Welcome to MSDN Blogs Sign in | Join | Help

Michael Howard's Web Log

A Simple Software Security Guy at Microsoft!
A little more info on raw sockets and Windows XP SP2

There's been a little confusion about raw sockets and Windows XP SP2. Hopefully, this little entry from the "Changes in functionality..." doc (see my last blog entry for an URL to the doc) should explain things a little better:

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

  • TCP data cannot be sent over raw sockets.
  • UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.
     
Posted: Thursday, August 12, 2004 10:10 AM by michael_HOWARD
Filed under:

Comments

Robert Hurlbut's .Net Blog said:

# August 12, 2004 2:00 PM

Robert Hurlbut's .Net Blog said:

# August 12, 2004 2:29 PM

Robert Hurlbut's .Net Blog said:

# August 12, 2004 2:36 PM

Open-node.net said:

# August 13, 2004 2:12 AM

Open-node.net said:

# August 13, 2004 2:13 AM

Sergey Simakov blog said:

# August 13, 2004 2:40 AM

Sergey Simakov blog said:

# August 13, 2004 3:27 AM

RM said:

Just wondering...
# August 25, 2004 10:23 AM

RobertGas said:

*We have removed support for TCP sends over RAW sockets in SP2.
We surveyed applications and found the only apps using this on XP were people writing attack tools.*

Esto es lo que MS respondi a la pregunta de "Por qu Nmap ya no funciona con el Serv
# August 26, 2004 4:14 AM
New Comments to this post are disabled
Page view tracker