SUMMARY: Kill TCP/IP Connections

From: <Jonas.Furrer_at_BIT.admin.ch>
Date: Mon, 13 Jan 2003 14:09:21 +0100

Hi,

I received answers from:

Arrigo Triluzi arrigo( _at_ )albourne.com
Nikolai BldrxJ( _at_ )netscape.net

Thanks a lot Arrigo and Nikolai, but I couldn't compile libnet, libnids and
dsniff. I'm not experienced enough in this field.

Regards, .. Jonas

----------------------------------------------------------------------------

----
Original question:
--------------------------
I searching for a possibility to kill TCP/IP connection. So that
IP-connections can be kill form a defined client on a specified service port
without killing the server process.
I saw that dsniff (http://naughty.monkey.org/~dugsong/dsniff/) includes a
command named tcpkill. But I can't compile dsniff on a Tru64 V5.1 system.
The story:
- Installing libpcap form Tru64 OpenSource CD	-> ok
- Installing gcc from Tru64 OpenSource CD	-> ok
- Downloading libnet / libnids from http://www.packetfactory.net -> ok
- Compiling libnet without success:	-> nok
gcc -DHAVE_CONFIG_H -I. -I. -I../include     -g -O2 -Wall -c
libnet_link_pf.c
libnet_link_pf.c:36: ../include/low_libnet.h: No such file or directory
*** Exit 1
Stop.
*** Exit 1
Stop.
- Compiling libnids without success -> nok
gcc -c -g -O2 -D_BSD_SOURCE  -Wall -DHAVE_ICMPHDR=0 -DHAVE_TCP_STATES=0
-DHAVE_BSD_UDPHDR=1 -I. -I/usr/local/include  ip_fragment.c
ip_fragment.c: In function `ip_create':
ip_fragment.c:408: structure has no member named `ip_hl'
ip_fragment.c:397: warning: `ihlen' might be used uninitialized in this
function
ip_fragment.c: In function `ip_glue':
ip_fragment.c:522: structure has no member named `ip_hl'
ip_fragment.c: In function `ip_defrag':
ip_fragment.c:565: structure has no member named `ip_hl'
ip_fragment.c:538: warning: `ihl' might be used uninitialized in this
function
*** Exit 1
Stop.
*** Exit 1
Stop.
- No chance to compile dnsniff :-(
Is there anybody out there who knows what I can do now.
Maybe there is another tool for my purpose.
Any help is welcome.
Thanks .. Jonas
----------------------------------------------------------------------------
----
Answer from arrigo_at_albourne.com:
First mail:
There is a chance... what you are looking at is BSD-style (OpenBSD to
be precise) naming conventions for the IP header structures.  ip_hl
under SysV is called something different.
Go and have a look at /usr/include/netinet and friends (in particular
ip.h) and translate the fields into SysV names.  Then it will all
work.
Second mail:
The directory is /usr/include/netinet and the file is ip.h.  In it you
will find the following:
  struct ip {
  #if     defined(_KERNEL) || defined(_NO_BITFIELDS) || (__STDC__ == 1)
          u_char  ip_vhl;                 /* version and header length */
  #else
  #if BYTE_ORDER == LITTLE_ENDIAN 
          u_char  ip_hl:4,                /* header length */
                  ip_v:4;                 /* version */
  #endif
  #if BYTE_ORDER == BIG_ENDIAN 
          u_char  ip_v:4,                 /* version */
                  ip_hl:4;                /* header length */
  #endif
  #endif
etc.  These are the definitions that you should be using.  For some
reason libnet is not finding them so you need to find out which
include files are being used by libnet. 
You should be able to hack it to work, since Tru64 is not too bad
w.r.t. TCP/IP programming.
----------------------------------------------------------------------------
----
Answer from BldrxJ_at_netscape.net
You might need to use GNU make as well as GNU automake and GNU autoconfig
for this. Leave the system make in place if you do, and just tell the
compiler to use GNU make.
hope this helps,

Received on Mon Jan 13 2003 - 13:10:07 NZDT