From: Phillip Whelan <pwhelan@exis.cl>
To: netfilter-devel@lists.netfilter.org
Subject: Faking ethernet source MAC in NF_IP_POST_ROUTING
Date: Wed, 23 Jun 2004 16:15:03 +0000 [thread overview]
Message-ID: <20040623161503.188c007f@mindrape> (raw)
Hello,
Quote: (myself)
"I've been working lately on a netfilter hook extension which Rewrites outgoing ARP packets to spoof a host's MAC address."
I already managed to solve a problem involving ARP replies automagically updating arp caches by modifying the arp payload's sender hw_addr.
(or perhaps, the tha... whatever, it works).
The kernel is now spoofing itself, etc... but, it still sends out packets with the real MAC address. This, of course confuses the end host to no ends.
In NF_IP_POST_ROUTING, the skb->mac is not NULL, but skb->mac_len is 0.
Directly modifying the skb->mac would just lead to memory corruption.
How would I modify the source MAC address? (Im inside NF_IP_POST_ROUTING). Can I access through a negative offset from skb->data? (net/ipv4/arp.c does this, I think).
--
Phillip Whelan
Lead Programmer
Exis - Extreme Information Solutions/Security
http://www.exis.cl
next reply other threads:[~2004-06-23 16:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-06-23 16:15 Phillip Whelan [this message]
2004-06-24 8:07 ` Faking ethernet source MAC in NF_IP_POST_ROUTING Henrik Nordstrom
2004-06-28 9:31 ` Mario
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040623161503.188c007f@mindrape \
--to=pwhelan@exis.cl \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.