Spoofing a TCP Server handshake failing

Question

I am looking to build a simple server to proxy TCP connections at the gateway of my network (none malicious intent) but the TCP handshake is failing.

Using netfilter, I have managed to change the IP and port of incoming TCP packets so they are diverted to my application and also change them back to the original on the way back out as well as updating all checksums.

My server is currently sending back the SYN-ACK, which gets to the intended host but the ACK is never generated. According to wireshark the packet is well formed no problems with the checksum, the SYN and ACK values seem to match up.

Here is the TCP Dump output

Successful Handshake without my proxy

16:21:08.887938 IP 192.168.1.1.37513 > 192.168.2.56.12105: Flags [S], seq 4201716329,     win 14000, options [mss 1400,sackOK,TS val 727682 ecr 0,nop,wscale 2], length 0
16:21:08.889870 IP 192.168.2.56.12105 > 192.168.1.1.37513: Flags [S.], seq 34328406, ack 4201716330, win 14480, options [mss 1460,sackOK,TS val 1879286956 ecr 727682,nop,wscale 5], length 0
16:21:08.891751 IP 192.168.1.1.37513 > 192.168.2.56.12105: Flags [.], ack 1, win 3500, options [nop,nop,TS val 727683 ecr 1879286956], length 0

Failing handshake with my proxy

16:21:49.767611 IP 192.168.1.1.37514 > 192.168.2.56.12105: Flags [S], seq 2057472079, win 14000, options [mss 1400,sackOK,TS val 731770 ecr 0,nop,wscale 2], length 0
16:21:49.768522 IP 192.168.2.56.12105 > 192.168.1.1.37514: Flags [S.], seq 1201001621, ack 2057472080, win 14480, options [mss 1460,sackOK,TS val 7621570 ecr 731770,nop,wscale 4], length 0

After this the client and server just resend the ack/syn-ack.

Is there something obvious I am missing? Or does anyone have any advice on how I should start to debug the issue?

Are you sure the SYN-ACK packet is reaching the client, and not being filtered somehow? Can you run tcpdump on the client to verify that it's receiving the packet? — David Gelhar
Sorry I didn't specify, the dump provided is from the client. — DarkRyuu
Try to add dump from server side also. What the IPs of client, server, proxy? How packets are intercepted by proxy? — Nikolai
Can you provide the whole packets, as libpcap/wireshark dump? (With a little bit of luck, wireshark will even higlight you incorrect TCP sequence numbers, checksums and so on). — Emiswelt

user1130800 user1130800 · Accepted Answer · 2014-01-03T02:54:57

It depends how you changed the packets. You use iptables NAT to change the IP address and port number?

In your case, the client drops the packet because it believes that is not the correct packet, even though the ip, port, ACK are right.

Spoofing a TCP Server handshake failing

1 Answers