Re: Scaled TCP window with Net::RawIP

You do understand that the wscale option is only valid on SYN, SYN/ACK packets, right? The tcpdump line you listed did not appear to have the SYN flag set. Also, I have not used Net::RawIP, but the documentation is not very clear to me on optset. For example, It says that the data has to be a string (which perl ought to convert for you, but who knows). Since it gives no examples of usage of this method, you may have to use a little trial-and-error to get it right. If you look here, there is an example involving optset that implies that it really wants a string containing the binary representation of the option value (ala pack())

fnord

Update: added reference to optset example.

Comment on Re: Scaled TCP window with Net::RawIP

Replies are listed 'Best First'.
Re^2: Scaled TCP window with Net::RawIP by Martynas (Initiate) on Mar 02, 2011 at 20:42 UTC
That is the point. I receive scaling factor in previous SYN/ACK. Now how I shall form packet flow after that to use scaled window with window size and scaling factor? Martynas	[reply]
Re^3: Scaled TCP window with Net::RawIP by Illuminatus (Curate) on Mar 02, 2011 at 21:15 UTC
Maybe you should read the rfc that defines window scaling (section 2). As long as both the SYN and SYN/ACK contain wscale opts, both sides will do scaling based on the values they sent/received. The option is never resent, but its shift-value is implied in the window value in the tcp header of each packet. The session info in the stack keeps track of the scale. This is a different question from "how can I get optset to work?" I guess I am a little confused about what you are trying to do. Are you really trying to manage a complete TCP session via RawIP? Unless the session is extremely trivial, this is not recommended. fnord	[reply]
Re^4: Scaled TCP window with Net::RawIP by Martynas (Initiate) on Mar 02, 2011 at 21:46 UTC
My intension is to use Net::RawIP to assemble single ACK packet that would have window size scaled (greater than 65535). I am not trying to simulate whole flow, just taking some values from normal S-S/A-A flow. When I analyze normal flow I see in Wireshark that "Windows size: 262144 (scaled)" and trying to assemble same packet with Net::RawIP. In previous S/A packet I see "Window size: 65535" and also "Window scale: 3 (multiply by 8)".So that is ok - S packet has scaling factor set up clearly. Windows scale is not present in A packet, but still Windows size is presented as scaled. Question is how I can use this factor in assembling next single A packet so that window size would be scaled? Thanks, Martynas	[reply]
Re^5: Scaled TCP window with Net::RawIP by Illuminatus (Curate) on Mar 03, 2011 at 00:37 UTC
Re^6: Scaled TCP window with Net::RawIP by Martynas (Initiate) on Mar 03, 2011 at 07:20 UTC
Some notes below your chosen depth have not been shown here


XP is just a number
	PerlMonks