Linux ping source code

Пишем ping на Си

Видите это довольное лицо? Это Майк Муусс — автор, наверное самой часто используемой утилиты ping (недаром он на фотке так радуется).

Некоторое время назад мне самому довелось написать ping, но в виде отдельной функции.

И на мой взгляд, для си-программистов, которые только начинают работать с сетью, это очень полезная утилита для самостоятельной разработки. Почему? Потому, что для разработки этой утилиты нужно научится делать, казалось бы, самые примитивные действия — отправлять и принимать пакет.

Давайте сначала вкратце определим требования конкретно для нашей функции ping. Функция нужна нам для проверки целостности и качества соединения между хостами. И для этого нам достаточно отправить ICMP-эхопакет с запросом целевому хосту и получить от нее ответ. Для оценки качества соединения будем использовать время между запросом и получением ответа.

Системные вызовы

Операционная система (в нашем случае Linux) позволяет получать доступ к сетевым устройствам посредством системных вызовов. Для ping мне потребовались следующие вызовы:

• socket — используется для создания сокета
• select — в нашем случае используется для проверки состояния сокета
• sendto — для отправки данных
• recvfrom — для получения данных
• inet_aton — для преобразования ip-aдреса в строковом виде в структуру sockaddr_in
• и другие

Реализация

Функция для получения текущего времени

Для начала напишем вспомогательную функцию для получения текущего времени в миллисекундах.

Данные

Далее нужно определится с тем, какие данные будем отправлять. Объявим структуру, который будет иметь icmp заголовок и поле данных. Эта структура будет служить нашим пакетом.

Напишем функцию для заполнения нашей структуры.

Функция ping

Сигнатура нашей основной функции будет следующим.

На входе мы получаем ip-адрес пингуемого хоста и таймаут ожидания. На выходе результат выполнения и третий аргумент time куда запишем время пинга хоста.

Тут же, с помощью inet_aton , преобразуем ip в строковом виде в структуру sockaddr_in .

Сокет

Далее нам нужно создать сокет путем вызова соответствующей функции.

Директива SOCK_RAW говорит о том, что мы отправляем “сырой” пакет без использования транспортного уровня (UDP/TCP). С помощью директивы IPPROTO_ICMP говорим, что мы будем использовать протокол ICMP. Функция socket() возвращает нам файловый дескриптор, который будем использовать в последующем.

Отправляем пакет

Перед тем как отправить пакет фиксируем время.

И отправляем пакет.

Получаем ответ

Для получения ответа нужно считать принятые данные из сокета. Данные будут записаны в структуру ip_pkt .

Таймауты

Далее на мой взгляд идет самая сложная часть. Делать вызов recvfrom , то есть принимать данные из сети, нам нужно только при наличии данных. Для этого нам поможет системный вызов select , который используется для отслеживания состояния сокета. А именно:

• Я взвожу select на требуемый таймаут, после чего происходит блокировка на этой функции до момента пока не появятся данные или не истечет время
• Если select разблокировался по таймауту, значит время истекло и мы выходим из цикла
• Если select разблокировался из-за появления данных, то вызываем recvfrom и записываем данные в структуру ip_pkt
• Если данные адресованы не нам, взводим select заново, ведь у нас еще осталось время

Запуск

Компилируем, запускаем ping и видим, что все работает.

Стоп! Но почему для запуска требуется sudo? А потому, что мы используем сырые пакеты. Помните директиву SOCK_RAW ?

Тогда почему стандартная утилита ping не требует sudo? Ничего страшного. Пара нехитрых действий и наш ping тоже запускается без sudo.

Если есть вопросы или замечания — пишите! Я обязательно постараюсь ответить. Спасибо!

Источник

ping(8) — Linux man page

Synopsis

Description

ping uses the ICMP protocol’s mandatory ECHO_REQUEST datagram to elicit an ICMP ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams (»pings») have an IP and ICMP header, followed by a struct timeval and then an arbitrary number of »pad» bytes used to fill out the packet.

Options

When using ping for fault isolation, it should first be run on the local host, to verify that the local network interface is up and running. Then, hosts and gateways further and further away should be »pinged». Round-trip times and packet loss statistics are computed. If duplicate packets are received, they are not included in the packet loss calculation, although the round trip time of these packets is used in calculating the minimum/average/maximum round-trip time numbers. When the specified number of packets have been sent (and received) or if the program is terminated with a SIGINT, a brief summary is displayed. Shorter current statistics can be obtained without termination of process with signal SIGQUIT.

