Subject: RE: TCP/IP

From: "Chris Evans" <[email-masked]>
Date: Mon, 27 May 2002 04:06:37 -0700

TCP-IP stacks vary widly across platforms. What OS are you refering
to?   Sounds like you want to hack into the stacks entry point ;o)
not good idea unless you know how exactly it will behave once ya
jmp'd into the fray.. more likly ya get a gosub with out a return.

---- Original Message ----
From: [email-masked]
To: [email-masked]
Subject: RE: TCP/IP
Date: Mon, 27 May 2002 02:50:51 -0400

>Does anyone know the memory address(es) of the TCP/IP stack? Where 
>it's
>located in memory and how it is loaded?
>
>

---

From: "Bill Cunningham" <[email-masked]>
Date: Mon, 27 May 2002 09:38:12 -0400

Win98 is what I use mostly I also have linux. Your right I'd like to enter
the stack's entry point. Do you know how it loads and expands into memory?

---

From: [email-masked]
Date: Mon, 27 May 2002 10:38:13 -0400

> Win98 is what I use mostly I also have linux. Your right I'd like to enter

For Linux, you have the source - go poke around in /usr/src/linux/drivers/net
which contains the bottom half of the stack (the device drivers).  The
top half, which does protocol support, is under /usr/src/linux/net/*.

Please note that from userspace, you want to be using the provided syscalls,
as you will most certainly generate an error if you go calling kernel code
without a firm understanding of what you're trying to do and why.

I'd certainly stay *FAR* away from any system's TCP stack internals until
I had read *and understood* at least the first volume or two of Comer's books,
and for Unix/Linux, Steven's "Unix Network Programming".  If you don't
recognize those 2 references, you're not ready. ;)

I think you're getting confused by terminology - although many programs
have their function entry points on a "stack", which is vulnerable to
tweaking by buffer overflows and other malware, the entire networking
subsystem is *also* referred to as a "stack" (which makes sense once you
understand the basics of the OSI 7-layer burrito^H^H^H^H^Hmodel).  As such,
the networking code doesn't really *HAVE* a distinct entry point - it's being
called many ways for different things - from userspace via the syscall
interface (to open/bind/send/receive/close a connection), to/from device
drivers to receive packets and queue packets for transmission, hooks into
the system timing services for callbacks to maintain retransmit timers,
and so on.

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech