Re: Tracking down random ICMP

On Tue, 23 Jan 2007, Valdis.Kletnieks@vt.edu wrote:

> I'm not aware of any well-known userspace API that generates ICMP, so 
> any userspace would have to be hand-crafting the packets itself.  So 
> what you're looking for is a process that has a raw socket open.

at least on Win32:

        http://msdn2.microsoft.com/en-us/library/aa366045.aspx

and then something along these lines:

HANDLE hIcmpFile;
char[] SendData = "Data Buffer";
LPVOID ReplyBuffer;

if ((hIcmpFile = IcmpCreateFile()) == INVALID_HANDLE_VALUE)
  printf("\tUnable to open file.\n");
else
  printf("\tFile created.\n");

// Declare and initialize variables
ReplyBuffer = (VOID*) malloc(sizeof(ICMP_ECHO_REPLY) + sizeof(SendData));
if ((dwRetVal = IcmpSendEcho(hIcmpFile,
  inet_addr("1.2.3.4"),               // jose@ fix to use a valid IP
  SendData, sizeof(SendData),
  NULL, ReplyBuffer,
  sizeof(SendData) + sizeof(ICMP_ECHO_REPLY),
  1000)) != 0) {
  PICMP_ECHO_REPLY pEchoReply = (PICMP_ECHO_REPLY)ReplyBuffer;
  printf("\tReceived %ld messages.\n", dwRetVal);
  printf("\tMessage: %s\n", pEchoReply->Data);
}
else {
  printf("\tCall to IcmpSendEcho() failed.\n");
  printf("\tError: %ld\n", GetLastError());
}

// END OF EXAPLE

anything that can trace API calls (ie debuggers and such) should be able 
to help you track down the process.

________
jose nazario, ph.d.                 jose@monkey.org
http://monkey.org/~jose/            http://monkey.org/~jose/secnews.html
                                    http://www.wormblog.com/