is an application-layer (off-topic) concept. TCP creates connections between peers. – Ron Maupin Apr 8 '18 at 0:14
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:12
3

I'd try it with the RST bit set. Your SEQ/ACK shouldn't matter in that case. If that doesn't work it is probably because you messed up your checksum and the packet is getting dropped.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.