Responding to Packets

It's sometimes useful to generate a response in addition to accepting or dropping a packet
If a connection request is dropped, the originator is likely to try again
If in addition to dropping the request an error response is generated, the originator is likely to back off

Generating a TCP RST:

    use Net::RawSock; # http://www.hsc.fr/ressources/outils/rawsock/
    ...

    my $tcp = NetPacket::TCP->decode($ip->{data});

    ($ip->{src_ip}, $ip->{dest_ip}) =
        ($ip->{dest_ip}, $ip->{src_ip});

    ($tcp->{src_port}, $tcp->{dest_port}) =
        ($tcp->{dest_port}, $tcp->{src_port});

    $tcp->{flags} = RST;
    $tcp->{winsize} = 0;
    $tcp->{seqnum} = 0;
    $tcp->{acknum} = 0;
    $tcp->{data} = "";

    $ip->{data} = $tcp->encode($ip);
    Net::RawSock::write_ip($ip->encode);

    $ipq->set_verdict($msg->packet_id, NF_DROP);

Next	© 2003 Michael C. Toren