If ping does not receive any reply packets at all it will exit with code 1. If a packet count and deadline are both specified, and fewer than count packets are received by the time the deadline has arrived, it will also exit with code 1. On other error it exits with code 2. Otherwise it exits with code 0. This makes it possible to use the exit code to see if a host is alive or not.

This program is intended for use in network testing, measurement and management. Because of the load it can impose on the network, it is unwise to use ping during normal operations or from automated scripts.

Icmp Packet Details

An IP header without options is 20 bytes. An ICMP ECHO_REQUEST packet contains an additional 8 bytes worth of ICMP header followed by an arbitrary amount of data. When a packetsize is given, this indicated the size of this extra piece of data (the default is 56). Thus the amount of data received inside of an IP packet of type ICMP ECHO_REPLY will always be 8 bytes more than the requested data space (the ICMP header).

If the data space is at least of size of struct timeval ping uses the beginning bytes of this space to include a timestamp which it uses in the computation of round trip times. If the data space is shorter, no round trip times are given.

Duplicate and Damaged Packets

ping will report duplicate and damaged packets. Duplicate packets should never occur, and seem to be caused by inappropriate link-level retransmissions. Duplicates may occur in many situations and are rarely (if ever) a good sign, although the presence of low levels of duplicates may not always be cause for alarm.

Damaged packets are obviously serious cause for alarm and often indicate broken hardware somewhere in the ping packet’s path (in the network or in the hosts).

Trying Different Data Patterns

The (inter)network layer should never treat packets differently depending on the data contained in the data portion. Unfortunately, data-dependent problems have been known to sneak into networks and remain undetected for long periods of time. In many cases the particular pattern that will have problems is something that doesn’t have sufficient »transitions», such as all ones or all zeros, or a pattern right at the edge, such as almost all zeros. It isn’t necessarily enough to specify a data pattern of all zeros (for example) on the command line because the pattern that is of interest is at the data link level, and the relationship between what you type and what the controllers transmit can be complicated.

This means that if you have a data-dependent problem you will probably have to do a lot of testing to find it. If you are lucky, you may manage to find a file that either can’t be sent across your network or that takes much longer to transfer than other similar length files. You can then examine this file for repeated patterns that you can test using the -p option of ping.

Ttl Details

The TTL value of an IP packet represents the maximum number of IP routers that the packet can go through before being thrown away. In current practice you can expect each router in the Internet to decrement the TTL field by exactly one.

The TCP/IP specification states that the TTL field for TCP packets should be set to 60, but many systems use smaller values (4.3 BSD uses 30, 4.2 used 15).

The maximum possible value of this field is 255, and most Unix systems set the TTL field of ICMP ECHO_REQUEST packets to 255. This is why you will find you can »ping» some hosts, but not reach them with telnet(1) or ftp(1).

In normal operation ping prints the ttl value from the packet it receives. When a remote system receives a ping packet, it can do one of three things with the TTL field in its response:

• Not change it; this is what Berkeley Unix systems did before the 4.3BSD Tahoe release. In this case the TTL value in the received packet will be 255 minus the number of routers in the round-trip path.
• Set it to 255; this is what current Berkeley Unix systems do. In this case the TTL value in the received packet will be 255 minus the number of routers in the path from the remote system to the pinging host.
• Set it to some other value. Some machines use the same value for ICMP packets that they use for TCP packets, for example either 30 or 60. Others may use completely wild values.

• Many Hosts and Gateways ignore the RECORD_ROUTE option.
• The maximum IP header length is too small for options like RECORD_ROUTE to be completely useful. There’s not much that that can be done about this, however.
• Flood pinging is not recommended in general, and flood pinging the broadcast address should only be done under very controlled conditions.

See Also

History

The ping command appeared in 4.3BSD.

The version described here is its descendant specific to Linux.

Security

ping requires CAP_NET_RAWIO capability to be executed. It may be used as set-uid root.

Источник

ICMP ping flood code using sockets in C on Linux

ICMP Ping Flood

Icmp ping flood is a kind of DOS attack that can be performed on remote machines connected via a network. It involves sending a large number of ping echo requests (packets) to the target system such that it is not able to tackle so fast.

