RockSaw Frequently Asked Questions

The latest version of this software is now maintained by Savarese Software Research Corporation. You can find the new project page at https://www.savarese.com/software/rocksaw/

RockSaw FAQ

1. Why do I get an “invalid argument” error when I try to write to a TCP raw socket?
2. Why can't I send TCP packets on Windows XP?
3. Why can't I establish a TCP connection?
4. Why can I get replies to ICMPv6 echo requests on POSIX systems but not on Microsoft Windows?
5. Where's the name come from?

1.	Why do I get an “invalid argument” error when I try to write to a TCP raw socket?
	java.io.IOException: An invalid argument was supplied. at org.savarese.rocksaw.net.RawSocket.__throwIOException(RawSocket.java:) at org.savarese.rocksaw.net.RawSocket.write(RawSocket.java:) This problem occurs only under the Windows family of operating systems. It occurs when you open a raw socket in the TCP protocol family (IPPROTO_TCP) and then try to write to it. Windows does not support writing to IPPROTO_TCP raw sockets even though it allows you to create one. It does, however, support IPPROTO_UDP. In order to write TCP packets via a raw socket on Windows, you have to open the socket with either IPPROTO_IP or IPPROTO_RAW. Then you have to set the IP_HDRINCL socket option and populate both the IP and TCP headers of each packet. What this means in terms of RockSaw is that on Windows you have to use `RawSocket.getProtocolByName("ip")` and `setIPHeaderInclude(true)`.
2.	Why can't I send TCP packets on Windows XP?
	New restrictions on raw socket functionality were imposed in Windows XP SP2. If you're running Windows XP SP2, you cannot send TCP packets (but you can still receive them), nor can you spoof the source address of IP packets. The source address must exist on a local network interface.
3.	Why can't I establish a TCP connection?
	Even though you can send TCP packets with a raw socket, the operating system's TCP/IP stack will process incoming TCP and UDP packets. When you send a TCP SYN packet with a raw socket, the destination's response will be rejected by the operating system because it is unaware of the SYN you sent. Therefore, you cannot complete a three-way handshake.
4.	Why can I get replies to ICMPv6 echo requests on POSIX systems but not on Microsoft Windows?
	The Microsoft Windows family of operating systems does not calculate the ICMPv6 checksum for outgoing ICMPv6 packets. Therefore, you have to calculate the checksum yourself. This can be tricky because you have to determine the address of the outgoing network interface, which can vary on multi-interface systems depending on the available routes. See the example.Ping source code to see how to compute the required checksum and send an ICMPv6 echo request on Windows.
5.	Where's the name come from?
	($rocksaw="SOCK_RAW\n")=~s/(.)([^_]+)_(.)(.+)/$3\L$2\E$1\L$4\E/&&print$rocksaw