1

I am using Ubuntu 16.10 to run an experiment. I use Python scapy to send two packets to a machine connected over a switch. The first packet is a normal TCP SYN packet and is received by the nc app on the second machine and I can see the corresponding SYN/ACK packet. However, the second packet I send contains an IP option Loose Source Routing. This second packet is received on the other machine (I can see it in wireshark) but not handed to the application, therefore no SYN/ACK is sent. I am wondering why that is the case.

Here's the scapy code I am using:

Packet 1:

pkt1=IP(src="10.0.0.2", dst="10.0.0.3")/TCP(sport=random.randint(54100,54300),dport=23800)
send(pkt1)

Packet 2:

pkt2=IP(src="10.0.0.2", dst="10.0.0.3",options=IPOption('\x83\x03\x10'))/TCP(sport=random.randint(54100,54300),dport=23800)
send(pkt2)
Human
  • 125
  • 6

1 Answers1

1

Source routed packets may not be accepted by default. Check net.ipv4.conf.eth0.accept_source_route (change interface eth0 according to your setup) settings on your second machine. Even when you are able to see the packet with wireshark, it's probably being blocked by kernel.

You can change behavior to accept source routed packets using below command

# /sbin/sysctl -w net.ipv4.conf.all.accept_source_route=1

Please note that enabling this is a security risk

VenkatC
  • 2,150
  • 15
  • 12