inserting a packet into a stream

[keithja]

Hello,

I have a problem I hope someone knows a way around. Because of the somewhat unusual nature of the request, let me give some background information.

I mother a network of 3 sites. I use Network Instruments Observer Suite for monitoring, etc. Although we are moving to a single vendor infra-structure, we aren't there yet. Among others, we have a few Baystack 350-24T's: these are the problem. On Telnet sessions, they require a CTRL-Y to get past the splash screen.

I wish to use Observers telnet scripting ability to loop through the switches ports, mirroring each port in turn to a monitor port. I could do this with other products, but by using Observer scripting, it neatly compartmentalizes each port's traffic and does graphs, etc.

The problem is that Observers scripting can't send a CTRL-Y. (or hex codes).

I can monitor the data stream between my probe and the switch, and using observers packet generator, build a packet containing H19 (cntrl-Y) to the switch, making it look like it came from the probe.

To do this, I set the source and destination addrs (both mac and ip) to look like the packet is from the probe(P) and to the switch (SW).

I get the probes TCP port number from the last packet it sent (seen via a network capture) and also that packets ID number. I set the port number for the manufactured (C) packet, and set its ID to captured packet ID +H100.

I set the Seq# of the manufactured(C) packet = to the ack# of the last (SW) packet

I set the ACK# of the (C) packet = to the SEQ# of the (SW) packet

And of course I set the data to H19.

This works to a degree. The switch sees and accepts the packet and advances past the splash screen. Unfortunately, it then generates a TCP ACK storm and desyncs communications between the probe and the switch. I see the probe sending further packets to the SW but the SW doesn't respond to them.

Does anyone know of a way I can restore synchronization to the stream so the script can go on it's merry way? Or alternately, does anyone know a way around the CTRL-Y splash screen? (the only chars I can send via the script are all alpha-numerics, [tab] [enter] arrows, and [esc], none of which allow one to send hex chars or cntrl-y

 

[JasonDeckard]

The TCP ACK storm happens because the client you're spoofing receives an acknowledgement for packets it did not send, and this greatly annoys the client.

I believe the solution will have to be found on the client side by getting the client to somehow send the CTRL-Y. Is it possible to solve this problem by using a tool other than "Observer"?

Regards,
Jason Deckard

 

[keithja]

No, unfortunately it's not possible to use something else. At least not with anywhere close to the same degree of functionality. By using observer scripting, it neatly compartmentalizes all of the data it sees for each port and reports on each port individually. Using another tool, you would just have an aggregate of snapshots of each port with no way to tell where the snapshot boundaries are, or what port they're from (actually not no way but no reasonable way).

I am sending the CNTRL-Y from the same client, unfortunately it's external to the existing TCP stream, which for all purposes is the same as a different client...
sigh...

Thanks for your input...
ka