学步园

      udp是一种无连接的传输层协议，不像tcp在传输数据前要先发起连接，因此要可以说没有办法阻断udp之间的通讯。有一些资料称可以伪造目的主机发出目的端口不可达的ICMP报文，从而误导源主机中止与目的主机的udp通讯，伪造icmp目的端口不可达的代码如下：

      int ForgedICMP(char *srcIP, char *dstIP, void *forgedData, int count)<br /> {<br /> char buff[2048] = {0};<br /> char *ptr = buff;<br /> ip_header iph;<br /> icmp_header icmph;<br /> int num = 0;<br /> unsigned int isrcip;<br /> unsigned int idstip;</p> <p> unsigned short iTotalSize = sizeof(ip_header) + 8 + count;<br /> unsigned short iICMPSize = 8 + count;<br /> struct sockaddr_in server;</p> <p> if(createSocket()<0) return -1;</p> <p> iph.ip_vhl = (4 << 4) | (sizeof(ip_header) / sizeof(unsigned long));<br /> iph.ip_tos = 0;<br /> iph.ip_len = htons(iTotalSize);<br /> iph.ip_id = htons(17393);<br /> iph.ip_off = 0;<br /> iph.ip_ttl = 255;<br /> iph.ip_p = IPPROTO_ICMP;<br /> iph.ip_sum = 0;<br /> isrcip = inet_addr(srcIP);<br /> idstip = inet_addr(dstIP);<br /> memcpy(&iph.ip_src, &isrcip, 4);<br /> memcpy(&iph.ip_dst, &idstip, 4);<br /> iph.ip_sum = checksum((unsigned short *)&iph, 20);</p> <p> icmph.type = 3;<br /> icmph.code = 3;<br /> icmph.checksum = 0;<br /> icmph.id = 0;<br /> icmph.seq = 0;<br /> memcpy(icmph.data, forgedData, count);<br /> icmph.checksum = checksum((unsigned short *)&icmph, iICMPSize);</p> <p> memset(buff, 0x00, 2048);<br /> ptr = buff;<br /> memcpy(ptr, &iph, sizeof(ip_header));<br /> ptr += sizeof(ip_header);<br /> memcpy(ptr, &icmph, iICMPSize);</p> <p> server.sin_family = AF_INET;<br /> server.sin_addr.s_addr = inet_addr(dstIP);</p> <p> num = sendto(sockfd, buff, iTotalSize, 0, (struct sockaddr *)&server, sizeof(struct sockaddr)); </p> <p> return num;<br /> }

      试验证明这种方法没有任何效果，现在的udp程式会忽略icmp端口不可达的报文，继续进行通讯。

      还有一种方式是arp欺骗，控制系统伪造arp响应包，改变主机arp缓存中的mac地址，这样主机所有的数据都会发往伪造的mac地址上，这种方式称为网关欺骗。但是arp欺骗不容易控制，主机每隔一段时间就会发出arp request报文，伪造的arp响应包不一定会比真实的网关发出的报文快，这样就会造成主机一会儿连接上，一会儿有断网的现象，同时arp欺骗还容易引起严重的后果，比如造成局域网内所有的机器都断网。

      arp欺骗的原理和示例代码：http://blog.chinaunix.net/u2/62281/showart_1206130.html

      这样看来要阻断udp通讯是不可能的事了，其实办法还是有的，只要伪造目的主机发出相应的udp报文给源主机，同样能达到阻断udp通讯的效果。

      int ForgedUDP(char *srcIP, char *dstIP, int srcPort, int dstPort, void *forgedData, int count)<br /> {<br /> char buff[2048] = {0};<br /> char *ptr = buff;<br /> ip_header iph;<br /> udp_header udph;<br /> psd_header psdh;<br /> int num = 0;<br /> int ret_val;<br /> unsigned int isrcip;<br /> unsigned int idstip;</p> <p> unsigned short iTotalSize = sizeof(ip_header) + sizeof(udp_header) + count;<br /> unsigned short iUdpSize = sizeof(udp_header) + count;<br /> struct sockaddr_in server;</p> <p> if(createSocket()<0) return -1;</p> <p> iph.ip_vhl = (4 << 4) | (sizeof(ip_header) / sizeof(unsigned long));<br /> iph.ip_tos = 0x0;<br /> iph.ip_len = htons(iTotalSize);<br /> iph.ip_id = 0;<br /> iph.ip_off = 0;<br /> iph.ip_ttl = 55;<br /> iph.ip_p = IPPROTO_UDP;<br /> iph.ip_sum = 0;<br /> isrcip = inet_addr(srcIP);<br /> idstip = inet_addr(dstIP);<br /> memcpy(&iph.ip_src, &isrcip, 4);<br /> memcpy(&iph.ip_dst, &idstip, 4);<br /> iph.ip_sum = checksum((unsigned short *)&iph, 20);</p> <p> udph.uh_dport = htons(dstPort);<br /> udph.uh_sport = htons(srcPort);<br /> udph.uh_ulen = htons(iUdpSize);<br /> udph.uh_sum = 0;</p> <p> psdh.s_addr = isrcip;<br /> psdh.d_addr = idstip;<br /> psdh.mbz = 0;<br /> psdh.protocol = IPPROTO_UDP;<br /> psdh.tcpl = htons(iUdpSize);</p> <p> memcpy(buff, &psdh, sizeof(psd_header));<br /> memcpy(buff+sizeof(psd_header), &udph, sizeof(udp_header));<br /> memcpy(buff+sizeof(psd_header)+sizeof(udp_header), forgedData, count);<br /> udph.uh_sum = checksum((unsigned short *)buff, sizeof(psd_header)+sizeof(udp_header)+count);</p> <p> memset(buff, 0x00, 2048);<br /> ptr = buff;<br /> memcpy(ptr, &iph, sizeof(ip_header));<br /> ptr += sizeof(ip_header);<br /> memcpy(ptr, &udph, sizeof(udp_header));<br /> ptr += sizeof(udp_header);<br /> memcpy(ptr, forgedData, count);</p> <p> server.sin_family = AF_INET;<br /> server.sin_port = htons(dstPort);<br /> server.sin_addr.s_addr = inet_addr(dstIP);</p> <p> num = sendto(sockfd, buff, iTotalSize, 0, (struct sockaddr *)&server, sizeof(struct sockaddr)); </p> <p> return num;<br /> }