Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there an easy way (or is it possible at all) to rewrite a TCP packet as it leaves the machine?
For example if I run

telnet binfalse.de 22

it will search for an unused port to leave the machine. In this case it's 46576:

root@srv % lsof -i -P -n | grep telnet
telnet    10150   user    3u  IPv4 1159425      0t0  TCP 1.2.3.4:46576->87.118.88.39:22 (ESTABLISHED)

But now I want to rewrite these packets to let the server think the requests came from port 1337, or somewhat like this. Of course I know that I don't have to expect an answer in my telnet session.

EDIT:
Of course on 1337 another program is listening, so telling telnet to speak through 1337 is no option...

share|improve this question
4  
you should use the word packet instead of package –  Mike Pennington Jun 29 '11 at 16:37
    
thanks a lot for the hint, never thought about it ;-) –  binfalse Jun 29 '11 at 17:47
4  
If you want to send IP packets that aren't UDP or a well-formed TCP connection, you need to be root (or have the appropriate capability). Then you could send IP packets that happen to be TCP packets with a bogus source port. But that wouldn't work well, because you'd have to reimplement (a large chunk of) the TCP stack, and you wouldn't go far without being able to receive the ACKs from the other party, which would go to the listening program. Thus you need to re-route the packets to a different port as they come in, with iptables. –  Gilles Jun 29 '11 at 22:21
    
Ok, really don't want to establish a connection, I'd be happy if one single packet leaves my machine, and all nodes that have a look into the packet think that it came from :1337... I don't care for any answer... –  binfalse Jun 30 '11 at 9:09
1  
if that is the case, you should be using a packet-generator like scapy –  Mike Pennington Jun 30 '11 at 15:23

2 Answers 2

up vote 6 down vote accepted

Assuming you are speaking about Linux, iptables has a mangle table that can do all sorts of crazy things to outgoing TCP traffic. iptables NAT features might help as well, because it really sounds like you want to do "port address translation" or "manual NAT."

share|improve this answer

If you're really using the telnet protocol (or raw tcp streams), you can use nc -p <source_port>... -t negotiates telnet options. I have a terminal server below that accepts telnet connections on tcp/2015 and I will source from tcp/31415

# Window 1
[mpenning@hotcoffee ~]$ nc -p 31415 -t 192.168.12.117 2015
????????????????

8024-1(config-if-Po2)#

To verify...

[mpenning@hotcoffee tshark_wd]$ netstat -an | grep 31415
tcp        0      0 192.168.12.236:31415    192.168.12.117:2015     ESTABLISHED
[mpenning@hotcoffee tshark_wd]$

This assumes you do not already have a local socket listening on tcp/31415... if you already have a local tcp socket bound on the desired port, iptables is your only option.

share|improve this answer
    
Unfortunately there is another program listening on this port. so nc -p is no option. But nevertheless it can't be bad to list it here, thx ;-) –  binfalse Jun 29 '11 at 17:47
    
@binfalse, help me understand... do you want an established TCP connection, or just to fake some packets from a certain source port (even if another program is listening on that same port)? –  Mike Pennington Jun 29 '11 at 17:58
    
I have a tool listening at port X. I want to send some packets (e.g. with telnet or netcat or whatever) from the same machine to a server, but want that server to answer to port X. But since there is already something bound to port X your command nc -p X [...] doesn't work. –  binfalse Jun 29 '11 at 19:49
    
I understand why nc won't work... I'm trying to figure out why aren't you just using a packet generator like scapy –  Mike Pennington Jun 29 '11 at 20:03
    
Hey thanks a lot, scapy works just fine. Never heard of something like that! –  binfalse Jul 5 '11 at 14:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.