Re: TCP-packet with PUSH flag with wrong payload data in LOCAL_OUT hook.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wednesday 2009-01-21 19:01, Кобылянский Владимир wrote:
>
>I see in my module 3 handshake packets - they all normal.
>Then I see first packet with payload - it is TCP-packet with PSH and ACK
>flags and it is not normal at all.

It could be something in your code (which seem to be absent here).

>In this packet in tcp-data area I MUST see such string:
>"GET / HTTP/1.1..."
>or in HEX
>"4745 5420 2f20 4854 5450 2f31 2e31 ..."
>BUT I see such data in it:
>"0200 0100 0100 0000 0100 0000 0000 ....".

Could be TCP options. Payload could be begin in a later packet maybe.
Or somewhere in your code you have a wrong pointer.
I don't read glass spheres so...
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux