Scapy SYN sends to our own IP address

Question

I tried to send SYN packets to my local network and track them using Wireshark, and everything works fine, except when I try to send a packet to my own IP address, which it seems to work, because it says I sent packet 1, but it’s not actually sent, I don’t see the packet in Wireshark and there are no responses to the packet. My setup is Computer A (192.168.0.1) with a Socket Socket Server listening on port 40508, and Computer B (192.168.0.2).

On computer B, I test:

ip=IP(src="192.168.0.2",dst="192.168.0.1") SYN=TCP(sport=40508,dport=40508,flags="S",seq=12345) send(ip/SYN) 

It works fine, I see a SYN packet on Wireshark and a SYN / ACK response from 192.168.0.1

On computer A, I test:

 ip=IP(src="192.168.0.1",dst="192.168.0.2") SYN=TCP(sport=40508,dport=40508,flags="S",seq=12345) send(ip/SYN) 

It works fine, I see the SYN packet and RST / ACK (the server does not listen on port 40508 on 192.168.0.2, so it sends an RST / ACK response) from 192.168.0.2

But when I try to use computer A:

 ip=IP(src="192.168.0.2",dst="192.168.0.1") SYN=TCP(sport=40508,dport=40508,flags="S",seq=12345) send(ip/SYN) 

In Wireshark, nothing appears, as if the packet was never sent, but he said, like other tests: sent 1 packet. and didn’t answer anything. If I run the same test on computer B and try to send a packet to my own IP address, I had the same problem.

For my program, I really need to send a SYN packet to my own IP address, is there a way to do this or is it impossible?

Thanks in advance,

Nolhian

Answer 1

Which network device is your Wireshark installation? I suspect that he is listening on a real network card (ethernet, wifi or otherwise, according to the Wireshark FAQ ) - and when sending from a computer to it, the OS can, of course, bypass the device (why bother with this?) And just do the “sending” by copying bits to the TCP / IP stack in the kernel.

In other words, I suspect your packet is being sent OK, just Wireshark might not see it. To test this hypothesis, you can try (for example) to use your browser to visit existing and nonexistent ports on your local machine and see if Wireshark sees these packets or not.