Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Incidents
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Tracking down random ICMP

from [Valdis . Kletnieks] Network Security [Permanent Link]
Subject: Re: Tracking down random ICMP
Date: Thu, 25 Jan 2007 12:20:02 -0500 
On Thu, 25 Jan 2007 13:13:20 +0100, 
=?ISO-8859-1?Q?Javier_Fern=E1ndez-Sanguino?= said:

Valdis.Kletnieks@vt.edu dijo:

On Mon, 22 Jan 2007 09:19:31 -0400, Craig Chamberlain said:

Is there a tool that can determine which process ID is generating ICMP
packets or IRPs in Windows? TDImon seems to be TCP/UDP only. TCPview and
netstat apparently can't do it.


I'm not aware of any well-known userspace API that generates ICMP, so
any userspace would have to be hand-crafting the packets itself.  So what
you're looking for is a process that has a raw socket open.


Maybe you don't know about libdnet? [1] There are quite a number of 
tools that use it.


Note that libdnet is basically just a set of wrapper functions that help
the programmer craft a raw packet with the right bits, as opposed to an
actual documented system/kernel API akin to the socket/bind/connect/send/rcvmsg
calls in the Unix-y networking API.

Of course, Jose Nazario proved me wrong and found that Microsoft did actually
provide an API for this.  Apparently the concept of userspace-generated ICMP
as a layering violation doesn't bother the Microsoft design team much. :)

Attachment: pgpGnsYJh7qTZ.pgp
Description: PGP signature

[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Full-disclosure] [NETRAGARD-20061218 SECURITY ADVISORY] [@Mail WebMail Cross Site Request Forgery], Netragard Security Advisories
Next by Date:  [Full-disclosure] 2007 Security OPUS CFP: Closed (Agenda included), Sharkey
Previous by Thread:  Re: Tracking down random ICMP, Javier Fernández-Sanguino
Next by Thread:  Attempted FTP intrusion, David Gillett
Indexes:  [Date] [Thread] [Top] [All Lists]