1

I want to design a system which reduce travel time of packet what is happening in reality is I send a SYN bit from client side, this bit travel through router then to server and server reply SYN+ACK which also travel through the router to client.

So I just want something else like what if the client send SYN to router, router then send this to server and copy this packet modify SYN to SYN+ACK and send back to client before server can send after server send this SYN+ACK to router, router just accept it(see it as the reply is coming) and discard it

To achieve the above goal, I design a setup in which I have one laptop which send and receive packet from two ethernet interface and other one is desktop which act as router(packets are coming and it only forward it to its destination) I setup the routing table from both side and enable the ip forwarding on desktop(which act as router).

All are working fine, on a laptop I have server and client program which send the packet and receive it but the problem is that I want to send the packets to from where it was coming (to source itself) so I modify the packet on routing side using netfilter module, copy the entire skb(using skb_copy) and interchange its ip source and destination(I did this on NF_INET_PREROUTING) and also interchange the port number but the packet always goes to destination.

What other modification I need to be done to send the packet to its source itself?

closed as unclear what you're asking by dirkt, Rui F Ribeiro, schily, Bananguin, Jesse_b Aug 6 '18 at 12:30

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Please edit your question and clarify what you actually want to achieve. You can't send a TCP packet you just received back to the same source where it came from, it will just get rejected. If your problem is that TCP replies don't get correctly routed, likely your router setup is wrong, so we need to see your (complete) router setup. Are you doing NAT on the router? Firewalls? Does ping to the source work from the laptop/router? – dirkt Aug 6 '18 at 5:44
  • Yes I did NAT on router, firewall also enable and I can ping from source to destination and vise versa. MY packet travell from source to destination and destination to source all are working fine but I just want to send a packet which is coming from client to client itself. As you say @dirkt "you can't send a TCP packet you just received back to the same source where it came from, it will just get rejected" Is it really true please let me know if you have any idea. I disable rp_filter on router so my packet couldn't be rejected. – ASid13 Aug 6 '18 at 6:01
  • 1
    Yes, it is true, a packet just sent back won't make sense to the sender. Why would you even try something like that, what do you want to achieve? – RalfFriedl Aug 6 '18 at 6:18
0

TCP uses different sequence counters on both ends of the connection. So if you just send a complete packet back, it will have the wrong sequence number, and get rejected on the other end because the other end thinks it is a duplicate packet that got delayed etc.

However, you can send the contents of a packet back, if this is what you want. A simple way to do that is with socat. Test the following in two terminal windows. In one, do

socat TCP-LISTEN:9990 SYSTEM:"cat"

This will listen for incoming connections, and when a connection is established, pipe incoming data to cat, which will output the same data, which then gets output through the TCP connection.

In the other, do

socat - TCP:localhost:9990

This will connect to the first socat at port 9990, send stdin to it, and write the responsed to stdout. Type a few lines (stdin only sends lines on CR) and watch them coming back.

So you can use this to test your setup, if this was the idea. You can also also use something similar to send everything back to the server:

socat TCP:server.com:1234 SYSTEM:"cat"

But that requires the server to actually send something when connecting.

If that doesn't solve your problem, please edit your question and explain why you want to send back "packets", and what problem do you want to solve by sending back "packets". (Test your setup? Test the server? Something else?).

This looks very much like an XY Problem.

  • Now I give you the complete explanation. I want to design a system which reduce travel time of packet what is happening in reality is I send a SYN bit from client side, this bit travel through router then to server and server reply SYN+ACK which also travel through the router to client, so I just want something else like what if the client send SYN to router, router then send this to server and copy this packet modify SYN to SYN+ACK and send back to client before server can send after server send this SYN+ACK to router, router just accept it(see it as the reply is coming) and discard it. – ASid13 Aug 6 '18 at 6:58
  • What you want is called a "synproxy" (google). It has nothing to do with "sending packets back", it's just about the initial SYN/ACK processing. And no, you can't do that with firewall rules. – dirkt Aug 6 '18 at 7:48
0

As the question has completely changed, another answer:

Sending SYN+ACK back to the client before the server actually receives the SYN is what a synproxy does. Google for existing implementations.

This has nothing to do with "sending packets back", it's just about the initial SYN/ACK processing.

And no, it's not possible to do this with firewall rules, because it has to keep state (or at least some amount of state).

  • is that a syn proxy? – ctrl-alt-delor Aug 6 '18 at 9:32
  • @dirkt can you please explain a little bit the last line "it has to keep state (or at least some amount of state)." – ASid13 Aug 6 '18 at 10:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.