3

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send a replay of a battle from a game online to farm for rewards, in case you're wondering).

I read here that TCP/IP ignores packets with repeated sequence numbers. So, am I on the right track in thinking that new sequence numbers are created every time that first SYN packet in this group of packets is sent, and the rest of the packets are ignored because of it? How can I now these new sequence numbers and replay them accordingly?

If I'm way offbase, lemme know. I've replayed the packet as-is, and it replays fine, but I'm not gaining items/xp so I figure the packets must be getting ignored by the server.

Improve this question
4
  • You should use a MITM proxy and replay the data, not the packets. There's no guarantee that replaying the packets will work with the protocol being used. If they don't get ignored, then they are very likely to cause the connection to be closed for invalid data.
    – Darth Android
    Jul 24, 2013 at 18:36
  • I tried downloading mitm proxy, but the only installation instructions are via pip. I've tried for around 45 minutes now to install pip, but I can't figure it out. I already downloaded setup tools. The line ($ sudo easy_install pip) I was told to use in the tutorial just comes back as invalid syntax.
    – Grace
    Jul 24, 2013 at 19:47
  • I got it downloaded, finally. Installed mitmproxy. Can't figure out how to open it.
    – Grace
    Jul 24, 2013 at 20:32
  • Errr, a proxy is a generic type of application, I wasn't recommending a specific piece of software.
    – Darth Android
    Jul 24, 2013 at 20:56

1 Answer 1

Reset to default
3

Certainly you must change the sequence numbers of the peer at least according to its first reply. At the start of TCP connection (TCP handshake) each of the communication parties generates its own pseudo-random initial sequence number. The sequence numbers then grow by number of bytes of data being transmitted and really the packets are refused if the sequence number is wrong.

There are existing tools which will do the sequence number translation/regeneration for you and replay the single side part of the captured TCP stream.

  • Tcpreplay is a very useful set of tools for modifying and replaying of captured traffic. The tool for replaying TCP is tcpliveplay
  • Wireplay is another, more simple tool.

More info about TCP: Transmission Control Protocol - Operation

Improve this answer
3
  • I actually tried to download tcpreplay before colasoft, but couldn't manage to install it. Same with bittwist. I downloaded the cygwin1.dll and put it the system32 directory as instructed, but it still comes back that the file was missing from my computer. Are there any windows equivalents to tcpreplay that don't require cygwin?
    – Grace
    Jul 24, 2013 at 19:50
  • Excuse me, I did not know that the tool should be for Windows. I am afraid that bittwist cannot translate the TCP sequence numbers. I do not know any such a tool for Windows. If you want to try tcpreplay of other Linux tool I would recommend the following options in the order of preference: 1: Run Linux in a virtual machine. 2: Boot live Linux from a flash drive. 3: Do a regular installation of Cygwing and compile tcpreplay. Good Linux distribution for similar tasks is BackTrack which should already contain tcpreplay and other useful tools.
    – pabouk - Ukraine stay strong
    Jul 25, 2013 at 16:19
  • 1
    BTW there is another Linux tool capable of TCP replaying with sequence number translation: tcpcopy. It is even distributed and can duplicate the TCP session in real time! And I agree with Darth Android that often it is easier to replay just the stream. Instead of capturing it on a proxy you can assemble and export the stream in Wireshark using the Follow TCP stream function.
    – pabouk - Ukraine stay strong
    Jul 25, 2013 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .