Hi All, I am trying to resolve short name in my TDI filter. The short name is not resolvable in the local host/DNS. I would like to pass this short name to the socks server for resolution.
I am getting ip xx.xx.xx.255 with port 137/138/139 response(RFC 1002/1003)in TDI_CONNECT for short name request frm IE. Its a local broadcast address.
Following steps I followed & working fine.
- The NBNS request are filtered in the driver & sent to my SSLClient application.
- During Every application(IE) request, I am creating a listening socket for to accept data IN for the application & another socket to send data to my socks server.
- Read NBNS packet, Encrypted NBNS Request are converted in to text format (Decode Algorithm) to identify the short name request requested in the upper layer(IE). This details are available in RFC 1002 & 1003.
- The decoded short name sent to the socks server to resolve the same.
- Socks Server returning the resolved IP that are configured in the clean side DNS.
Following are not working
- Formed NBNS response as per RFC 1001 & 1002. This packet formate is not IP formate. This contains 4bytes of header/flag(Not clear), Destination Ip, Destination port , length of pkt, NBNS Response. There is no source ip/port information. 90 % sure NBNS packet I formed is correct except first 4 bytes. If anybody know detail on this please send the info.
- Using sentto command sent NBNS response packet to the upper layer(Sent to listening loop back ip/port). Shows No.of bytes sent with status success. I am trying to send the NBNS response packet to the application that requested the NBNS to give acknowledge. Before I send NBNS response to the application(IE) requested, IE is getting completed with "The Page Can not be displayed". There is no response on the NBNS response i sent to the application. Pls give me detail regarding this.
In general the broadcast NBNS packets are sent to all PC's, Whoever is having a match on the short name will respond with NBNS response, But in my application I am forming NBNS reply & there is no option to get/specify source ip/port info. I am specifying destination ip as 127.0.0.1 & port as 137. Please give me detail regarding this.
Note: a. The packet received in the TDI level is not the exact Ethernet packet format as we are looking in ethereal. b. Partially some fields are identified & remaining are still i am investigating(may be it represents NBNS request/flags).
Regards, srmjothi