We need a program to send out a packet for every possible IPv4 address to a specific destination address. Sounds simple enough, right. Crafted up a quick bash script, uses four for loops that increment each octet of the ip address. Then the address is passed to netwox, where it sends out a tcp packet for each address.
3 Days later – This is still running, what’s the deal? Few calculations:
Total IPv4 addresses 2^32 = 4,294,967,296
Transmission rate ~ 500 packets per second (seems fast)
Total Time for completion ~ 99 days
Wow, we don’t have that much time!
Should of started off in C, why am I so lazy all the time. So here it is a C program to send one packet for each IPv4 address. The program actually uses UDP packets, we did not want to clog the network with SYN/ACK packets. The point of the test was to test the logging capabilities of a hardware device. The device classifies received packets into separate categories based on IP address. We are using the libnet libraries, I am including a link to good article that tells how to use libnet, also it was compiled on Fedora Core 6, with newest libnet installed. I hard coded the mac addresses so that an ARP would not have to be performed (speeds up performance). This program was able to exhaust the IPv4 space in less than 3 days. Again the formatting of code is a little off after pasting into the blog, so review the code before using. What about IPv6 - good luck being able to do this in less than a year :)
#include "libnet.h" /* replace " with <> */
int main(void)
{
libnet_t *l;
libnet_ptag_t t1, t2, i1, i2, e1, e2;
char errbuff[LIBNET_ERRBUF_SIZE];
u_char src_eth[6] = {0x00, 0x0B, 0xDB, 0x1E, 0x55, 0x74}; // source mac change these
u_char dst_eth[6] = {0x00, 0x0B, 0xDB, 0x1E, 0x58, 0x0C}; //dest mac
u_long src_ip = 0, dst_ip = 0x02046E0A; //dst_ip network byte order format
u_short src_port = 23456, dst_port = 80, payload_s = 0;
char *payload = NULL;
int c;
l = libnet_init(
LIBNET_LINK,
NULL,
errbuff);
t1 = libnet_build_udp(
src_port,
dst_port,
LIBNET_UDP_H + payload_s, /*size*/
0, /*checksum */
payload,
payload_s,
l, /*libnet handle*/
0);
i1 = libnet_build_ipv4(
LIBNET_IPV4_H + LIBNET_UDP_H + payload_s,
0,
242,
0,
48,
IPPROTO_UDP,
0,
htonl(src_ip),
dst_ip,
NULL,
0,
l,
0);
e1=libnet_build_ethernet(
dst_eth,
src_eth,
ETHERTYPE_IP,
NULL,
0,
l,
0);
c = libnet_write(l);
while (src_ip < 0xffffffff)
{
src_ip++;
i2=i1;
i1 = libnet_build_ipv4(
LIBNET_IPV4_H + LIBNET_UDP_H + payload_s,
0,
242,
0,
48,
IPPROTO_UDP,
0,
htonl(src_ip),
dst_ip,
NULL,
0,
l,
i2);
c = libnet_write(l);
}
libnet_destroy(l);
printf ( "all done\n");
return(0);
}
Friday, November 30, 2007
One Packet For Each IPv4
Posted by
ecore
at
9:11 AM
Labels: computer security, networking
Subscribe to:
Post Comments (Atom)
0 comments:
Post a Comment