Until now I know all network devices have IP addresses because someone may want to send something to it. But no one wants to send a packet to a device like a firewall or load balancer, as they just connect networks. I wonder if they have an IP address or not.
A firewall or loadbalancer will have an IP address as you need to direct the packets to either of the devices for it to work it's magic, if its a firewall then you will want to block outgoing or incoming traffic, if you have loadbalancers then you will want to let that decide which node behind the LB that is able to process the incoming request.
Not always. Some proxy devices are just 'bumps in the wire'.
Related
I'm writting a simple network sniffer that should be able to reconstruct network structure.
When an interface has set up a DHCP, I can easily read interface settings such as client IP address, subnet mask, DNS server etc. by catching a DHCP packet and analysing it.
When an interface has a static IP, I'm catching ARP Announcement packet to get static IP address and then ARP request from the gateway, to get geteway IP address. I'm also saving MAC addresses.
My problem is: how to get subnet mask from one or more static IPs in the network and the gateway address. Or by caching some packets. I didn't see packets that could have such informations.
I also need DNS address, but it's less important.
The program should work in OpenWRT (C++).
My problem is: how to get subnet mask from one or more static IPs in the network and the gateway address.
Possibly, you can't.
If the sniffed network uses DHCP then you can monitor the DHCP requests (which should be broadcast) for their subnet mask and router fields which mirror the server's offer.
Without DHCP, all you can do is take an educated guess. If your passive sniffer registers broadcasts from addresses 192.168.1.1 through 192.168.1.29, you know that the prefix length is at most /27. It could also be anything shorter, down to /16, with potential addresses being (currently) absent or silent. The prefix could be even short than /16 if the network admin is ignoring RFC 1918. With public addresses you're mostly on your own.
If you can scan actively you could send ARP requests and see which ones get answered - you'd also see nodes that don't originate any traffic/broadcasts.
The gateway is also just a guess. In a network with mostly Internet-bound traffic, the default gateway is most likely the one being ARPed most often. If the network traffic is mostly server-centric, ARP requests for their addresses outnumber the ones for any gateway.
Your sniffer is severely limited when it is just attached to a switch and listening to broadcast packets only. If the sniffer manages to listen to all traffic on the network (via a monitoring/mirroring switch port) then you can easily identify the gateway by its MAC address that packets for arbitrary IP addresses is sent to and vice versa.
As above, if you can actively send probe packets you could test the gateway(s) with packets that they accept (and hopefully forward) and which ones they reject.
I'm new to the networking world and I'm using Wireshark to learn stuffs about the network.
I was hanging around in Wireshark while I was using my VPN for circumventing the internet filter (living in a dictatorship country).
While I was using the VPN I see packets that their source or destination IP was neither my IP nor VPN server IP.
I considered two things about my problem:
1- I know my VPN uses its VPN server to send my whole packets to that server then forward them to my deserved destination, then take the response and send it to my client (is that correct?).
2- In Wireshark, I just can see the packets that their either source or destination address is my IP address.
My packets before using VPN:
As you can see, their either source or destination IP is my IP (192.168.1.101).
After using VPN, VPN:
Wireshark:
I tried filtering packets with my IP like this ip.addr == 192.168.1.101 to see only the packets that their either source or destination IP was my private IP, and guess what? nothing was changed. Why did this happen? Wasn't that supposed to filter my packets?
I also checked those packets' MAC and compared them with my MAC, and they were identical.
So my main question is why these kinds of wandering packets were showed by Wireshark? Is my VPN client insecure and trying to sending my data to other places? Or I'm wrong about how my VPN works?
Also, I appreciate it If somebody tells me more explanation about how my VPN or Wireshark works so that I have these types of packets in my Wireshark.
First of all your considerations, point no.1 is right, that's how a typical VPN works and point no.2 is wrong.
Wireshark can capture any packet (any source IP or destination IP) flowing in and out of a network adapter technically known as NIC card. NIC cards are the way through which you can connect to a network (Internet). A quick brief of NIC over here
A typical VPN client software would form a virtual NIC to encrypt and send your traffic through it. A quick brief of VPNs over here
So, to see the required traffic in Wireshark, you must capture traffic from an appropriate interface (NIC card). The answer over here might be helpful.
That's essentially my question. Isn't the network portion in a computer's IP address so that, when it is sent, other computers can look at that network portion and know where to send it back to? So why do routers have their own IP address?
The router needs to be a node on the same network as the computer using it. When your PC tries to communicate with a system on a different network, it consults it's routing table to figure out which router (there can be several) has the route to the destination. Without an IP on the router, there would be no way to send packets to the router, and thus no way to get out of your network.
I suppose the IP protocol could have been designed to use broadcasts to find the route out, but that would have caused issues with traffic congestion. Thankfully it wasn't designed like that.
I'm trying to send UPD packets from node A to node B, both are connected to internet through different routers.
I am able to send (and receive) UDP packets between them when they connected on the same network by giving the local destination ip adddress (192.168..) and port number.
Now I'm finding the dynamic ip address of node B using www.whatismyip.com and consider it as w.x.y.z
When I send the packets from A to this destination, I'm unable to receive them at B. I've also setup port forwarding on both the routers.
This is completely new to me. Is there is something else that needs to be done when I want to send packets to a node connected on another network? Please help!!
I can suggest something to check:
Port Forwarding in both the router are configured for the UDP protocol?
If you ping the remote address w.x.y.z, you receive a response? (check if the routers are configured to do so)
Verify also if there are firewall that block the UDP packet that arrives from the Internet (on the routers or on the target machine).
The thing that you can not receive them at B is because NAT will filter all the messages if you haven't build a connection in the netfilter's table. The way to solve the problem is to use a port mapping like UPNP or NAT-PMP. In this way, the destination node's specific port will receive any message from WLAN and send it to this node. But this needs your router support these protocols, if not, maybe you need to use ICE as a realy server to realize it.
Good Day,
I basically have a laptop connected to the internet with a fixed IP Address. I need to have a way for a server possibly though a PHP script, send data/string to the laptop and it is able to receive it.
Now, if I was within a local network, i could do that. But what if I wanted to send from an external network? Do devices have a particular address that I can access from any internet connection?
Do devices have a particular address that I can access from any
internet connection?
No, it does not, unless you do use external IP for your laptop (doubtfully).
The easiest and fastest solution I could think of is to do the other way round: open TCP or UDP socket on your server and use laptop to connect and request data from the server. Of course, it is not suitable for all scenarios, but in many cases it works. Write more information (what is the purpose of this? What are the requirements and limitations?) so more specific answer may be provided.
OK, to make things easier to explain, let's say:
- Your router's public IP address is 10.10.10.10
- Your laptop's private IP address is 192.168.0.1
- You want to communicate via port 80 (since you mentioned PHP)
What you need to do is configure your router so that it forwards packets destined to 10.10.10.10:80 to 192.168.0.1:80. This is the simplest form of NAT.
Then from anywhere else with an Internet connection, you can send packets to your laptop by sending packets to 10.10.10.10:80.