Handle TCP protocol on your own

Is it possible to somehow dive deeper, and handle the initial TCP handshake(SYN/ACK) on your own? At the moment winsock is doing this for me.
Yes, if you open a raw socket you can send packets at layers 2 (Ethernet) and 3 (IP).

https://docs.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2

Thanks Helios, you've been golden as usual.

So when I use raw sockets will I see all messages going back and forth between the machines? Or is there still a lower protocol that handles messages before it reaches me (my raw socket)? Based on your reply there might be something happening at layer 1?
Last edited on
If you open at layer 2 you'll see all traffic on the network segment, some of which will be addressed to your NIC. You won't see the traffic being generated by other processes on your host.
If you open at layer 3 you'll see all traffic addressed to your NIC and you'll have to filter based on IP (like how you pass an address to bind()).
How can I skip all layers/protocols, and see what's really going on?
Last edited on
You can't go lower than Ethernet from software, since layer 1 is the physical protocol. You would need to build your own NIC and measure the electrical signals passing through the cable.
Okey. If I understood you correctly. When I've set up the raw socket, and sent a http request to my self from a client... I'll first have to handle the TCP/IP protocol, before I see the http request?
Yes, obviously. If you're at layer 3 you'll have to handle everything yourself: IP, TCP, and HTTP.
Great
If you want to watch the wire.

One of these (or the pre-assembled one if you can't solder).
https://www.amazon.co.uk/d/Computer-Accessories/Great-Scott-Gadgets-Throwing-Star/B01COWCXF6
Also at https://greatscottgadgets.com/throwingstar/

One of these (or two singles if you have plenty of spare USB ports).
https://www.amazon.co.uk/StarTech-com-Dual-Gigabit-Ethernet-Adapter-Black/dp/B00D8XTOD0

Three LAN patch cables.

Two patch cables to between the Tap ports and the USB dongle.
The third patch cable continues the connection from the Tap to the equipment under test.


Then use https://www.wireshark.org/ to watch the two ends of the tap and you'll see everything.
Topic archived. No new replies allowed.