关于 Windows XP SP2 对 raw socket 的影响

最新推荐文章于 2024-07-06 17:14:01 发布

转载最新推荐文章于 2024-07-06 17:14:01 发布 · 1.6k 阅读

文章标签：

#socket #windows #xp #sockets #security #interface

vcbcbdelphi的window编程专栏收录该内容

551 篇文章

订阅专栏

WinXP SP2 对RawSocket进行了限制，包括禁止通过RawSocket发送TCP数据及源地址不合法的UDP数据包。这些改变有助于防止分布式拒绝服务攻击及伪造源IP地址的数据包。尽管如此，SP2的防火墙仍然允许使用pcap进行数据包发送。

winxp sp2 不支持 raw socket 的事情，在这个地方
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx#XSLTsection127121120120

找到了这样一段
Restricted traffic over raw sockets
Detailed description

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

• TCP data cannot be sent over raw sockets.

• UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

Why is this change important? What threats does it help mitigate?

This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.

大致意思是没法再通过raw socket发送tcp数据了，没法再通过raw socket发送源地址不合法的udp报文了

想到一点;sp2的防火墙的层次还是比较高的，所以用pcap 发包应该是可以的了.