So the result is that the host either gets too busy into replying these echo requests that it gets no time to serve its original purpose, or it might crash or something similar.

If a machine connected to the internet gets flooded by such a large quantity of echo packets then it wont be able to process other network activities it was intended to, and will keep very busy in replying to the echo requests.

Defense against ping flood

Different machines handle this differently depending on the network security and kind of operating system setup etc. Slowly all machines connected to the internet are securing themselves from such dos attacks.

The most common technique is the use of a firewall, that will block the sending ip if it receives an unexpected amount of echo request.

Other techniques involve not replying to ping packets at all from over the internet. Each of the techniques has its own pros and cons and has limitations.

If its a website or online network then using the firewalls or other blocking policies would work well. If its a broadband router of a home user that is connected to internet, then flooding such a device will, depending on the make and model, either crash it or make it so slow that the users would be thrown off.

To test this out flood your own broadband router.

Ping Flood Code in C

In this post I am going to show you how to write a very simple program in c that will do this very thing called icmp ping flooding. The program will construct ping echo packets and send them to a destination in a loop, very fast.
Lets take a look at the code

Compile the program using gcc and run it.

So the output shows how many packets have been send. To ensure that the packets were indeed send out, use a packet sniffer like wireshark. Wireshark would show those packets (lots of them in same color).

If wireshark does not show any packets then the packets were generated from the above program but were not send out due to some reason.

For example, if a firewall is running then it might block such packets with spoofed source addresses. Also note that if you try to ping flood a LAN ip like 192.168.1.x and your machine is on the same subnet, then your kernel would first try to find out the hardware address of the other machine.

If the ip address does not exist, then the packets wont be send out and your own machine would reply with a desination unreachable message.

A Tech Enthusiast, Blogger, Linux Fan and a Software Developer. Writes about Computer hardware, Linux and Open Source software and coding in Python, Php and Javascript. He can be reached at [email protected] .

10 thoughts on “ ICMP ping flood code using sockets in C on Linux ”

when the payload_size is bigger than mtu,sendto will failed,I don’t know how to fix it!

I’m trying to implement ICMP Flooding mechanism. The flooding is successful only for some networks. It’s failing for some other networks. Why is this happening?

When running this it consistently fails to send the packets throwing an error with the message `send failed`.

When checking `errno` it shows a EINVAL error (invalid argument).

This code compiles out-of-box under Ubuntu 14 and runs. But it suffers from several things;

First is the call to rand(). I don’t understand what the point of doing this is because you could just pad out the packet with zeros, but if you must use “random” data for padding, the rand() call is extremely slow, and introduces significant delay in the code. More importantly, when rand() runs out of bits it blocks forcing the main loop to block.

A better way would be to take the “fastrand()” example code from here:

and use that. Secondly is the call to printf – this is slow as well – it would be better to rewrite the code to print a total number of packets sent over time when the program exits – and print nothing during the flooding time.

Another strange thing in there is that usleep() call, it should be commented out it is not needed, not under Ubuntu 14 at least.

With just these changes I’m able to do an actual flood ping that really does flood ping.

Interestingly, when comparing this code out-of-box with the operating system ping program “ping -f”, the OS ping throws out more traffic than this., However, after fixing the stuff I mentioned, this program can throw out about ten times the amount of traffic that a Linux ping -f command can.

Personally I suspect that the Linux ping command flooding ability is compromised because it is sending the traffic through iptables and such.

Its fake , when i dump traffic in network it doesnt show nothing , so its not real as icmp flooder , the developer should fix it

The inclusion of arpa/inet.h is necessary to prevent implicit declaration of inet_addr in the code. I can’t get the socket to connect. I keep getting “could not create socket: Operation not permitted.” I’ll compare it to your other articles on sockets, which work wonderfully, to see if I can see the difference.

Thanks again for great resources for those of us learning to program!

Love your articles!

On this one, if you have time, I’m getting “implicit declaration of function ‘inet_addr’ as a warning. Of course, the code runs fine. I’m also not able to open a socket, though the socket programs in your other articles open just fine.

Do you have any ideas for me to clean up the warning and troubleshoot the socket problem?

Thanks again for great, informative articles!

include the following header file

the “implicit declaration” errors come up due to missing header includes.

run the program with root privileges. the above program creates raw sockets for which it needs root privileges on linux. on ubuntu for example run it with sudo.

Could not create socket. Operation not permitted.

Источник